Privacy policy

Who we are

Daybook plans city trips as day-by-day walks. Sunday Labs Ltd (company number 17555468, ICO registration number ZC290825), 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, runs Daybook and is responsible for your data. Write to hello@sundaylabs.co.uk with any question about this policy or your data.

What we collect

• Your account: your email address and name. If you sign in with Google, we also get your Google account id and, if you allow it, your profile picture. If you use a password, we store only a scrambled form of it (a hash), never the password itself.
• Your trips: the city, dates, budget and preferences you choose, the plan we make, and what you tick, pick or change in it.
• Your places: the places you ask us to fit into a trip, as a name and a point on the map, with any time you set. You choose the name, so a friend’s flat can just be “Anna’s”. Until you make the trip, your browser keeps them, not us.
• People you share a trip with: who has access to each trip and in what role.
• Technical data: your IP address and browser type in our server logs, used to keep the service working and secure.

We do not use advertising or tracking cookies. We do not sell your data or use it for advertising.

Cookies

• daybook_session keeps you signed in, for up to 60 days.
• daybook_anon remembers trips made on this browser before you sign in, for up to a year.

Both are needed for the site to work, so we don't ask for consent to use them.

Why we use it

• To give you the service you asked for: your account, your trips and sharing them (contract).
• To keep the service secure and working, for example to stop abuse (legitimate interest).

Who else handles it

• Google Cloud hosts the site and the database in London (europe-west2).
• Google handles sign-in when you choose "Continue with Google". We use only your name, email and profile picture from it, and nothing else in your Google account. If you paste a short Google Maps link (maps.app.goo.gl), our server asks Google where it leads.
• OpenStreetMap Foundation (Nominatim) answers when you search the map for a place. It receives the words you search for from our server, not your name, email or location. We keep recent searches in memory for up to 7 days so the same search isn’t sent twice.
• Esri serves the street map under each day’s route. Your browser loads the map pictures straight from it, so it sees your IP address and which part of the city you are looking at, as any website does. It gets nothing else from us.

We will update this list before we add any other service, such as payments or email.

How long we keep it

We keep your account and trips while your account exists. When you ask us to delete your account, we delete it and your trips within 30 days. Trips made without an account are deleted after 180 days without use. Server logs are kept for 30 days.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, or object to how we use it. Write to hello@sundaylabs.co.uk and we will reply within one month. If you are unhappy with our answer, you can complain to your data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk).

Changes

If we change this policy, we will update the date at the top. We will tell signed-in users about important changes before they take effect.