Legal

Privacy Policy

Effective date: October 26, 2026

Calmendar (the "App") is an app for iPhone and Android for notes, tasks, appointments, reminders, voice capture, and optional AI organization. This policy explains what the App stores, what it sends off your device, and the choices you have.

1. Who we are

Calmendar is operated by the Calmendar team.
Contact: through the support form, or at contact@calmendar.app

2. Summary

No account is required to use Calmendar.
Your notes, tasks, reminders, and recordings are stored primarily on your device.
The App does not show ads, does not include analytics or advertising SDKs (the only third-party code that reports anything is optional crash reporting, see section 9), and does not use advertising identifiers such as IDFA.
AI features are optional and only run when you trigger them.
You can erase all of your data from inside the App at any time.
If you choose to send notes to other people, they are end-to-end encrypted: we can relay them but cannot read them (see section 4).

3. Data we store on your device

Notes, tasks, reminders, lists, subtasks, completed history, personal glossary, and appointments you create.
Voice recordings you capture are kept privately on your device only. We never upload them to our servers or to any AI service, and they are excluded from backups. While you speak, the audio is also passed to your phone's speech service to be transcribed, as described in section 5. Transcripts are text and stay on your device unless you use AI processing.
Appointments imported from calendars you grant the App access to. Calendar access is read-only — the App never writes to or modifies your calendar.
A contact name you choose to attach to a task. Read on-device only; not transmitted.
App preferences and settings.

4. Sending notes to other people (optional)

If you choose to link with another person and send them notes, the App uses a small relay server we operate on Cloudflare. It works like this:

What leaves your phone. A random device identifier and a public encryption key (created on your phone, never tied to your name, phone number, or an account); an address used only to ring your phone with a generic "you received a new note" alert (an Apple push token on iPhone, a Firebase installation identifier from Google on Android); your interface language; and, for each link, which two devices are linked and when. Names are encrypted too.
Notes. Each note is end-to-end encrypted on your phone and decrypted only on the recipient's phone. We cannot read it. The encrypted note waits on our server until the recipient's phone confirms it saved it, and is deleted after at most 7 days even if never collected.
What the server can see. Who is linked to whom, when links and notes were created, note sizes, push addresses, and the network address of requests as they arrive. Short-lived counters keyed by network address (kept for up to a day) limit abuse. We never see the text of a note.
Delivery status. The sender can see "sent", "delivered" or "not delivered". This status record, which contains no note text, is deleted as soon as the sender's phone has read it and at the latest 14 days after the note was sent. We never tell a sender whether a note was accepted or why it was not delivered.
Reports. If you report a note, we receive the report you send. It includes the text of the note only if you choose to include it, and then that text is readable by us. The report is stored on our server and emailed to the Calmendar team, who aim to act on it within 72 hours. The stored report is deleted after 90 days, and the copy in our support mailbox is deleted by us within the same 90 days. We cannot reply to a reporter, because reports carry no name or contact detail: you will see a confirmation in the App only. Reports may be used to block abusive devices.
App Review demo partner. For app-store reviewers, a demo contact ("Calmendar Demo") run by our server can be connected from the review page. By design, our server holds the encryption keys of that one link. Normal links are never affected.
Backups. Our relay database keeps restore points for up to 7 days, so deleted records can remain in them until they expire. Because notes are encrypted, those restore points do not contain readable notes, with two exceptions: the text of a report if you chose to include it, and the demo partner's link described above. On your own phone, the files for direct notes are kept out of iCloud and device backups, and their keys are stored in a way that is not restored onto another phone.
Erasing and uninstalling. "Erase All Data" in Settings ends this identity on our server straight away (or as soon as your phone is back online if it is offline at that moment). Deleting the App alone does not tell our server, because neither iPhone nor Android lets an app do that: on iPhone, reinstalling ends the old identity automatically; on Android it cannot be ended afterwards. In that case the other person's contact for you simply stops receiving, notes still waiting expire after at most 7 days, and the other person can remove the contact at any time.

