Privacy policy

increday is run by the company below, which decides how and why your personal data is used (the “controller” under UK GDPR). In this policy “we” means that company.

Kanso Coders Ltd

increday is invite-only. This policy applies to the people who have an account, to people we have invited, and to visitors to this site.

• Your account: your name and email address. If you turn on an authenticator app, what it needs to work.
• Your workspace: everything you put into increday: captures (including the original text you typed or spoke), tasks, issues, notes, projects, areas, subtasks, week plans, the briefs written for you, AI suggestions, and a trail of what was changed, when, and by whom (you, the AI, or an agent you connected).
• Settings and access: your settings, the API tokens you create, the agents you connect and the webhook addresses you add (with their signing secrets), and, if you use our Apple apps, a device identifier for notifications.
• AI usage records: for each AI request, which job it was, the model, the number of tokens, the cost, how long it took and whether it failed. They do not include the text that was sent, apart from the error message of a failed request, which can occasionally quote part of it.
• Security and technical data: your IP address and browser details (user agent), kept with your signed-in session and in short-lived counters that limit repeated requests, and in our monitoring (see “Who receives it”). A sign-in code you ask for also notes which browser session or app asked for it, so it works only there.
• Invitations: if you were invited, the email address that was invited, who invited you and when.

Most of this comes from you. The rest is made when you use increday, such as AI suggestions and security records.

We do not sell personal data. increday has no advertising or analytics trackers.

• To provide increday to you — making your account, signing you in with emailed codes, storing and syncing your workspace, sorting your captures, writing your briefs, sending reminders and notifications, and sending invitations. The basis is performing our contract with you.
• To keep increday secure and working — limiting repeated sign-in attempts, keeping sessions, setting spending limits on AI, finding and fixing errors. The basis is our legitimate interest in running a safe, reliable service.
• To turn speech into text with your browser’s own speech service, when your browser cannot do it on your device. The basis is your consent, which we ask for once in that browser (see “Voice capture”).
• To meet legal obligations, such as answering a lawful request from an authority.

• OpenRouter and the AI model providers it sends requests to. When an AI feature runs, we send what the job needs: the capture or item text, your project names and descriptions, and related items. You choose the models in Settings → AI. Private spaces, such as Life, are not sent unless you switch on “Send private spaces to AI”. These providers handle the request under their own terms.
• Laravel Cloud, which hosts increday and so stores and processes everything described above.
• An email delivery provider, which sends your sign-in codes, invitations and address-verification emails, so it sees your email address and the message.
• Laravel Nightwatch, which monitors errors and performance. It receives technical records of what the app does: requests (addresses visited, timings, the IP address, and the ID, name and email address of the signed-in user), database queries, outgoing requests, jobs, emails sent, log messages and errors, with the code around an error. A log message or error can occasionally include some of the content involved, such as an email address. It is set not to receive what you submit in forms, your cookies or your authorisation headers.
• Apple, if you use an increday app for iPhone, iPad or Mac with notifications. Apple’s Push Notification service delivers them, so it handles the notification text (an item’s reference and title, or the text of a daily or weekly brief) and your device identifier.
• Agents and addresses you connect. An AI agent you connect (over MCP, or as a connector) can read and change what you let it, space by space. A webhook sends events to the address you chose; private items are left out unless you opt in for that address. Their own privacy policies apply to what they do with it.

Some of these providers are based or process data outside the UK. We may also share data where the law requires it.

Speech is turned into text before it reaches increday. In the increday apps for Apple devices that happens on your device. On the web, your browser does it on your device when it has the language available. If it does not, it can use its own speech service (in Chrome, that is Google’s) — but only after you agree to that, once, in that browser. We never receive or store audio: only the text you end up with is sent to us, like anything you type. Browsers without speech recognition, such as Firefox, show no microphone.

• This site (increday.com) sets no cookies, loads no third-party scripts and serves its fonts itself. If you pick the dark theme, your choice is kept in your browser’s local storage and never sent to us.
• The app (app.increday.com) sets a session cookie that keeps you signed in, a security token cookie that protects forms, and a “remember me” cookie only if you tick Remember me. All three are strictly necessary for signing in, so they need no consent. They do not reach this site.
• The app also keeps some display choices in your browser’s local storage, such as your theme, whether the sidebar is hidden, and whether you agreed to the browser’s speech service. These stay in your browser.

• Your account and workspace: until you delete your account. Deleting it, in Settings → Profile, deletes your account, your workspace and everything in it, your AI usage records, your device registrations and the invitation that made your account. API tokens and agent connections you made stop working at once, though a small record of each token (its name and when it was last used) can remain. Sessions on your other devices end when they expire.
• Things you delete in increday are kept as hidden “deleted” records, so your other devices learn of the deletion. They are removed when you delete your account.
• Sign-in codes last 10 minutes, and expired ones are cleared daily.
• Sessions end after a period without activity (longer if you chose Remember me).
• Unused invitations expire after 7 days, and are deleted once they are 30 days old and expired.
• Counters that limit repeated requests last from a few minutes up to a day.
• Logs, failed-job records and monitoring data are kept for as long as is needed to find and fix problems. We do not set a fixed period for them yet.

The providers in the previous section keep the data they receive under their own policies.

Under UK GDPR you can ask us for a copy of your personal data, to correct it, to erase it, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on your consent you can withdraw it at any time.

• Erase it: delete your account in Settings → Profile.
• Take it with you: make an API token in Settings → Agents & API, and read everything in your workspace through the API (the sync endpoint pages through all of it, as JSON).
• Correct it: change your name and email in Settings → Profile, and edit anything in your workspace in the app.
• Anything else: contact us (below). We answer within one month.

If you are unhappy with how we have used your data, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint.

For questions about this policy or a request about your data, contact:

Kanso Coders Ltd

If we change this policy, the date at the top changes with it.