Privacy Policy

One Percent Daily ("the app", "we", "us") is a personal productivity application that helps you break goals into daily actions using AI. It is operated by Bombay Media, Dubai, UAE.

Contact: hello@bombay.media

• Your email address (used for login and account management)
• Goals and task descriptions you enter
• Content you upload to your Brain Bank (links, photos, PDFs, text notes, voice memos) — original files are stored in a private cloud storage bucket tied to your account
• Usage data: tasks completed, Pomodoro sessions, streak history
• Google Calendar access tokens (if you connect your calendar)
• Technical data: IP address, browser type, session cookies
• Feedback you choose to send us while the app is in testing: what you write, which part of the app it is about, and the diagnostics attached to it (app version, device screen size, browser, language, time zone, and which screen you were on). The full list is shown to you inside the form before you send anything. If you send feedback while signed out, we store the email address you optionally provide so we can reply, and no account identifier — your IP address is used only to rate-limit the form and is never stored on the report

• To generate personalised daily tasks, goal breakdowns, and Brain Bank summaries using AI models we route through OpenRouter
• To create embeddings of your Brain Bank content for semantic search (Google Gemini)
• To transcribe voice memos you record (Groq)
• To add tasks to your Google Calendar (with your permission)
• To calculate and display your streak and progress
• To read and act on feedback you send us. Feedback is stored in our own database and is not sent to any AI model or third party
• We do not sell, rent, or share your personal data with third parties for marketing

Your goals, tasks, and Brain Bank content — including the image itself, for photo uploads — are processed by the following AI vendors:

• OpenRouter — receives your goal descriptions, task text, and Brain Bank content to generate goal breakdowns, daily tasks, weekly review insights, and Brain Bank summaries. OpenRouter is a routing layer, not a model provider itself: as of July 2026 it forwards text requests to DeepSeek's deepseek-v4-flash model, and image requests — photo uploads, and still frames sampled from shared Instagram reels — to Google's gemini-2.5-flash-lite vision model — these routes may change as models are added or retired. Per OpenRouter's own policy, OpenRouter does not use your inputs or outputs to train its systems; the underlying model provider it forwards a given request to sets its own data-use terms, which can differ by model. Subject to OpenRouter's Privacy Policy.
• Google — receives the text of your Brain Bank content to generate the embeddings that power semantic search, via the Gemini API. Subject to Google's Privacy Policy and the Gemini API Additional Terms of Service.
• Groq — receives your recorded voice memos to transcribe them to text. Subject to Groq's Privacy Policy.

AI-generated summaries and insights are marked as such within the app. The AI does not have access to your account credentials.

One Percent Daily lets you save content to your Brain Bank by sharing it to our Instagram account in a direct message. This is optional and off until you link your Instagram account in Settings.

What we receive. When you send a direct message to our Instagram account, Meta sends us your Instagram-scoped user ID, your Instagram username, the text of that message, and details of any reel, post or link you shared. We receive nothing about your Instagram account unless you message us first, and we never see messages you send to anyone else.

How we use it.To link your account, the app shows you a short code and you send it to us as a direct message. When we receive it we store the Instagram-scoped ID Meta gives us for that sender, and that ID is what connects your Instagram account to your One Percent Daily account from then on. We store the username it belongs to so we can show you which account is linked. The code itself is short-lived and is discarded as soon as it is used. The shared reel is processed into a Brain Bank entry the same way an uploaded link is: we fetch the media, transcribe any speech, sample still frames to read text and visuals shown on screen, and generate a summary. Where the source allows it, a thumbnail — either the post's own preview image or one still frame we extract — is saved to your library; a private or otherwise unreachable source can save without one. We reply once in the same Instagram conversation to confirm the save.

Third-party AI processing. That processing sends the content to the AI providers listed above — OpenRouter for summarisation, Google Gemini for embeddings, Groq for audio transcription. It is the same pipeline as any other Brain Bank item; sharing by DM changes how the content arrives, not where it goes.

What we never do. We do not read direct messages on any account other than our own. We do not post on your behalf, follow accounts, or read your followers. We do not message anyone who has not messaged us first, and we send nothing promotional. Messages from senders we cannot match to a linked account are discarded without a reply.

Retention and deletion. We never store the Instagram media link itself — it is a signed URL that expires within minutes, so we use it once to fetch the content and discard it. What we keep is the derived Brain Bank entry: transcript, summary, embeddings, and, when one was saved, the thumbnail image described above. The Instagram link and any saved entry last as long as your account does. Unlink in Settings to stop all of it immediately — this is the way almost everyone should do it, since sharing a reel by DM never requires granting our account any access to yours. Deleting an entry or your account removes any stored thumbnail along with everything else. See Data deletion.

Your data is stored securely in a Supabase-managed PostgreSQL database. Supabase is hosted on AWS infrastructure. Data is encrypted at rest and in transit (TLS 1.2+). Row-level security ensures your data is only accessible to your account.

Photos, recorded audio and PDFs you upload to your Brain Bank are stored as original files in a private Supabase Storage bucket, scoped to your account only, alongside a thumbnail image for each Brain Bank entry (including one derived from shared Instagram content, described above). Deleting an item, wiping your Brain Bank, or deleting your account also deletes these stored files.

Google Calendar refresh tokens are stored in encrypted form using AES-256-GCM.

We also use the following providers, each bound by its own privacy policy:

• Stripe — payment processing and subscription billing. Subject to Stripe's Privacy Policy.
• Railway — application hosting. Subject to Railway's Privacy Policy.
• Sentry — receives error reports (e.g. stack traces) so we can fix bugs. Subject to Sentry's Privacy Policy.
• PostHog — receives product-usage analytics (e.g. which features you use). Subject to PostHog's Privacy Policy.
• Resend — receives your email address and the contents of the reminder emails we send you (your weekly completion counts, your streak length, and the name of a goal that fell behind). Only used if email reminders are enabled; you can switch them off at any time in Settings. Subject to Resend's Privacy Policy.

• Access: You can view all your data within the app at any time.
• Deletion: You can delete your account and all associated data from Settings → Delete Account. This permanently removes all goals, tasks, Brain Bank content (including uploaded photos, audio and PDFs), any feedback and feature ratings you submitted while signed in, and your user record.
• Portability: Contact us to request a data export.
• Correction: You can edit your goals and content directly in the app.

We use cookies solely for authentication (to keep you logged in). We do not use tracking cookies or third-party advertising cookies. By using the app, you consent to this essential use.

One Percent Daily is not intended for users under 16 years of age. We do not knowingly collect data from children. If you believe a child has created an account, please contact us for immediate deletion.

We may update this policy. Significant changes will be notified via email. Continued use after changes constitutes acceptance.