Your reflections,
kept simply.

When you create an account, Dayfold’s database keeps:

• your email address and optional display name;
• your password, as a salted scrypt hash (never the password itself);
• a SHA-256 hash of your recovery key (never the key itself);
• if you ask for a password-reset email: a SHA-256 hash of the link’s one-time token, when it expires (after 30 minutes) and whether it was used;
• whether feeling suggestions and the stress-language check are on;
• each reflection you save: its text, the feelings you chose (including Stressed, if you confirmed it after a stress check), whether you kept it to revisit, and when it was written and last edited;
• anything you choose to save after a reflection: your worksheet answers and small action, whether you completed it, whether you marked it or a pause helpful, and the topics you picked;
• sign-in sessions: a hash of the session token and its expiry date.

To slow down password guessing and spam, Dayfold also counts recent requests per IP address and per email. These counters are stored under a keyed hash rather than the address itself and are deleted after about two days.

Dayfold runs on Vercel, and accounts and reflections are stored in a Postgres database hosted by Neon (in the US), connected through Vercel. Connections to the site are encrypted (HTTPS), and the database provider encrypts stored data on its disks.

Reflections are not end-to-end encrypted. Dayfold doesn’t look at them, but someone with administrative access to the database could technically read them, as with most web services. If that matters for something you want to write, keep it offline.

Like any website, the hosting provider records basic request logs (such as IP address, the page or API address requested, and browser type) for a limited time. Journal text is only ever sent in the body of requests, never in addresses, and Dayfold’s own code never logs it.

• No advertising, analytics or tracking scripts, and nothing is sold or shared.
• No outside sign-in providers, and no email except the password-reset links you ask for. Those are sent through Dayfold’s Gmail account and contain only the link, never anything from your journal. Fonts and both models are served by Dayfold itself.
• No AI service in the cloud. Both models run in your own browser, and what they suggest is never saved.
• Organizations that share a link to Dayfold receive nothing: no entries, no feelings, and no list of who signed up.

Dayfold sets one cookie: a random sign-in token marked HttpOnly (page scripts can’t read it), Secure and SameSite=Lax. It expires after 30 days or when you sign out.

While you write, your unsaved reflection is kept in this tab’s session storage so a reload, a sign-in or a failed save doesn’t lose it. It’s removed when you save, sign out or close the tab. The two models are cached in your browser after their first download so they don’t need to be fetched again (about 30 MB for feeling suggestions and about 106 MB for the stress classifier, which only downloads if you ask for a stress check).

When you choose Suggest feelings, or pause while writing with suggestions turned on, your browser runs a small text-emotion model on what you wrote. The model (about 30 MB, downloaded once from Dayfold) runs on your device using WebAssembly. Your text isn’t sent to Dayfold or anyone else to be analyzed, and the site’s security policy blocks the page from connecting to any other server.

The model is MiniLMv2-goemotions-v2 (Apache-2.0 licence), a compact MiniLMv2 model fine-tuned on Google’s GoEmotions dataset of English Reddit comments. Dayfold only suggests labels that model was trained on, shown in plain words: Admiring, Amused, Angry, Annoyed, Caring, Confused, Curious, Longing, Disappointed, Disgusted, Embarrassed, Excited, Afraid, Grateful, Grieving, Happy, Loving, Nervous, Hopeful, Proud, Relieved, Regretful, Sad, Surprised.

Its idea of “neutral” is never shown as Calm or any other feeling. When nothing stands out, Dayfold says so and lets you choose. Scores are never shown as percentages, because they aren’t measurements of what you feel.

The model is often wrong. It was trained on short public comments rather than private journals, it tends to over-suggest “admiring”, and it can miss anger, sarcasm, mixed feelings and anything not written in English. It isn’t clinically validated and can’t detect or diagnose anxiety, depression or any other condition.

It’s also separate from the stress-detection research that inspired Dayfold. It wasn’t built from that work and doesn’t inherit its results.

You can turn suggestions off in Settings at any time and tag feelings yourself. If the model can’t run in your browser, manual tagging always works.

Dayfold can also run a classifier from Aarav’s own research. It looks for stress-related language, using the categories annotated in Dreaddit (a public dataset of Reddit posts labelled by people as stress-related or not). It’s a new training run of the paper’s MPNet LoRA-large configuration (an all-mpnet-base-v2 model with a small low-rank adapter), compressed to about 106 MB. The original paper’s weights weren’t kept, so this is not the exact model behind the paper’s numbers.

It only runs when you press “Check for stress-related language”, and like the feeling model it runs entirely in your browser. It gives one of three answers: stress-related language suggested, no clear stress-related language suggested, or uncertain. It says “uncertain” whenever its confidence is below a threshold chosen on held-out research data. Long entries are checked in parts, and Dayfold tells you when that happens.

It can’t measure how stressed you are, tell what you’re actually feeling, or diagnose anxiety or anything else. It was trained and tested on Reddit posts, not journals, so its research accuracy doesn’t carry over to your writing. When it suggests stress-related language, Dayfold asks whether that fits; only if you say yes is “Stressed” added to your feelings, like any feeling you choose. Its suggestion itself is never saved, and an uncertain or negative result never labels you as calm or unstressed. Summaries count Stressed the same way as your other feelings. You can turn the check off in Settings.

The open-source feeling model and this classifier are separate. Dayfold never blends them into a combined score.

“What would help right now?” is optional. The worksheet saves only what you write, the pauses are fixed prompts written in advance, and “What helped before?” shows only things you marked helpful. Nothing there is generated or suggested by a model.

Summaries are counts of what you saved, such as actions completed or things you marked helpful. They describe your records. They don’t claim anything caused a change, and Dayfold doesn’t treat any condition.

• Edit or delete any reflection from your journal.
• Export everything as JSON or plain text from Settings.
• Delete your account from Settings. This immediately and permanently removes your account, every reflection, your settings and your sign-in sessions from the database.
• Forgot your password? Ask for a reset link by email: it works once, expires after 30 minutes, signs you out everywhere when used, and leaves your reflections untouched. The recovery key you saved at sign-up still works as a backup. Signing up never needs email confirmation.

If you use the “For organizations” form, your name, organization, email and message are stored in Dayfold’s database so they can be read and answered by email. They aren’t linked to any journal account.

Dayfold is a journal, not therapy or medical care, and nobody monitors what you write. If you’re struggling or in danger, please contact a health professional, a local crisis line or emergency services.