Privacy Policy

What Daysift Indexes

Daysift uses a predefined allowlist of work apps — it only indexes pages from productivity tools, not your entire browsing history. This includes tools like:

• Google Docs, Sheets, Slides, Drive
• Notion, Figma, Linear, Jira
• GitHub, GitLab, Confluence
• Slack, Asana, and similar productivity tools

What's NOT indexed: Personal browsing, social media, banking, shopping, email content, and any sites not on the work app list. You can customize this list in settings if needed.

Why Chrome Shows Permission Warnings

When you install Daysift, Chrome shows a warning that the extension can "read your browsing history." Here's what that actually means for Daysift:

What the permission allows

• Read page titles and URLs from your allowlisted work apps
• Store this data locally inside your browser so you can search it later

What Daysift does NOT do

• Access passwords or autofill data
• Read form inputs
• Track sites outside the predefined work app list
• Send your history to any server
• Run in the background when you're not using it

Note on page content: Daysift extracts keywords from work app pages to improve local search. This data stays on your device and is never sent anywhere. When you use AI search, only page titles are shared — not the extracted content.

The broad Chrome permission warning exists because Chrome doesn't distinguish between extensions that send data to servers and ones like Daysift that keep everything local. We need this permission to provide search functionality, but we've designed Daysift to be as privacy-respecting as possible.

What's Stored on Your Device

Data stored on your device never leaves your computer. Only you can access it — we cannot see, retrieve, or analyse it.

When Data Leaves Your Device

The key difference: Regular search with ⌘J never touches the network. AI features (Ask AI, summaries, writing tools) send the text needed to answer to Proton Lumo. You're always in control of which one you use.

About AI Data Processing

Daysift's AI features run on Proton Lumo, chosen for its privacy practices and its European base.

Why Proton Lumo?

We evaluated multiple AI providers. Most retain your data:

• OpenAI: retains API data for up to 30 days
• Anthropic (Claude): retains API data for up to 30 days (7 days with opt-out)
• Proton Lumo: not used for training, and not logged or kept after answering

Proton runs open-weight models on its own servers in Europe, under Swiss law, so your data stays out of US jurisdiction. See Proton Lumo's Privacy Policy.

A note on encryption

Proton's Lumo app uses zero-access encryption for saved chats. Daysift reaches Proton over its API rather than the app, so requests travel over an encrypted connection (HTTPS/TLS) but are not end-to-end or zero-access encrypted. Your text passes through Daysift's own service (a Cloudflare Worker) before reaching Proton. We do not claim more than this.

Where each part runs

Daysift uses two AI services for different purposes:

1. Classification (Cloudflare Workers AI)

When Daysift encounters a new page, it may use AI to classify whether it's a work tool. This runs on Cloudflare Workers AI and receives only:

• Hostname (e.g., "github.com")
• Generalised path pattern (e.g., "/*/*/issues/*", not the actual URL)
• Title category (e.g., "code", not the actual title)

Never sent: Full URLs, actual page titles, page content, or any identifying information.

2. Ask AI, summaries & writing tools (Proton Lumo)

When you use these features, the text needed to answer is processed by Proton Lumo:

• For Ask AI: your question, plus relevant page titles and domains from your local results
• For summaries: the content of the page you ask to summarise
• For writing tools: the text you select in a note

If Proton is temporarily unavailable, requests fall back to Groq (US), which operates a Zero Data Retention policy, so AI keeps working.

Never sent: Your notes, your pins, or browsing history beyond what a given feature needs.

How your data is handled

For requests processed by Proton Lumo:

• Your content is not used to train AI models
• Your content is not logged or kept after your request is answered
• Processing happens on Proton's servers in Europe, under Swiss law

On the rare fallback to Groq, Groq's Zero Data Retention applies: data is processed and discarded, never stored. See Groq's Privacy Policy.

Your consent and withdrawal

First use: When you first use an AI feature, you'll be asked to consent. AI features won't work until you accept.

