Privacy
Last updated 11 October 2026
This page explains what personal data Sailyn processes, why, who receives it, how long it is kept and what your rights are. There is no advertising, and nothing about you is sold or shared for marketing.
What is collected
- Your account. A username, a password and a recovery code, and an email address if you add one. Passwords and recovery codes are never stored in readable form. Your date of birth, or an age range from your app store, is used at sign up to check your age and is not kept. If you are under 18, the day you turn 18 is kept, only so extra protection can switch off that day, and it is deleted then. A username and password are needed for an account; everything else on this page is optional.
- What you put in. Your tasks, goals, timetable, routines, sessions, settings and time zone, and anything else you enter into the app.
- What you choose to add. A place name, if you set one or share your location. Calendars you import or connect, as busy times, event names and where each event is. Messages you send to Sailyn by email or with a shortcut. Reports you make about another account, with any words or picture you add.
- Your location, if you share it. It stays on your device and is never sent to Sailyn. Sailyn receives only your region: a country and a state or province. To name the region, and to find how far the nearest shop, gym or pharmacy is, your device asks OpenStreetMap directly, with a position rounded to about a kilometre for the region and about a hundred metres for the nearest place. You can share it once, keep it up to date while Sailyn is open, or switch it off in Settings.
- If you turn on Planning and wellbeing, the times you give Sailyn (your bedtime, when you woke, your meal times and, if you choose, how your energy is) are kept with the rest of your plan, encrypted the same way, and used only to plan your day. They are never shared with buddies or teams, never used for advertising, and your bedtime, meals and energy are not sent to the AI model. Only your latest energy answer is kept, for a day. Turning the mode off stops all of it; the export includes what is stored.
- If you turn notifications on in a browser (not on an iPhone or iPad), the reminders for the next two days are kept on our server until each is sent, so they arrive with Sailyn closed, and each is deleted once sent. A medication reminder says only "Medication reminder" unless you choose to show the name.
- The private wellbeing log, if you turn it on, is kept in that browser or app only. It is never sent to us, synced to your other devices or used for anything else, and deleting it removes it at once.
- Medication and cycle entries are optional health information you choose to add. They stay in your plan, sealed per account where encryption is set up, and are never sent to the AI model, shared with buddies or teams, or used in analytics. Removing them, turning cycle tracking off with delete, or deleting your account removes them, and the export includes them.
- Chats with your buddies. They are encrypted on your device, and the Sailyn servers cannot read them. The Sailyn team holds a separate key so it can open a chat to look into a report or stop abuse, and every chat it opens is recorded.
- Your voice, only while you dictate. The microphone button uses the speech recognition your browser or phone already has, which may send the sound to its maker, such as Google or Apple, to turn it into words. Sailyn never receives or keeps the recording, only the words that land in the box.
- How the app is used. Which features are used and how sessions go, recorded without anything you write, so Sailyn can be improved.
What Sailyn receives from Google Calendar is used to show your week and plan around it, and for nothing else. It is never sold, never used for advertising and never used to train a model, which is what the Google API Services User Data Policy, including its Limited Use requirements, asks us to say here.
If you turn it on for a connected calendar, Sailyn also puts your tasks into a calendar it creates in that account, called Sailyn, and reads back what you move, rename or delete there. It changes nothing else in the account, and its servers keep a reference to each event it wrote but never the event's name.
Why, and on what legal basis
- To provide Sailyn and everything it does for you, including sync between your devices, reminders, calendars and buddies. The basis is the contract with you (Art. 6(1)(b) GDPR).
- To improve Sailyn and keep it safe, including how it plans and reads messages, preventing abuse and handling reports. The basis is our legitimate interest (Art. 6(1)(f) GDPR). You can object to the use for improvement at any time in Settings, Privacy, and no feature is withheld for it.
- To send you updates about Sailyn, only if you agreed to them. The basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from any update or in Settings.
