Privacy policy

Who we are

Dailies is run by Kanishak Mahendiratta, a sole proprietor in India, trading as Dailies. He decides how your personal data is used, and is responsible for it under India’s Digital Personal Data Protection Act, 2023 and, where it applies to you, the EU and UK GDPR.

This policy covers the Dailies website, the waitlist, and the Dailies app once you have an account. Write to kanishak@dailies.design about anything on this page.

The waitlist

Dailies is not open to everyone yet. When you join the waitlist we store three things: your email address, which of the two forms on the page you used, and the time you joined. Nothing links that entry to anything else.

We use your address for one thing: to email you when your invite is ready. We don’t add it to a newsletter, and we don’t share it with anyone. Our legal basis is your consent, which you give by joining and can withdraw at any time by asking us to remove you.

To stop the form being abused, each request also counts against a limit of ten an hour from the same internet address. That counter holds your IP address and is deleted automatically within about two hours.

Your account and your work

Once you have an account, we keep what Dailies needs to work:

• Your account. A username and your email address. If you sign in with Google or GitHub, we receive your ID on that service, your email address and your name or username there, which we use to suggest your Dailies username. We never receive your password for either service.
• Your password, if you sign in with email. We store only a salted, slow one-way hash of it, so it can be checked but never read back.
• Your sessions. For each device you sign in on, we keep its IP address, its browser’s user-agent string (which names the browser, the operating system and sometimes the device), and when the session started and was last used. You can see your sessions and end them from your security settings.
• Your work. The Projects, components, media, comments and saved videos in your workspace.
• Your team. Your role in each workspace you belong to. Owners and admins of a workspace can see its members’ email addresses and when each was last active. Workspaces keep a log of actions such as invitations and role changes, which names the person but not their email.
• Invitations. When someone in a workspace invites a person by email, we keep that address on the invitation, with who sent it and whether it was accepted. We keep it whether or not the person joins, and the workspace’s owners and admins can see it.
• What you publish. Your profile is private unless you make it public. If you publish a profile, a marketplace listing or a marketplace comment, anyone can see it. Comments on a storyboard stay inside its workspace, apart from the AI features described below.
• Your settings. Your email preferences and editor preferences.

We use this to run Dailies for you: to sign you in, keep your work, show your team what you share with them, and send the emails the product sends. That is the contract between us, and where you choose to publish, your choice. We also keep short-lived counters of sign-in attempts, keyed by IP address or email address, to stop abuse.

The emails Dailies sends are about your account and your work: verifying your address, password resets, invitations, changes to your access, and summaries of new comments. You can turn the comment and activity emails off in your settings.

Cookies and browser storage

The website and the waitlist set no cookies. Dailies runs no analytics and no advertising, and nothing on the site tracks you across other sites.

Once you sign in, Dailies uses cookies only to keep you signed in:

• A session cookie on the main site, and one on your workspace’s editor, which runs on its own address. Each lasts up to 30 days, and a session ends after at most 90 days, after which you sign in again.
• Short sign-in cookies that protect the sign-in round trip, remember where to send you afterwards, and confirm it is you before a sensitive change. Each lasts at most 10 minutes.

All of them are HttpOnly, Secure and SameSite=Lax: page scripts cannot read them, and they never travel to other sites.

The editor keeps your panel layout and preferences in your browser’s local storage, and caches your Project’s files so it loads quickly. Your editor preferences, such as theme and grid settings, are also saved to your account, so they follow you to other workspaces and devices. The rest stays on your device.

Who else receives data

We use a few services to run Dailies. Each receives only what its job needs, and most only when you use the feature that needs it.

Code in a Project can also make your browser load files from other sites, including code your team writes or an AI app you connect writes. Those sites see your IP address, and we don’t control them.

We may also share data where the law requires it, or to protect the rights and safety of our users. We never sell or rent personal data, and no one else may use it for their own purposes.

AI features

We don’t use your work to train AI models. The AI features send content to an AI provider only when you use them. The provider’s own terms then decide what it may do with that content, including whether it trains on it. For an app you connect, your settings in that app decide this too.

