Your memories stay yours.

Plain-language summary

• No ClipMyDay account is required.
• The app’s working library is stored on your Android device.
• The app does not include an advertising SDK.
• Android Photo Picker shares only media you deliberately select.
• No memories, project text or diagnostics leave app-private storage automatically. Google Play Billing does automatically check the Pro catalogue and prior ownership at startup.

Data stored by the Android app

ClipMyDay stores project names and settings, selected media working copies, edited moments, generated movies, archive records, reminder preferences and local purchase-entitlement state needed to operate the app.

Your gallery original is not modified. Removing a ClipMyDay moment immediately removes its live private working copy, not the original outside the app.

Operation recovery copies

Before you delete a project, ClipMyDay creates and verifies an app-private recovery ZIP containing only that project and its owned media; it does not copy unrelated projects or app settings. Before Replace local data, ClipMyDay instead creates and verifies a full-library recovery ZIP because that operation can replace every local project and setting.

These operation recovery ZIPs are readable and unencrypted. The app lock controls access to the app but does not encrypt the ZIPs. Each copy becomes automatically eligible for deletion after seven days of proven phone uptime when cleanup next runs. A restart, clock correction or Android delaying work can postpone age-based deletion rather than risk deleting a newer recovery copy early. ClipMyDay keeps at most three project-deletion copies and three Replace local copies, and applies a 16 GiB combined retention target. Cleanup runs during healthy startup, after relevant operations and through daily WorkManager scheduling. Count and size limits still apply. Settings → Archive & restore lets you inspect or permanently delete each copy sooner.

Migration recovery checkpoints

Before an app update changes the local database format, ClipMyDay can create a private, verified recovery checkpoint that includes the earlier database and owned working media. This means bytes from a deleted working copy can remain in that checkpoint for recovery.

After the updated database opens successfully, passes its integrity check and startup recovery finishes, the app keeps no more than two verified checkpoints for seven days. A 16 GiB combined retention target applies; when the current library itself is larger, the newest required checkpoint may exceed that target instead of allowing the update to continue without a verified backup. Device-clock corrections can extend, but never shorten, the seven-day recovery window. Cleanup is enforced at every verified healthy startup and queued for the expiry time; Android can defer background work while the device is off or unavailable.

Settings → Storage separately shows verified checkpoints, recognized interrupted work and unknown artifacts, including their size, oldest date and next expiry. You can delete verified checkpoints and recognized interrupted work immediately; unknown or tampered artifacts are preserved. Clear all app data also removes every remaining private checkpoint artifact. Incomplete, corrupt or unverified folders are never treated as recoverable checkpoints.

App lock

If you enable the optional six-digit lock, the app stores a randomly salted, deliberately slow verification hash. It does not store the PIN itself.

When data can reach another provider

Optional ClipMyDay account

When you create an account or sign in, Google Firebase Authentication processes your email address, account identifier and the connection information needed to authenticate and protect your account. If you use email-and-password sign-in, Firebase also processes your password; ClipMyDay does not store it in its own database. The same account can be used on the website and in an account-enabled Android preview.

If you continue with Google, Google and Firebase also process your Google display name and profile-photo URL when supplied, and hold them with your Firebase sign-in account. ClipMyDay does not request access to Gmail, Google Drive or Google Photos.

The website keeps your sign-in session in browser session storage. Signing in alone does not upload memories or projects. You can request verification and password-reset emails from the account screen.

Controlled cloud-backup testing

Cloud backup is not available to the public. During controlled pre-release testing, ClipMyDay may enable it temporarily for specifically selected disposable test accounts. Access by a selected test account does not mean the feature has launched.

An enabled tester starts each upload explicitly in the Android app. A library backup is an unencrypted ZIP containing the complete library, including private moments, notes, media and finished movies. A tester can also upload an individual finished movie. Anyone who obtains an unencrypted archive can read its contents, so testers should not use irreplaceable personal media during qualification.

Firebase Authentication verifies the account. Cloudflare D1 and R2 process and store account-scoped library metadata and uploaded files. Google Cloud stores durable deletion records; reviewed operator recovery workflows may also retain storage-metadata backups. Existing cloud copies remain available for download if paid upload access ends.

