Privacy
Last updated
calman reads calendar links you give it and publishes the feeds you configure. This page lists what it stores, why, where, and for how long. Questions and requests: calman@wykwit.pl.
What calman stores
- Your account
- Your email address, when you signed up, your plan.
- Sign-in
- Sign-in links are stored only as hashes and work once, for 15 minutes; each request for one records the email address and the IP address it came from. Each session stores a hash of its cookie, the browser name and IP address it was started from, and when it was last used. Sessions end after 30 days or when you sign out.
- Sources
- The calendar address, encrypted (AES-256-GCM), its host name for display, and the label, description, colour and settings you chose. Fetch results: times, errors, the calendar's name and event count.
- Calendar content
- The latest copy of each source calendar as its server sent it, which can include whatever that calendar contains (titles, places, attendee names). Each fetch replaces the previous copy. Published feeds are built from it at the level of detail you chose; attendees, organizers and alarms are never published.
- Feeds
- Feed settings, the private link, and the latest published copy.
- Feed requests
- A count of requests per feed and response status, keyed by a shortened hash of the link. No IP addresses or calendar apps are recorded.
- Billing (Pro)
- Stripe's customer and subscription ids, plan status and renewal date. Card details go to Stripe and never reach calman.
What calman does not do
- No advertising, analytics or tracking cookies. The only cookie is the session cookie that keeps you signed in.
- No access to your calendar accounts: calman only reads the links you add and never writes anywhere.
- Your data is not sold or shared beyond the services below.
Services that process data for calman
- Cloudflare
- Runs calman and stores its database and files, in the EU jurisdiction. Cloudflare handles every request, including the IP address it comes from.
- Cloudflare Email Routing
- Delivers sign-in emails: your email address and the message.
- Stripe
- Handles payments for Pro: your email address and payment details.
How long data is kept
Until you delete it, except sign-in records: a sign-in link request is deleted a day after it was made, and a session within an hour after it ended. Deleting a source removes its stored copy; deleting a feed makes its link stop working; deleting your account removes everything above at once. Database backups are encrypted and kept for up to 90 days, so deleted data disappears from them within that time. Request counts are kept for 3 months.
Your rights
You can download your account data, including sources with their full addresses, feeds and settings (Account → Export data), and delete your account at any time (Account → Delete account). For access to anything else, correction or objection requests, or a complaint, email calman@wykwit.pl. You can also complain to your data protection authority.
People in your calendars
Calendars can name other people. calman processes those names only to publish your feeds as you configured them, keeps only the latest copy, and strips attendees from everything it publishes. Choose a lower level of detail for feeds that others see.