Privacy Policy

This policy explains what data Dagur collects, how it's used, and your rights. Plain English. If anything is unclear, email hello@dagur.co.

1. Who we are

"Dagur" ("we", "us", "our") is the data controller responsible for processing your personal data under this policy. For privacy questions or to exercise your rights under GDPR or other applicable laws, contact hello@dagur.co. Full operator details are available on request.

2. What we collect

2.1 Stored locally on your device only

Your widget layout, notes, todos, captures, AI conversation threads, settings, and (if you provide one) your own AI API key are stored in your browser's localStorage and IndexedDB. We do not have access to this data unless you explicitly enable cloud sync by signing in.

2.2 Stored on our servers (only if you create an account)

• Email address — for sign-in and account recovery
• Hashed password (we never see the plaintext) — handled by Supabase Auth
• Subscription tier, Stripe customer ID, and billing status
• If you enable cloud sync: your synced widgets, captures, threads, and notes
• If you connect Google: encrypted OAuth refresh tokens (server-side only)
• Server logs (request metadata, IP, user agent) retained up to 30 days

2.2a Company briefings (only if you join or create a workspace)

A workspace is run by your organization, and its data is separate from your personal tab. A workspace can never see your notes, todos, layout, or anything else on your personal tab.

• Your membership: the workspace, your role, when you joined, and the email address and display name from your account, which publishers see so they can address updates
• Updates your workspace publishes, who they were addressed to, when they reached your briefing, and the responses you choose to give (acknowledged, completed, dismissed)
• If a publisher imports an item from an RSS or Atom feed, our server fetches that public feed on their request; nothing is fetched on your behalf
• If your workspace has reminder emails turned on, a publisher's reminder sends an email with the update's title and deadline to people who haven't responded yet
• If you delete your account, workspaces you own pass to the longest-standing admin or member, or are deleted if you were the only member

2.3 Usage analytics (only with your consent)

We record usage analytics only after you choose Accept in the usage-data notice, or turn on Analytics in Settings → Privacy. This applies on dagur.co and in the Chrome extension alike. Until you answer, and after you decline, nothing is recorded or sent — and events from before you accept are never sent later.

What we record: usage events such as a tab being opened, a widget being added or removed (its type, not its contents), a layout or background being applied, page views, and error reports (the error message and where in our code it happened). We never record what you write or read: the content of your notes, todos, captures, prompts, or company updates stays out.

How it travels:

• Our telemetry endpoint (web and extension) — events go to dagur.co/api/t, which forwards them to PostHog (EU-hosted). We do not forward your IP address, location lookup (GeoIP) is disabled, and each event gets a new random identifier, so events can't be linked to you or to each other.
• PostHog's script (dagur.co only, not the extension) — loaded through our own domain after you accept. It keeps a random identifier in your browser's localStorage to count page views. If you are signed in, it links events to your account (user ID, email address, name, and plan) so we can understand how accounts use Dagur.

You can change your answer at any time with the Analytics switch in Settings → Privacy. Ghost Mode, free on every plan, turns off all analytics and telemetry regardless of that switch.

3. Legal basis for processing (GDPR)

Where GDPR applies, we process your personal data under the following legal bases:

• Contract — to provide the service you signed up for (account, sync, subscription)
• Legitimate interest — to keep the service secure and prevent abuse
• Consent — for usage analytics (see 2.3) and optional integrations (Google Calendar, Gmail). You can withdraw consent at any time
• Legal obligation — to retain billing records as required by tax law

4. Third-party processors (sub-processors)

To operate the service, we use the following providers. Each is bound by contract to use your data only to deliver their service to us, and each maintains its own privacy and security commitments:

• Supabase — database, authentication, and cloud sync (EU region)
• Vercel — web hosting and serverless functions
• Stripe — payment processing. We never see your card details. Stripe's privacy policy applies to checkout
• Anthropic, OpenAI — AI inference. Your prompts and conversation context are sent to these providers solely to generate responses. Per their API terms, your data is not used to train their models
• Google — only if you opt in to Calendar or Gmail integration. Read-only scopes, minimum required tokens stored server-side
• PostHog — product analytics, EU-hosted, only if you consent (see 2.3)
• Resend — email delivery for company briefing reminders, only when that workspace has reminder emails turned on (see 2.2a)

5. International data transfers

Most processing happens in the EU. Some providers (Anthropic, OpenAI, Stripe) may process data in the United States. Where required, transfers rely on Standard Contractual Clauses or equivalent safeguards.

6. What we do not do

• We do not sell your personal data to anyone
• We do not share your data with advertisers or data brokers
• We do not train AI models on your content
• We do not read your synced data unless required for technical support and only with your explicit consent, or as legally compelled
• We do not track you across other websites

7. Data retention

• Account data — kept while your account is active. Deleted within 30 days of account deletion request
• Cloud-synced content — same as above
• Billing records — retained for 10 years to comply with Czech tax law
• Server logs — up to 30 days, then deleted
• Backups — encrypted, rotated within 30 days

8. Your rights

Under GDPR and similar laws (including UK GDPR, CCPA, and Brazil's LGPD), you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — delete your account and associated data ("right to be forgotten")
• Portability — receive your data in a portable format. Use Settings → Export Layout for local data, or email us for cloud data
• Restriction — limit how we process your data
• Objection — object to processing based on legitimate interest
• Withdraw consent — at any time, without affecting prior lawful processing
• Lodge a complaint — with your local data protection authority. In the Czech Republic, that's the Úřad pro ochranu osobních údajů

To exercise any right, email hello@dagur.co. We respond within 30 days.

9. Cookies and similar technologies

Without your consent, we use cookies and localStorage only for essential functions: authentication, session management, and remembering your settings (including your analytics choice). If you accept usage analytics on dagur.co, PostHog also stores a random identifier in localStorage (see 2.3). We do not use advertising or cross-site tracking cookies.

10. Security

HTTPS everywhere. Database row-level security (RLS) enforced by Postgres so users can only read their own rows; company briefing content is served only through our API after membership and role checks. Passwords hashed via Supabase Auth. OAuth tokens encrypted server-side. We can never view your password or local-only data.

Despite reasonable safeguards, no system is fully secure. Report vulnerabilities to security@dagur.co.

11. Children

Dagur is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe we have, email hello@dagur.co and we will delete it.

12. Changes to this policy

If we make material changes, we'll notify account holders by email at least 14 days before the change takes effect. Minor edits (typos, clarifications) just bump the "last updated" date above.

13. Contact

Privacy questions, data requests, or concerns: hello@dagur.co.