• The built-in agent uses an Anthropic API key that a workspace owner or admin adds. When you use it, your prompts and its results go to Anthropic. So does what it reads in the workspace to do the job: Projects, code, media, still images of your Shots, and comments, which include the names of the people who wrote them. All of this goes under your workspace’s Anthropic account and Anthropic’s terms. We store the key encrypted and never show it in full again.
• AI apps you connect, such as Claude, ChatGPT, Codex or Cursor, can read what you can read in that workspace. They can change your Projects and code only if a workspace owner or admin turns editing on, though they can always reply to and resolve comments, marked as the agent’s. What they read is handled under that app’s own terms.
• Sound generation sends the text you type to ElevenLabs. It does not send your name, email or anything else about you. A generated sound you don’t add to a Project is deleted about a day after you make it, with the text you typed for it.

How long we keep it

• Your waitlist entry, until you ask us to remove it, or until it is no longer needed because you have been invited and Dailies is open to you.
• Rate-limit counters, which hold IP addresses or email addresses, until their window ends, then they are deleted within the hour. The longest window is a day.
• Sessions, until you sign out or they expire, 90 days at most. Expired sessions are deleted every hour.
• Your account and your work, for as long as you keep your account.
• Invitations, with the address each was sent to. We don’t delete them on a schedule. If you were invited and want your address removed, write to us.
• Payment records, for as long as tax and accounting law requires.
• Request logs at Cloudflare, for a few days.

You can delete your account yourself in your settings. Deleting it removes the email address on your account, your profile, sign-ins, sessions and access tokens. It also closes every workspace you own by yourself, and that workspace’s files are deleted within about an hour. A few things stay:

• In workspaces you owned by yourself, the list of Project names, the comments and the activity log stay in our database.
• Comments you wrote in other people’s workspaces stay, under the name you had.
• Projects, files and videos you made in other people’s workspaces stay with those workspaces.
• Workspace logs keep a record that your account did something, without your email.
• Invitations other people sent to your address stay in their workspace’s invitation history, with that address.
• Listings you published are taken down at once. Copies other people already made stay theirs.
• Records of payments stay for as long as the law requires.

Your waitlist entry is separate from your account. If you own a workspace other people use, or pay for a subscription, you will need to hand the workspace over or cancel first. Write to us and we will remove anything that remains.

How we protect it

Every connection to Dailies is encrypted, and browsers are told to use only HTTPS. Passwords are stored as slow, salted hashes. Session IDs are stored only as hashes, so a copy of the database could not be used to sign in. API keys a workspace adds are encrypted. Each workspace’s editor runs on its own address, so code in one workspace cannot reach your account or another workspace.

No system is perfectly secure. If a breach affects your personal data, we will tell you, and the authorities where the law requires it, without undue delay.

Your rights

Wherever you live, you can ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct it, or complete it;
• delete it, including removing you from the waitlist;
• stop using it, where you gave consent and now withdraw it.

Under India’s data protection law you can also name someone to exercise these rights for you if you die or cannot do so yourself. In the EU and UK you can also object to some uses of your data, ask us to restrict them, and ask for your data in a portable form.

Write to kanishak@dailies.design from the address the request is about. We will answer within 30 days, and for free. If you are not happy with the answer, you can complain to the Data Protection Board of India, or to the data protection authority where you live.

Where your data is processed

Cloudflare runs Dailies on servers in many countries, and the services listed above may process data outside India and outside your own country. Where data leaves the EU or UK, we rely on the safeguards those services provide, such as the European Commission’s standard contractual clauses.

Age

Dailies is for people aged 18 and over. Please don’t join the waitlist or create an account if you are younger. If we learn that we hold data about someone under 18, we will delete it.

Changes to this policy

When we change how we handle your data, this page changes first, with a new date at the top. If a change matters, we will also tell you by email or in Dailies before it takes effect.

Contact and grievances

For any question, request or complaint about your personal data, write to our grievance officer, Kanishak Mahendiratta, at kanishak@dailies.design. We reply within 2 working days, and aim to resolve every complaint within 15 days.