Sending from a computer. The encrypted computer page (calmendar.app/send) works like another device in the arrangement above: your browser keeps its own keys in its local storage, and notes are encrypted in the browser and decrypted on your phone, so we cannot read them. The older "Send from Computer" page (calmendar.app/pair), available on iPhone and on Android, follows a different path that is not end-to-end encrypted between your browser and your phone: the text travels inside the push notification that Apple (iPhone) or Google (Android) delivers, and passes through our pairing server, which does not keep a copy of it. To pair a computer, the App sends the scanned code and your phone's push address (an Apple push token on iPhone, a Firebase installation identifier on Android) to that server, which stores them with the time of pairing and a label for the computer until you disconnect it in Settings. Google may hold a note that could not be delivered for up to one day.

5. Permissions the App may request

Microphone — to record voice notes you initiate.
Speech recognition — to transcribe your voice notes. Transcription is performed by your phone's speech recognition service: Apple's on iPhone, and on Android the service your device is set to use (typically Google's). Depending on that service, your device and your settings, the audio may be processed on your device or on the provider's servers. On Android the App passes the microphone audio to that service. How the provider handles it is governed by its own policies. We do not receive the audio.
Calendar — to read upcoming appointments. Calendar access is read-only.
Contacts — only if you ask the App to find a person named in a task so you can call, message, or email them. Contacts are read on your device and are not uploaded.
Notifications — to remind you about tasks and appointments.

You can change or revoke any permission at any time in your phone's Settings.

6. AI Processing Notice

AI features in Calmendar are optional. They are only invoked when you ask the App to organize, structure, summarize, or otherwise transform your text.

When you use an AI feature:

Relevant text — such as a transcript, the contents of a note, a task, or a list title — may be sent to OpenAI for processing.
Audio files are not sent to OpenAI.
Your full contacts list is not sent to OpenAI.
Your full calendar database is not sent to OpenAI.

OpenAI processes the submitted text under its own terms and privacy practices. Calmendar does not control OpenAI's retention or training policies and does not claim "zero data retention" on your behalf.

If you never use the AI features, no content is sent to OpenAI.

Your past corrections are sent to the AI service to build your personal preference profile; the profile is stored on your phone and you can clear it in Settings.

Help improve the AI (optional, off by default). If you enable "Help improve the AI" in Settings, the App sends correction examples — the transcribed text, the AI's suggestion, and your final edit — to our server so we can improve AI quality for everyone. Phone numbers, long digit sequences, and email addresses are removed automatically before anything is sent. Nothing that identifies you is attached: no name, no email, no account, no device identifier, and your IP address is not stored alongside it. Please note that this shared text is your own wording, so if you wrote a person's name inside a note, that name is part of the text that gets sent — we cannot detect names reliably, so we do not claim to remove them. If that matters to you, leave this setting off; it is off unless you turn it on, and you can turn it back off at any time in Settings. This data is kept for up to 12 months and deleted automatically after that.

Abuse prevention. Every AI request also carries two extra values: a random identifier generated on your device (not your device's real hardware identifier), and your internet connection's IP address — the IP is converted to a one-way, non-reversible code before it is stored, and is deleted automatically after about a day. Their only purpose is preventing unfair use of the free AI allowance. Neither is linked to your name, email, or account. The device identifier is kept in a system store designed to survive deleting and reinstalling the App, and is not reset by "Erase All Data" in Settings, so it keeps working for its one purpose even across a reinstall.

Promotional codes (Android). When you redeem a promotional code, the App also sends a one-way code derived from Android's app-specific identifier, so the code stays with your phone if you delete and reinstall the App. The identifier itself is never sent, the code is not linked to your name, email, or account, and it is used for nothing else. If you redeemed a code on an older version, the App also sends your previous random identifier once, only to move that code to the new one.

Service-outage compensation. If our AI service has an extended outage, affected devices are automatically credited a few days of Elite access as an apology. To make sure the same device can't claim this more than once for the same outage, the same on-device identifier described above is recorded alongside which outage it was credited for. This record is kept for up to 8 days — matching how long an outage stays eligible for compensation at all, plus our daily cleanup cycle — and is deleted automatically after that. It is not linked to your name, email, or account.

