Privacy Policy
Last updated: November 13, 2026
Daily Console is built and operated by One Trick Pony ("we," "our," or "us"). This policy explains what we collect, how we use it, and the choices you have. We've kept it short and plain.
What we collect
Account information. When you sign up, we collect your email address and any other information you provide directly (such as your name).
Data from connected services. Daily Console works by pulling information from services you connect, such as Apple iCloud (CalDAV), Google Calendar, iCal subscription feeds, Oura, Todoist, and weather providers. We access only the data needed to display your personal dashboard. We do not sell or share this data. Each user's data is completely separate - our database uses row-level security to enforce that no account can read another account's rows, ever.
Usage data. We collect basic information about how you use Daily Console — which features you open, how often you sign in, what device you're on. This helps us improve the product. We use PostHog for product analytics, which processes this information on our behalf.
Payment information. When you subscribe, payments are processed by Lemon Squeezy. We do not see or store your credit card details. Lemon Squeezy is the merchant of record and has its own privacy policy at lemonsqueezy.com/privacy.
What we do with it
What we don't do
Third-party services we use
Each of these has its own privacy policy. Connections to your accounts use OAuth or similar standards, and you can disconnect them at any time from your Daily Console settings.
Your choices
Data retention
We keep your account data for as long as your account is active. If you delete your account, we delete associated data within 30 days, except for records we're legally required to retain.
International users
Daily Console is operated from the United States. By using it, you consent to your information being processed in the United States.
Children
Daily Console is not intended for anyone under 16. If we learn we've collected information from someone under 16, we'll delete it.
Changes to this policy
If we make material changes, we'll let you know by email and update the date at the top of this page.
How we protect your data
Encryption in transit. All connections between your browser, Daily Console, the database, and the third-party services we integrate with use TLS (HTTPS). This includes the OAuth flow when you connect Google Calendar, every subsequent sync to Google's APIs, and every page load.
Encryption at rest. All user data, including your account record and the synced data we cache from connected services, is stored in our Supabase Postgres database, where the underlying storage is encrypted at rest using AES-256. Database backups use the same encryption.
Row-level security. Every table containing user data enforces row-level security policies at the database layer. A user can only access rows where the row's user_id matches their authenticated session. A database-level event trigger automatically applies row-level security to any new tables we create.
Credential storage. OAuth refresh tokens (Google Calendar, Microsoft 365) and app-specific passwords (iCloud) are stored in your individual account row, protected by the row-level security described above and by the at-rest encryption of the database. They are only transmitted over TLS to the relevant provider's token endpoint when we need to refresh your access.
Access controls. Daily Console is operated by a sole proprietor; there is no customer-support team or other staff with routine access to production data. Administrative access to our production database, hosting, and source-code infrastructure requires multi-factor authentication.
Deletion. When you disconnect Google Calendar, Microsoft 365, or iCloud from Settings, we revoke the credential or OAuth grant where applicable and delete the cached events synced from that service. When you delete your account, all account data including all synced sensitive data is permanently removed from our active database within 30 days; encrypted backups containing your data roll off within an additional 30-90 days depending on backup retention.
Google user data
Daily Console requests read-only access to your Google Calendar events via the https://www.googleapis.com/auth/calendar.readonly OAuth scope. We never modify, create, or delete events.
Calendar data is fetched only to display in your personal dashboard. It is not shared with third parties, never used for advertising, never sold, and not used to train AI or ML models. Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Calendar events are stored in your private account in our Supabase database, isolated by row-level security, and used only to render your dashboard. You can disconnect Google Calendar in Settings at any time, which revokes the OAuth grant with Google and deletes both the stored refresh token and the cached Google Calendar events for your account.
We do not allow humans at our company to read your Google user data, except (a) with your explicit consent, (b) for security purposes, (c) to comply with applicable law, or (d) where the data has been aggregated and anonymized.
The Daily Console iPhone app
The iPhone app for iPhone Duo works a little differently from the web app, and this section covers what it does.
Signing in. You can sign in with an email address and password, or with Sign in with Apple. With Sign in with Apple, Apple shares your name and an email address with us, which can be a private relay address if you choose to hide your email.
Calendars and reminders. With your permission, the app reads the calendars and reminders already on your iPhone, from the calendars and lists you choose. This data stays on your iPhone. It is shown on your dashboard and widgets and is not sent to our servers.
Location. If you choose "Use my location", the app asks iOS for your approximate location once. We save the coordinates and the place name in your account settings so your weather is local, and we send the coordinates to Open-Meteo to fetch weather and air quality. You can type a city instead, or change it at any time in Settings.
Weather, air quality and headlines. The app fetches these directly from Open-Meteo and Google News. Those services see your device's IP address, as any website would, but not your account.
Oura and Todoist. If you connect them, your access tokens are stored in your account settings, as on the web, and the app fetches your data from Oura and Todoist directly.
Subscriptions. Purchases in the iPhone app are made through the App Store, and Apple processes the payment. We never see your payment details. Apple sends us a record of the subscription (the plan, its status and its renewal date), which we link to your account so it unlocks Daily Console.
No analytics. The iPhone app does not include product analytics or advertising tracking.
Deleting your account. You can delete your account from the app's Settings, under Account. This permanently deletes your account and the data we hold for it. An App Store subscription is managed by Apple, so cancel it in your Apple account settings as well.
Contact
Questions about this policy? Email info@onetrickpony.net.