Privacy Policy
Last updated October 27, 2026
Daily Writing Minutes is made by Aurelius Omega LLC ("we"). This policy covers the Mac and iPhone apps and the backup service at api.dailywritingminutes.com. The short version: your writing stays on your device unless you turn on backup, and with backup on it is encrypted on your device so that we can't read it.
Without backup
Your writing, timer history and settings are stored only on your device. We have no account for you and receive nothing. The apps contain no analytics, advertising, tracking or crash-reporting code.
The Mac app checks app.dailywritingminutes.com for updates. That request carries your IP address and app version like any web request, and is not linked to anything else.
With backup and sync
Backup is optional. When you turn it on, we store:
- Your email address, to sign you in with a one-time code. There is no password.
- Your writing, encrypted. Each day is encrypted on your device with AES-256-GCM before upload, under a key that only your passphrase or recovery key unlocks. Neither ever leaves your device. We store the ciphertext, filed under an opaque ID instead of the date, and can't decrypt it. We can see how many entries you have, their sizes and when they were uploaded. We keep up to 50 earlier versions of each day while you write it, so a sync conflict never loses writing, and the last 3 once it has been unchanged for 30 days.
- Your encrypted key, wrapped once by your passphrase and once by your recovery key.
- A random ID for each device, made by the app, with when it first and last synced. It is not your device's advertising identifier or serial number.
- Whether you bought sync: for an App Store purchase, Apple's transaction ID and a random token that ties it to your account; for a purchase on the Mac, Stripe's payment ID. Apple and Stripe handle payment; we never see card details.
We count downloads of the Mac app and its checks for updates. Each count keeps only the file or app version, the country, and the website the download link was on, never your IP address, a cookie or anything else that identifies you.
Signed-in sessions don't record your IP address or browser. To stop abuse of sign-in emails we briefly keep a one-way hash of the email address a code was sent to, and counters keyed by IP address. Both are deleted about a day later (within 25 hours), as are unused sign-in codes once they expire.
If you lose both your passphrase and your recovery key, and no unlocked device remains, nobody, including us, can recover your backup.
Who processes data for us
- Cloudflare runs the backup service, its database and sign-in emails, and keeps operational request logs for a few days.
- Apple processes App Store purchases under its own privacy policy.
- Stripe processes purchases made on the Mac, including your email, payment details and billing address for tax, under its own privacy policy.
We don't sell or share your data, and we don't use it for advertising.
Keeping and deleting your data
- Delete everything on our side from the app: Settings, then Delete Cloud Backup. Your account, every encrypted entry, your keys, devices and the link between your account and your purchase are deleted right away. Database backups that may still hold them expire within 30 days. Writing on your devices is not touched. We keep only the store's transaction or payment ID and whether it was refunded, tied to no account, so a refunded purchase can't be used again.
- Turn off backup on one device to stop it syncing; the backup stays for your other devices.
- Export all your writing as Markdown from the app at any time, with or without backup.
- An App Store purchase stays with your Apple Account after you delete your backup account, and Restore Purchase links it again. Stripe keeps its own payment records, as the law requires.
Your rights
You can ask us what we hold about you, to correct it or to delete it, wherever you live. Most of it you can see or delete in the app; for anything else, email us. Because your writing is encrypted with keys we never have, we can only ever return it to you as ciphertext.
Children
The apps are not directed at children under 13, and we don't knowingly collect their data.
Changes
If we change this policy, we'll update the date above. If a change affects data already stored, we'll say so in the apps before it takes effect.