Effective Date: 13 June 2026 · Last Updated: 13 June 2026
Exerevno Limited ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains what information is collected when you use Day Old, how that information is used, and your rights in respect of it.
Day Old is developed and operated by Exer-labs, a studio of Exerevno Limited. References in this Policy to "we", "us", or "our" mean Exerevno Limited, the legal entity responsible for Day Old.
"Day Old" or the "Service" means, collectively:
This Policy applies to both surfaces. Where a section applies only to one surface, it is clearly labelled (Mobile App) or (Web App).
By downloading, installing, opening, accessing, or browsing Day Old, you acknowledge that you have read and understood this Privacy Policy. This Policy should be read alongside our Terms of Use.
Exerevno Limited acts as the data controller in respect of any personal information processed in connection with Day Old. Our contact details are set out in Section 16.
If you are located in the European Economic Area ("EEA"), the United Kingdom, or Switzerland, Exerevno Limited is the data controller responsible for your personal information under the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK General Data Protection Regulation ("UK GDPR"), and applicable national implementing legislation (including the UK Data Protection Act 2018).
If you are located in New Zealand, Exerevno Limited is an "agency" within the meaning of the Privacy Act 2020 (NZ) ("NZ Privacy Act") and is responsible for compliance with the Information Privacy Principles set out in that Act.
If you are a California resident, Exerevno Limited is a "business" within the meaning of the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act ("CCPA/CPRA").
To be clear about what Day Old does not do (on either the Mobile App or the Web App):
Day Old is designed to collect as little as possible. The Mobile App collects a small set of anonymous, first-party usage analytics (Section 4.5); beyond that, the only data processed is the technical connection data that is an unavoidable part of any internet request. We never ask you for, and never store, information that identifies you personally.
Day Old retrieves content from a backend database operated by Supabase, Inc. ("Supabase"). When the Mobile App or the Web App makes requests to Supabase's servers, Supabase's infrastructure may log your device's IP address, the date and time of the request, the type and content of the database query (content data only), and general request metadata (e.g. response codes, payload size, User-Agent string).
This logging is performed by Supabase at the infrastructure level in accordance with Supabase's own Privacy Policy. Day Old uses only Supabase's anonymous (public) API key; no user authentication is performed.
Supabase data processing location: Day Old's Supabase project is hosted on Amazon Web Services ("AWS") infrastructure in the Asia Pacific (Tokyo) region (ap-northeast-1). Supabase's own operational and support systems may process limited metadata in other jurisdictions in accordance with its privacy policy.
The Web App is hosted as static files on Netlify, Inc. ("Netlify"), which operates a global content delivery network ("CDN"). When you load the Web App, Netlify's edge servers receive and process your device's IP address, the date and time of the request, standard HTTP request headers (including User-Agent, Accept-Language, Referer), and the path of the resource requested. Netlify processes this for content delivery, caching, denial-of-service mitigation, and operational logs in accordance with its own privacy practices.
Netlify data processing location: Netlify operates servers in the United States and other jurisdictions and uses a global CDN.
The Day Old interface uses the Geist and Bricolage Grotesque typefaces. These font files are bundled directly inside the Mobile App and served from our own domain on the Web App. Day Old does not load fonts from Google Fonts or any other third-party font CDN, and therefore does not expose your IP address to a font provider for this purpose.
When you tap a source article (including the numbered citations within a Recap) in the Mobile App, the article opens within an embedded in-app browser (WebView). When this occurs, the publisher's website and any third-party scripts, trackers, or advertising networks embedded in that website may collect information about your visit and may set cookies in the WebView's storage. Exerevno Limited does not intercept, read, or store your browsing activity within the WebView. You can exit the in-app browser at any time.
(Web App: source articles open in a new tab in your own system browser using target="_blank" rel="noopener"; once opened, that tab is governed entirely by your browser and the publisher's site. We do not receive information about your activity there.)
Day Old collects first-party, anonymous usage analytics and writes them directly to Exerevno Limited's own Supabase database. No third-party analytics tool (such as Google Analytics, Firebase, or any ad-network SDK) is used, no advertising identifier is read, and no information that identifies you personally is collected.
(Mobile App) From first launch, the Mobile App records:
(Web App) The Web App collects the same style of first-party events using a random, tab-scoped session identifier stored in sessionStorage (not a cookie), which is automatically deleted when the browser tab is closed. The Web App additionally derives a coarse country (country-level only, from the network edge — never a precise location) to understand broad traffic origin. (This coarse-country derivation applies to the Web App only; the Mobile App does not collect it.)
In both cases:
Your choice (Mobile App). Analytics collection is controlled by a "Share anonymous usage stats" toggle in Settings. It is on by default. When you turn it off, the Mobile App stops sending all usage and diagnostic events (including load-error events) and clears the analytics visitor identifier from your device (a new random identifier is generated only if you turn analytics back on), so your activity is no longer counted. Turning analytics off does not affect any other part of the app.