Who else sees it
These are the services involved in running Sailyn. None of them is given more than the job needs.
| Service | Why |
|---|---|
| Railway | It is where your account lives |
| Vercel | It serves the pages, and holds none of your account data |
| Vercel Web Analytics | It counts visits to the public pages: which page was opened, the site you came from, and your country, browser and type of device. It sets no cookies and does not identify you, and it is not used inside the app. The basis is our legitimate interest in knowing whether the site is found (Art. 6(1)(f) GDPR) |
| Google Analytics (Google Ireland Limited) | Only if you say yes when the app asks, or turn it on in Settings: which screens are opened and which actions are taken, such as adding or finishing a task, with a device identifier in cookies (_ga) kept for up to 13 months. Never what you type, the names of tasks, goals or calendar events, messages, your name or your email address. Google may process the data in the USA under the EU-US Data Privacy Framework. The basis is your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG), which you can withdraw in Settings at any time. Not available for accounts with extra protection |
| Brevo | Sending password resets, confirmations, and updates if you asked for them. A French company, data held in the EU |
| Groq | It writes your plan and your notifications |
| Scaleway | A backup for the same AI model, run in Paris |
| BigDataCloud | It turns coordinates into a city name, which is what the shop hours and holiday features need. Type your city instead and this never runs |
| Open-Meteo | It says what the sky is doing where you are, for the harbour and the room. Turn the weather off in Settings and this never runs |
| Cloudflare Turnstile | Without it those pages get filled by scripts within a day |
| Cloudflare R2 | It stores the large files, so the pages themselves stay small. Nothing about your account is stored there |
| Google Fonts | It serves the typeface the Sailyn name is set in |
| Apple or Google push | It is the only way to reach a closed app |
Some of these services are based outside the EU, including in the United States.
The AI planner
When Sailyn cannot handle a request on its own, such as a message it cannot read or planning your week, the text and the task details it needs are processed by Groq in the United States, or by Scaleway in France when Groq is unavailable. Your username, password and email are never sent, and neither provider may use what it receives to train its models. Text about suicide or self-harm is never sent; Sailyn shows crisis numbers instead.
Messages Sailyn sends to the AI are also kept, with no account, name, device or time attached, to improve how Sailyn reads messages, including by training models Sailyn controls. Because nothing links them to you, they cannot be found or deleted later. You can turn this off in Settings, Privacy. It never applies to accounts with extra protection or to messages that reached Sailyn by email or a shortcut.
If you use Read photos on Plan, the photos you choose are made smaller on your device and sent once to an AI provider to be read: Scaleway in France, or Groq in the United States. Neither the photos nor what was read from them are stored by Sailyn, kept for training or used for anything else. Sailyn keeps only when you read photos and how many, to count twenty a week and six a day.
For every request Sailyn sends to an AI provider for your account, it keeps the purpose, the provider, the model and how much was sent and received, never the words, to see what the service costs. These records are deleted after ninety days or with your account.
Challenges and the board
If you join a challenge, the other people in it see your username and one number for that challenge, and nothing else. Leaving deletes your row.
When a person at Sailyn can see your account
The Sailyn team sees counts about your account, not what it says. Reading your tasks or goals needs the highest level of access and a written reason, and every such reading is recorded permanently.
What is stored on your device
Only what Sailyn needs to work: your language choices (a cookie kept for six months, and only once you choose a language), your theme, and, once you are signed in, your data, so the app works offline. A preview link from the Sailyn team sets a cookie for one day. Nothing is used for advertising. Google Analytics sets cookies only if you say yes when the app asks you, or turn it on in Settings, so there is no cookie banner.
How long it is kept
Your account and everything in it are kept until you delete your account. The usage record is kept for 90 days, and pseudonymous session statistics for 400 days; the statistics are not deleted with your account, but nothing links them to you once it is gone. The words and picture in a report are deleted after 90 days, and backups roll off after a short period.
Your rights over it
You have the right to access, correct, download and delete your data, to restrict or object to its use, and to withdraw any consent. Most of this is built in: Settings has Download everything and Delete my account, and deleting is immediate and permanent. For anything else, write to us. You can also complain to a data protection authority.
Security
Everything travels over HTTPS, your tasks, goals and notes are stored encrypted, and deleting your account destroys the key they are encrypted with. If you find a security problem, please report it rather than exploit it.
Children
Sailyn is not for children under 13. If you believe a younger child has made an account, tell us and it will be removed. Under 18, extra protection is always on: no updates by email, no usage analytics, no link requests from adults, and no notifications between 22:00 and 07:00 except the end of a session you started.
Changes
If this page changes in a way that affects what happens to your data, the date at the top changes and the app will say so. Small wording fixes will not.
Contact
Questions about any of this, or a request that the app cannot handle itself: hello@joinsailyn.com.
Sailyn is run by Amaan Nizam, Einsteinstr 13, 97424 Schweinfurt, who is responsible for your data. The full legal details are in the Impressum.