Privacy policy

What Howday knows about you

Howday is one emoji a day, shared with friends. No usernames, no profiles, no feed, no ads. This page says exactly what it keeps, what it never takes, and how to get rid of all of it.

Last updated 22 September 2026

What is stored, and why

Your phone number is how you sign in and the only thing that identifies your account. Verification codes are sent by SMS through Twilio. A hash of that number is what friend matching runs on.

Howday matches friends through your address book without ever uploading it. The app hashes the phone numbers on your device and sends only those hashes. The numbers themselves, and every name and photo, stay where they are.

How you and a friend become visible

You see each other's check-ins only when both of you have the other's number saved and both of you use Howday. One direction is not enough, and there is nobody to search for.

The person you add has usually not joined yet, so your uploaded hashes are kept rather than matched and discarded — that is what lets the two of you connect if they sign up later. They are replaced whenever your address book changes and Howday syncs again.

This does mean Howday holds hashes of numbers belonging to people who have never used it. Those hashes are shown to nobody, published nowhere, and used for nothing but this one match.

Notifications

A friend's notification is written by your own phone: the server sends a generic message and your device puts the name to it from your address book. The notification never shows their mood. Their mood does travel inside the message, so your widget can update without going online, which means it passes through Apple's push service on the way to you.

Analytics and crash reports

Howday counts screen views and a few actions — that a check-in happened, that an invite was shared — to see which parts of the app get used. It never records your mood, a name, a phone number or a hash, and it is not tied to your account: events carry a random identifier made when you install the app and gone when you delete it.

It runs on an analytics server we host ourselves. There is no third-party analytics, no advertising identifier, and no tracking across other apps or websites. Crash reports go to Sentry with personal data switched off, so a crash says where the code broke and nothing about you.

Where it lives

Howday's database and functions run on Supabase in the United States (us-west-2). SMS goes through Twilio, and notifications through Apple's push service.

Deleting everything

Check-ins and contact hashes are kept for as long as your account exists. In the app, Settings → Delete account removes the account and everything attached to it: your check-ins, your phone number and its hash, the hashes you uploaded, your contact matches and your notification token. It cannot be undone.

One thing deletion cannot reach: if other people have your number saved, their own uploaded hashes still include a hash of it, on their side of the match. Those go when they delete their account or their address book changes.

Your rights

You can ask for a copy of what is stored about you, ask for it to be corrected or deleted, object to how it is used, or ask for it in a portable form. If you are in the EU or UK you can also complain to your data protection authority.

Howday is not directed at children under 13, and we do not knowingly collect their data. If this policy changes, the date at the top changes with it, and material changes are announced in the app.