A cloud copy remains until the account holder removes it or deletes the ClipMyDay account. Failed or interrupted multipart data and deletion work can remain while cleanup is retried. Deletion records are retained for at least as long as any recovery copy they can invalidate. Before public launch, this notice will be updated with the final configured cleanup schedules and recovery-copy retention periods.

Deleting a cloud copy does not delete a copy already saved on a device. Account deletion waits for confirmed cloud cleanup before deleting the Firebase sign-in identity; it does not delete the local Android library or cancel a Google Play purchase. Cloud backup supplements rather than replaces a separate portable backup of memories that cannot be replaced.

Google Play

On app startup, Google Play Billing checks the Pro product catalogue and prior ownership so ClipMyDay can show the current localized offer and entitlement state. Google Play can process the app package, device, account and purchase context needed for those provider checks; ClipMyDay does not send your memories, project names, notes, filenames or diagnostics in these requests.

A purchase still begins only after you choose Pro and confirm Google Play’s own checkout. Google Play processes that transaction; ClipMyDay does not receive your full payment-card details.

Purchase verification records

To verify paid access and handle purchase changes, ClipMyDay keeps cryptographic references to the purchase, order and account, an encrypted Google Play purchase token, product details, and records of access decisions, acknowledgements, subscription replacements, refunds and chargebacks. These billing records do not contain your email address, raw Firebase user ID or payment-card details. Refund reviews may also retain an encrypted order identifier and pending-refund token and, when Google Play supplies them, pseudonymous account and profile identifiers, together with the refund reason, provider event time and review state.

Deleting your ClipMyDay sign-in account does not automatically erase these purchase, refund and security records. They help prevent the same purchase being claimed by another account, process refunds and chargebacks, and keep purchase verification reliable.

Core purchase and account-verification records, refunded or voided purchase references, unmatched purchase notifications and unresolved refund reviews currently have no fixed automatic deletion date. Completed purchase-notification processing records are scheduled to expire after 30 days, and completed refund-review records after 90 days. Automatic cleanup can occur after the expiry time.

Android sharing and storage destinations

When you share a moment, export a movie or save an archive, Android shows the apps or destinations you can choose. The selected provider’s terms and privacy practices then apply.

Archives and app lock

ClipMyDay archives are unencrypted ZIP files. Anyone, app or storage provider with access to an exported archive can read its contents. The optional app lock controls access to ClipMyDay on the device; it does not encrypt or protect exported archives. Choose protected storage or a provider you trust before saving or sharing an archive.

Support

If you email support, Kastovia receives the email address and information you decide to include. Diagnostic reports are designed to exclude media, thumbnails, project names, notes, dates, filenames, paths, URIs and media hashes.

Your controls

• Review or revoke Android permissions in system settings.
• Export individual moments and movies.
• Create a portable, checksummed archive.
• Delete individual moments or projects inside the app.
• Inspect or delete each operation recovery copy in Settings → Archive & restore.
• Delete all app-private ClipMyDay data from Privacy settings.
• Delete exported copies separately from the destination where you saved them.
• Delete your sign-in account at Account after reauthenticating with your current sign-in method. ClipMyDay first removes cloud backups and saved cloud movies, then deletes the online identity. Local Android data remains, and Google Play purchases or subscriptions must be managed separately.
• Account deletion does not automatically erase the purchase, refund and security records described above. Contact support for a data-deletion request; we will explain which records can be removed and which remain necessary for purchase integrity.

This website

The ClipMyDay website does not set product analytics or advertising cookies. Optional account registration uses your email address through Firebase Authentication as described above. The separate preview-access button opens your own mail application with a short message that you can review, edit or discard. Nothing is submitted automatically by that button.

The earlier preview form has been retired. Any historical hosting-database rows created by that form, if present, are quarantined as unconfirmed and non-sendable: they are not exported, used for preview mail or treated as proof of consent. Email support if you want the team to locate and delete a historical request.

Normal hosting infrastructure may process short-lived request information such as IP address, user agent, requested URL and security logs to deliver and protect the site.

Questions and requests

Email support@clipmyday.com. Include only the minimum information needed; never email private memory files unless support specifically requires one and you choose to send it.