7. Backups

Backups are optional. If you enable backup, your data is written to a destination you control — your own iCloud or Google Drive account — as a JSON file without audio. Calmendar does not operate a server that stores your backups. To back up to Google Drive on Android you sign in with your Google account; the App uses it only to write the backup file to your own Drive, and your Google name and email are never sent to us. You can delete a backup from Settings → Backup. Uninstalling the App does not delete your cloud backups. Separately, your phone's own device backup (iCloud Backup on iPhone, Google's device backup on Android) may include the App's data, such as your notes and tasks; voice recordings are excluded from those device backups. Erasing data in the App does not delete copies already held in a device backup you made.

8. What we do not do

No ads or ad networks.
No analytics or advertising SDKs. The only third-party code that reports anything is crash reporting (see section 9), which you can switch off in Settings.
No tracking across other apps or websites.
No selling of personal data. Data is shared only with the service providers listed in section 9, and never for advertising.
No use of IDFA or other advertising identifiers.

9. Third parties

Apple Inc. — speech recognition, iCloud, in-app purchases and subscription billing.
OpenAI (USA) — AI text processing.
Cloudflare (USA) — hosts our server that relays AI requests, validates App Store receipts and Google Play purchase tokens, briefly stores a random device identifier and a non-reversible code derived from your IP address to prevent unfair use of the free AI allowance (deleted automatically after about a day), separately records which service-outage compensation credits a device has already received (deleted automatically after up to 8 days), and, only if you opt in, stores AI correction examples. Nothing stored there identifies you by name, email, or account.
Google LLC (USA) — Google Play purchases and subscriptions and, on Android phones whose speech recognition service is Google's (typically), that service, which receives the audio you dictate in order to transcribe it (see section 5). When you subscribe on Android, the App sends your Google Play purchase token to our server so it can ask Google whether your subscription is active; the token is not stored.
Google LLC (USA) — two separate, unrelated uses: (1) Google Sign-In and Drive backup, only if you choose to enable them, and (2) downloading the App's own display fonts from Google Fonts the first time each is needed, which happens automatically regardless of any other Google feature. Font downloads carry no personal data — only a request for a font file, the same as loading a font from any font provider.
Google LLC (Firebase Crashlytics) — crash reports. If the app crashes or hits an unexpected error, it sends the type of error, the technical trace of where it happened, your phone model, system version and app version, and a random installation identifier. It never sends your notes, tasks, names, recordings, or the text of the error message. It is on by default and you can switch "Send crash reports" off at any time in Settings, after which nothing is sent. Reports are used only to find and fix bugs and are not linked to your identity.

We do not sell or share your personal information for advertising.

10. Retention

Your content stays on your device until you delete it. Cloud backups stay in your cloud until you delete them. OpenAI retains API data per its API terms; data is not used to train models by default.

For notes sent between people: an encrypted note is kept on our relay for at most 7 days (and deleted as soon as the recipient's phone confirms it has stored it); delivery status records for at most 14 days; reports, including any text you chose to include, for 90 days; links and device records until you remove the link or erase your data.

11. Children

Calmendar is not directed to children under 13 and is not designed to collect data from children.

12. Data Deletion

Because Calmendar stores your data on your device, you can erase everything at any time from inside the App using the "Erase All Data" option in Settings. Deleting the App from your phone also removes the local database.

"Erase All Data" also ends this device's identity on our relay for direct notes: its links, any open invitations, and any notes still waiting for delivery are removed, though records already in the relay's short restore window can remain there until it expires. Deleting the App alone does not reach our server (see "Erasing and uninstalling" above); use "Erase All Data" first if you want everything ended.

If you previously enabled backup, you can delete those backups from your iCloud or Google Drive account directly. To request help with deletion, contact us through the support form.

13. Your rights

Depending on where you live, you may have rights to access, correct, or delete personal data. Because Calmendar keeps your content on your device, you generally exercise these rights directly inside the App — view, edit, delete, export (Backup), erase everything, or disable AI. For any question, contact us through the support form.

14. Changes

We may update this policy as the App evolves. Material changes will be reflected by updating the effective date above and, where appropriate, by an in-App notice.

15. Contact

Use the support form — it goes straight to the Calmendar team — or write to contact@calmendar.app.