1. Who is responsible
The data controller under the GDPR is LBX GROUP Sp. z o.o., ul. Wojska Polskiego 114L/15, 16-400 Suwałki, Polska. Privacy contact: kontakt@myday-app.eu.
2. Data that stays on your phone
Everything you enter in MyDay is stored in a database in the app's private folder on your device: tasks, events, notes, shopping lists, budget, expenses, payments, fixed costs, loans and instalments, documents with photos and scans, health data (appointments, medication, measurements, steps), habits, goals, trips and car data.
We have no access to this data — it is not sent to any server of ours, because this version of the app has none. Uninstalling the app deletes it. MyDay deliberately does not use Android's automatic backup (Google Drive), so the data does not leave the phone that way either. Backups and CSV exports are created by you in Settings; the resulting file is yours alone.
2a. Google Drive backup (optional)
If you turn it on, MyDay saves a backup of all your data and photos in a hidden app
folder in your Google Drive — automatically once a day and whenever you ask. The backup
contains what you enter in the app, including health and financial data. Data travels over an
encrypted connection directly from your phone to Google; it never passes through a server
of ours and we have no access to it. MyDay asks only for access to this one folder
(the drive.appdata scope) — it cannot see other files in your Drive. Google stores
the backup under your account's terms (Google Privacy Policy).
Legal basis: your consent, given by turning the feature on. Turn it off and revoke access in
Settings → Google Drive backup → “Disconnect Google Drive”; delete saved backups in the Google
Drive app → Settings → Manage apps → MyDay → “Delete hidden app data”.
The backup is encrypted on your phone before it leaves (AES-256-GCM). The key is created on the phone and kept in its system vault; its second form is the recovery code the app shows you with your first backup. Neither Google nor we (we have no server and no key) can read the backup's contents. Restoring on a new phone requires this code — if you lose both your phone and the code, the backup cannot be read and we cannot recover it. You can view the code at any time in Settings → Google Drive backup → “Show recovery code”.
2b. Document scanner (Google ML Kit)
The “Scan” button in the Documents module uses the Google ML Kit document scanner, provided by Google Play services on your phone. The scanner detects the edges of a document or receipt and crops the photo on the phone — photos and their content are not sent to Google or to us. Google ML Kit does send Google anonymous diagnostic data about the scanner (e.g. device model, system and app version, run times, error codes), not linked to your identity. Details: ML Kit — Data disclosure. If you prefer not to use it, add the document photo from the gallery — the scanner is then not started.
3. Permissions and why they exist
| Permission | Purpose | Does data leave the device? |
|---|---|---|
| Camera | Scanning documents, photos for notes | No |
| Photos and files | Attaching photos and files to documents, restoring backups | No |
| Approximate location | Weather and air quality for your area | Yes — section 4 |
| Notifications | Reminders for tasks, payments, medication and deadlines | No |
| Health Connect — read steps | Step count on the dashboard and in Health | No — section 5 |
| Biometrics (fingerprint / face) | Optional app unlock — section 6 | No |
You can refuse any permission. The app keeps working, just without that one feature.
4. Weather
To show weather and air quality, the app sends approximate coordinates to
Open-Meteo
(api.open-meteo.com, air-quality-api.open-meteo.com). Coordinates are rounded to about 1 km. The request contains no
device identifier and no personal data. As with any internet connection, Open-Meteo's server
technically sees your connection's IP address. We do not store the coordinates anywhere except
the cache on your phone. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — showing the weather
you ask for by granting location access. Without that permission no weather is shown.
5. Health Connect (steps)
With your permission MyDay reads only the step count from Health Connect
(READ_STEPS). MyDay writes nothing to Health Connect.
- Step data is used only to show it to you in the app.
- It never leaves the phone and is never sold or shared.
- It is not used for advertising, profiling or creditworthiness assessments.
- Use of Health Connect data complies with the Health Connect Permissions policy, including the Limited Use requirements.
You can revoke access at any time in Health Connect settings and enter steps manually instead.
6. App lock (PIN and fingerprint)
The lock is optional. Your PIN is never stored as such — the system vault (Android Keystore) holds only a cryptographic hash with a random salt. Fingerprint or face is verified by Android; MyDay only receives "confirmed" or "not confirmed" and never has access to biometric data.
7. What we do not do
- No advertising.
- No analytics, tracking or marketing SDKs (the only exception: anonymous diagnostics of the Google ML Kit scanner — section 2b).
- No selling or sharing of data with third parties.
- No profiling or automated decisions with legal effect.
8. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection, and the right to lodge a complaint with a supervisory authority. Since the data is on your phone, you exercise most of these rights yourself (edit, delete, export). Otherwise write to kontakt@myday-app.eu.
9. Children
MyDay is not intended for anyone under 16.
10. Changes
We will announce material changes in the app before they take effect — for example if a future version adds an optional cloud account. The date of the last update is shown at the top of this page.