The Mobile App offers an optional daily reminder that you can turn on in Settings and set to a time of your choosing. This reminder is a local notification scheduled entirely on your device — it is not a server/remote push notification. We do not operate a push server, do not collect or store a device push token, and the reminder content ("your daily Day Old is ready") is generic and fixed in the app, not personalised from your behaviour. iOS and Android ask for notification permission before any reminder is shown; you can revoke it at any time in your device settings, or turn the reminder off inside the app.
The Mobile App lets you save (bookmark) Recaps for later. Saved Recaps are stored only on your device (in the app's local storage) and are not uploaded to our servers, not synced to any account, and not visible to us. Because there is no account, your saved list does not move between devices and is removed if you delete the app or clear its data.
Day Old stores a small amount of data locally on your device or browser to make the app work: your chosen theme, your reminder preference and time, your saved Recaps, the anonymous analytics visitor ID, and cached content for performance. On the Web App, the equivalent values are the dark theme key in localStorage and the tab-scoped analytics session ID in sessionStorage. None of these are cookies, none contain personal information, and you can clear them at any time by deleting the app or clearing your browser's site data.
Day Old does not currently offer account creation, login, or personalised features. If a future version introduces optional account functionality, this Privacy Policy will be updated prior to launch with full disclosure of the data collected, its purpose, legal basis, retention period, and any sharing.
If the Mobile App directs you to the App Store or Google Play, those platforms collect information in accordance with Apple's and Google's own privacy policies. Exerevno Limited does not receive personal information from Apple or Google other than aggregated download, crash, and rating statistics provided by the respective developer console.
For users in the EEA, United Kingdom, or Switzerland, to the extent any personal information is processed, we rely on the following legal bases:
| Processing Activity | Legal Basis |
|---|---|
| Technical connection data processed by Supabase when serving content (Mobile App and Web App) | Legitimate interests (Art. 6(1)(f) GDPR): transmitting your IP address is technically necessary to retrieve content from the server. |
| Static hosting and content delivery by Netlify (Web App) | Legitimate interests (Art. 6(1)(f) GDPR): delivering the Web App's assets requires routing your request through a CDN; logs are necessary for security and abuse prevention. |
| Local theme / reminder / saved-Recap preferences stored on your device | Strictly necessary for the operation of features you have explicitly requested; these values are not personal data and (except as part of the Web App theme key) are not transmitted to us. |
| First-party anonymous analytics events written to Supabase (Mobile App and Web App) | Legitimate interests (Art. 6(1)(f) GDPR): we have a legitimate interest in understanding aggregate usage to improve the Service. The data is anonymous at source — no names, emails, or IP addresses are written to our analytics records, and the identifiers are random and not linked to your identity. The processing has minimal impact on your rights, and on the Mobile App you can switch it off entirely (Section 4.5). The Web App's session identifier is sessionStorage, not a cookie, and is not subject to the prior-consent requirement under Art. 5(3) of the ePrivacy Directive. |
Where we rely on legitimate interests, we have carried out a balancing assessment and consider that the limited, technical nature of the processing does not override your fundamental rights and freedoms. You may object to processing based on legitimate interests at any time using the contact details in Section 16. On the Mobile App, you can also turn analytics off directly using the "Share anonymous usage stats" toggle in Settings (Section 4.5).
To the limited extent that information is processed, it is used solely:
(a) to enable Day Old to connect to its backend and retrieve content (the daily Recap and source articles);
(b) to deliver the Web App's static assets from Netlify's CDN;
(c) to remember your local preferences (theme, reminder time, saved Recaps);
(d) to schedule the optional on-device daily reminder you have enabled;
(e) to measure and understand, in aggregate, how Day Old is used — which content is read, how users move between daily Recaps, and (Web App only) broad country of origin — for the purpose of improving the Service (you can switch this off on the Mobile App via the "Share anonymous usage stats" toggle in Settings — Section 4.5); and
(f) insofar as Supabase and Netlify retain infrastructure logs, for network security, abuse prevention, and operational diagnostics as described in their own privacy policies.
Exerevno Limited does not use any information for profiling, automated decision-making producing legal or similarly significant effects, targeted advertising, marketing, or sale to third parties.
We do not sell, rent, share for cross-context behavioural advertising, or trade your personal information. We do not share personal information with third parties except as described below.
| Third Party | Purpose | Surface |
|---|---|---|
| Supabase, Inc. (AWS ap-northeast-1, Tokyo) | Backend database — hosts and serves Recap and article content; stores first-party anonymous analytics events | Mobile App and Web App |
| Netlify, Inc. (United States) | Static site hosting and global CDN | Web App |
| Apple Inc. (United States) | App distribution, download statistics, crash reports | Mobile App (iOS) |
| Google LLC (United States) — Google Play | App distribution, download statistics | Mobile App (Android) |
(Google Fonts is intentionally not used — fonts are bundled locally; see Section 4.3.)
We may disclose information if required to do so by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Exerevno Limited, our users, or the public.
In the event of a merger, acquisition, restructuring, or sale of all or substantially all of our assets, your information may be transferred to the successor entity. We will notify you of any such change and any new privacy policy that will apply.
Server-level logs generated by Supabase and Netlify are retained in accordance with those providers' own retention policies. Exerevno Limited does not download, archive, or maintain its own copy of those infrastructure logs in identifiable form.
