Privacy Policy

Effective October 30, 2026

Dayfend helps you filter eligible scam texts, block known dangerous domains, monitor published email breaches and assess suspicious content. This policy explains the information those features use.

Dayfend is operated by Viral Ventures LLC. Privacy requests and questions can be sent to ceo@veryviralventures.com or to our mailing address:

Account, access and payments

We use your email address, account identifier, sign-in information and session credentials to authenticate you and keep your account private. Supabase provides account authentication and database services. Device identifiers, protected connection credentials and notification subscription identifiers connect your devices to your account. Some credentials are kept in the iPhone Keychain; the server stores hashes of device-management and DNS credentials.

Apple or Whop processes purchases. Dayfend keeps subscription and transaction identifiers, product, billing-provider, status and access-expiry information to verify access, handle renewals and prevent duplicate billing. We do not receive your full payment-card details. The payment provider maintains its own purchase, payment and legally required records.

The web account service uses session cookies to keep you signed in. These legal pages contain no tracking scripts. We do not run advertising trackers, sell personal information or share it for targeted advertising.

Text protection

When you select Dayfend as your iPhone text filter, iOS may send eligible unknown-sender message content and sender information to Dayfend for a filtering decision. The current filter checks links against our shared domain policy. It does not inspect all of your conversations or provide filtering inside iMessage or other chat apps.

We do not store SMS or MMS message bodies or sender information. We do not copy filtered messages into a Dayfend message archive. Your messages remain in Apple Messages. Apple controls which messages the extension can check.

Website protection and block alerts

While Dayfend is selected as your DNS provider, domain lookups from apps using system DNS are processed by our service and its upstream DNS resolvers. DNS protection evaluates domain names, not the contents of individual encrypted web pages. We do not keep an ordinary DNS-query or browsing history.

A confirmed blocked-domain event can contain the domain, device identifier, reason and time for up to 24 hours, so you can understand an alert. It does not contain the full page URL or the contents of the page. A browser explanation link normally expires after 15 minutes and cannot outlive its underlying event. Push notifications use generic copy and an opaque event identifier rather than the blocked domain.

OneSignal and Apple provide push delivery. Notification permission is optional. Turning it off stops push delivery; it does not by itself remove DNS settings or stop breach-monitoring email.

Email breach monitoring

Monitoring starts only when you explicitly enable it for your own currently verified account email. That email is sent to Have I Been Pwned (HIBP) to look for published breaches. The first successful lookup establishes a baseline and does not send a breach alert. Later checks are scheduled approximately daily while monitoring and access remain active. Newly found breach names can generate a grouped email and, when enabled, a generic push notification.

We store the monitored email and public breach metadata, including breach names, reported and published dates, descriptions, category labels and your review markers. We do not retrieve your actual leaked passwords, phone numbers, addresses or other leaked values. A category describes the breach as a whole and does not establish that your individual record contained every listed field.

Disabling monitoring removes the watch, its findings and pending notification records from the active service database. Changing the verified account email removes the old watch. Accepted or skipped notification records are normally cleaned up after seven days. Messages already accepted by an email or push provider may still be delivered. HIBP maintains its own independent breach database and privacy practices; disabling Dayfend monitoring does not remove records from HIBP. See HIBP’s Privacy Policy.

Scam checker and third-party AI

The checker accepts text or a link, optional context and one image. The app prepares the selected image for upload; the server checks its format and size and removes metadata before forwarding a normalized image. We do not automatically upload your photo library or messages. Submitted links are not opened or crawled by the checker.

Dayfend does not store or log checker input, images or result history on its server. Content is processed in memory for the request and the result is returned to the app. We keep limited usage and idempotency metadata: account and request identifiers, a keyed fingerprint of the request, timestamps, processing state, usage and cost. This metadata is kept for up to approximately four days and is removed from account-linked active storage when the account is deleted. Aggregate budget totals do not contain submitted content.

Requests ask OpenRouter to use zero-data-retention-eligible inference endpoints and deny provider data collection. We do not intentionally enable input/output logging for these checks or use submissions to train Dayfend models. These controls are not a promise that every intermediary retains no data under every circumstance. OpenRouter and Google still process the content; their policies can cover transient processing, abuse prevention, security and legally required handling. See OpenRouter’s Privacy Policy and Google Cloud’s Privacy Notice.

AI can misunderstand an image, miss a scam or flag a legitimate request. “No obvious red flags” means only that the check did not identify obvious signs in the supplied content. It is not a certification of safety or identity.

Providers and other records

Our service providers include DigitalOcean for hosting; Supabase for authentication and account data; HIBP for breach lookups; OpenRouter and Google for consented AI checks; Resend for sign-in and service email; OneSignal and Apple for push delivery; and Apple and Whop for payments. DNS resolvers process the domain requests needed for website protection.

Providers may process network information such as IP addresses, authentication events, delivery records and security diagnostics under their own policies. Dayfend’s application does not deliberately put message bodies, checker content, images or ordinary browsing history into logs. Support messages you choose to send are used to answer and resolve your request.

Infrastructure and providers may process information in the United States and other countries. We do not promise that all processing remains in one country.

Retention, deletion and your choices

Account and device information is retained while needed to provide your account and requested features. You can turn off breach monitoring in the app, withdraw checker sharing by not submitting another check, change notification permission in iOS, and remove Dayfend DNS or the selected text filter in Settings.

You can request account deletion from the app’s Account screen or the web account service. We verify the request, remove active account-linked protection data and revoke device access. Account deletion does not cancel an Apple subscription; cancel it separately in Apple’s subscription settings. Disabling a feature or deleting your account does not erase information held independently by HIBP, Apple or another provider.

Authentication/security logs, backups and payment or legal records can have separate retention requirements and may not disappear immediately when active application data is removed. We retain information only for the relevant service, security, support or legal purpose.

Depending on where you live, you may have rights to access, correct, delete or receive a copy of your information, withdraw consent, restrict or object to processing, or complain to a privacy authority. Contact ceo@veryviralventures.com. We may need to verify your identity and will handle requests as required by applicable law. We do not discriminate against you for exercising applicable privacy rights.

Children and policy changes

Dayfend is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has provided personal information, contact us so we can address it and remove it where appropriate.

We may update this policy as the service changes. The effective date appears above; material changes will be communicated as required by law, and we will request new permission where needed before a new use of your content.