Withdrawal: You can revoke your consent at any time in the extension's Settings → AI Search. After revoking, you'll need to consent again to use AI features.

After uninstall: If you uninstall Daysift, your local data is deleted immediately. Neither Proton nor Groq keeps your AI requests, so there's nothing retained on their end either.

What We DON'T Collect

• No accounts or login
• No email addresses (unless you contact us, or opt in to product updates during onboarding)
• No third-party trackers, no ads, and no tracking of your content or behaviour across sites
• No passwords or form data
• No cloud storage of your personal data or browsing history
• No silent upload of your searches, browsing history, notes, or page content — the only things that ever leave your device are listed above

Usage Statistics (Optional)

To see which features help and where Daysift can be better, we collect limited usage statistics about how the product itself is used — for example, how often search or AI is used, or when you reach a free-plan limit.

What this includes: a short event name (like "search" or "ai_query"), your plan tier, the app version, your operating-system family (Mac, Windows, or Linux), and a random ID that stays on your device and can be reset at any time. The ID lets us recognise returning use without knowing who you are.

What it doesn't include: we don't collect what you search for, which sites you visit, your page content, your notes, or your IP address.

These statistics go only to us, never to a third party, and are used only to improve Daysift. You can turn them off anytime in Settings → Data Management.

Your Control

• See your data: It's on your device — open browser dev tools
• Delete everything: Uninstall the extension
• AI requests: Not stored by us, and not kept by Proton after answering

Third-Party Services (Data Processors)

When you use certain features, your data may be processed by these third-party services:

We have Data Processing Agreements (DPAs) or equivalent terms in place with our processors. Cloudflare's DPA is incorporated by reference in their Customer DPA. Proton Lumo's terms are at proton.me/lumo/terms, and Groq's at groq.com/terms-of-use.

Security

Your data lives in your browser's local storage. We can't access it. External transmissions (AI queries) use HTTPS encryption.

GDPR & Data Protection

For users in the UK and EU, here's how data protection roles work with Daysift:

Local data (most of Daysift)

Since Daysift stores your data locally on your device and we cannot access it, traditional data controller/processor roles don't apply to this data. You control your own data.

When you use AI features

When you use an AI feature, the text needed to answer is processed by Proton Lumo, with Groq as a fallback. In this case:

• Daysift acts as a data controller (we decide to use Proton, Cloudflare and Groq for AI features)
• Cloudflare acts as a data processor for classification (anonymised metadata) and as the proxy that forwards requests
• Proton Lumo acts as a data processor for Ask AI, summaries and writing tools (not used for training, not kept after answering)
• Groq acts as a data processor only when Proton is unavailable (Zero Data Retention)

Proton processes data in accordance with its Privacy Policy and Terms.

When you make a payment

Payment processing is handled by Lemon Squeezy, who acts as an independent data controller for payment data. See their Privacy Policy.

International data transfers

Here is where your data is processed when you use AI features:

• Proton Lumo: Processes data on servers in Europe, under Swiss law. Switzerland is recognised by the UK and EU as providing an adequate level of data protection.
• Cloudflare: May process data in various locations globally. Covered by their DPA, which includes Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA).
• Groq (fallback only): Processes data in the United States under a Zero Data Retention policy, so data is processed and then discarded.

These mechanisms provide adequate protection when data is processed outside the UK/EU, as required by data protection law.

Your rights

Under UK GDPR and EU GDPR, you have the right to:

• Access: Your local data is already accessible to you in your browser
• Deletion: Uninstall the extension to delete all local data
• Portability: Your data is stored in your browser and can be exported via developer tools
• Object: Don't use AI features if you don't want your text processed by Proton Lumo (or Groq on fallback)
• Withdraw consent: Revoke AI consent anytime in Settings → AI Search

For questions about data protection, email hello@daysift.com.

Changes

We'll update this page if anything changes. Major changes will be noted in the extension update notes.

Contact

Questions? Email us at hello@daysift.com