Cached content, your saved Recaps, theme and reminder preferences, and the anonymous analytics visitor ID are stored locally and can be cleared at any time by deleting the Mobile App or clearing your browser's site data. Exerevno Limited does not have access to locally stored data.
Anonymous analytics events written to our Supabase database are retained for no longer than 12 months in raw, event-level form, after which they are deleted or irreversibly aggregated into non-identifying summary statistics, which we may keep indefinitely. Because the records contain only random identifiers and event metadata — no names, emails, or IP addresses — they are not linked to your identity. If you wish to request deletion of analytics events that may relate to your use of Day Old, contact us at info@exerevno.co.nz; because the identifiers are random and not linked to you, it may not be possible to identify which records (if any) relate to you.
Because Day Old does not collect personal information or operate accounts, Exerevno Limited does not maintain a central repository of identifiable user data.
Exerevno Limited implements reasonable technical and organisational measures, including:
No method of electronic transmission or storage is 100% secure; while we use commercially acceptable means to protect information, we cannot guarantee absolute security.
Day Old is not directed to children under the age of 13, and we do not knowingly collect personal information from children. Because Day Old does not request or knowingly collect personal information from any user, no parental-consent mechanism is required for the current version. For users in the EEA, where national law sets a higher digital-consent age (up to 16 under Art. 8 GDPR), we will comply with the relevant national requirement. We comply with the United States Children's Online Privacy Protection Act ("COPPA"). If a parent or guardian becomes aware that a child under 13 has used Day Old, please contact us at info@exerevno.co.nz.
Day Old relies on service providers that may process data outside your country of residence: Supabase (AWS ap-northeast-1, Tokyo, with operational metadata possibly processed elsewhere) and Netlify (United States and global CDN edge locations). By using Day Old, you acknowledge that your connection data may be transferred to and processed in jurisdictions with different data-protection laws than your own.
Transfers from the EEA, UK, or Switzerland: where personal data is transferred outside those regions to a country without an adequacy decision, we rely on the sub-processor's appropriate safeguards, including the European Commission's Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum.
Transfers from New Zealand: where personal information is transferred outside New Zealand, we comply with Information Privacy Principle 12 of the NZ Privacy Act.
You have the rights of access, rectification, erasure, restriction, data portability, objection (including to analytics processing based on legitimate interests), the right not to be subject to automated decision-making (we carry out none), and the right to lodge a complaint with your supervisory authority or the UK ICO. Because Day Old does not collect or store personal information centrally, we may not hold any personal information about you against which to exercise these rights. We will respond to any verified request within one month (extendable by two months for complex requests under Art. 12(3) GDPR).
You have the right to request access to and correction of any personal information held about you under Information Privacy Principles 6 and 7, and to complain to the Office of the Privacy Commissioner (www.privacy.org.nz).
You have the rights to know, delete, and correct; we do not collect sensitive personal information; we do not sell or share personal information for cross-context behavioural advertising; and we will not discriminate against you for exercising your rights. In the preceding 12 months, Exerevno Limited has not sold or shared any personal information.
Contact us using the details in Section 16. We may need to verify your identity before acting on a request. Note that, because our analytics use random identifiers not linked to you, we may be unable to locate records relating to a specific individual.
Day Old displays content from third-party news publishers and links to their websites. In the Mobile App, source articles and citations open in the integrated in-app browser; in the Web App, they open in a new tab in your system browser. In both cases, Exerevno Limited is not responsible for the privacy practices or content of any third-party website and does not receive information about your activity on those sites.
This Section applies only to the Mobile App.
The Mobile App collects a Device ID (the anonymous, device-local visitor identifier) and Product Interaction / Usage Data (the analytics events described in Section 4.5), plus diagnostic data (load-error events — not crash reports; the app has no crash-reporting SDK). This data is not linked to your identity and is not used to track you across other companies' apps or websites. No Tracking-permission (ATT) prompt is required.
The Mobile App collects an anonymous Device ID and app-activity/usage data, and diagnostics (load-error events). No data is shared with third parties for advertising. Data is encrypted in transit (TLS/HTTPS). You may request deletion via info@exerevno.co.nz.
The Mobile App does not offer or require account creation, so there is no account to delete. If a future version introduces optional account functionality, Exerevno Limited will implement a compliant in-app and online account-deletion flow prior to that release.
If there is any inconsistency between this Privacy Policy and the in-store privacy disclosures, this Privacy Policy prevails as the governing document.
We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date and, where changes are material, notify you within the app, on the Web App, or by other appropriate means. Your continued use of Day Old after a change constitutes acceptance of the revised Policy.
Exerevno Limited
Level 4, 125 Queen St, Auckland 1010, New Zealand
Email: info@exerevno.co.nz
Website: https://www.exerevno.co.nz
For users in the EEA or UK, if you are not satisfied with our response, you may lodge a complaint with your local national data protection authority (EEA), the Information Commissioner's Office (UK, ico.org.uk), or the Office of the Privacy Commissioner (New Zealand, www.privacy.org.nz).