Privacy Policy

Kalendars is not a calendar service. It reads the calendars your device already has, through the permission you grant in iOS or macOS. Your events live in your device's own calendar and in a database on the device itself. We do not sync your calendar to our servers and we keep no copy of your week. So that the month view shows your events the moment you open the app, Kalendars keeps a small copy of the titles, times and calendar colours of the events around the month you last looked at, in its own storage on your device. That copy never leaves the device, and it is deleted when you sign out or turn off calendar access. When you are signed in, the few choices you make about an event (the category you pick, whether it can move, and a new time you moved it to) sync to your account so they follow you to your other devices. They are stored against an identifier for that event, never its title, notes or guests (section 3). A place you pick for an event is different: its name and its position on the map sync to your account with that identifier, so the place follows you to your other devices.

Kalendars never connects to your Google, Microsoft or iCloud calendar on your behalf. There is no calendar integration to authorize, because there is none. Events from those accounts show up because you linked the account in your device's own settings and the operating system synced them; Kalendars only ever reads what is already there.

The one exception is Google Meet, and only if you choose it. When you set Settings > Video calls to Google Meet, you sign in to Google once, on your device, and allow Kalendars to create Meet meetings for you. Each time you tap "Add a video call", Kalendars asks Google for a new Meet link and puts it in the event's notes. Kalendars asks only for that permission and for your email address, so Settings can show which Google account it uses. It never sees your Google calendar, your mail or your contacts, and it sends Google nothing about the event: not its title, time, guests or notes. The sign-in is kept in your device's keychain, never on our servers, and signing out in Settings removes it from your device and withdraws the permission at Google. Kalendars' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The other permissions work the same way. Workouts from Apple Health (with their route, heart rate and other measurements) and sleep (with heart rate, breathing and other measurements during the night), your contacts, and your location are all read on the device, and none of the Health data leaves it. Health data is never used for advertising or marketing, and never shared with third parties. Location is used in three places: on the screen where you pick where an event is, to fill in where you are when you tap "use current location" and, when you search for a place, to put the ones near you first; and for the weather where you are, as described below. Your raw address book is never uploaded: it is read to put faces on the people already on an event, to show you a list when you are adding someone to a plan, and to offer the addresses on a contact's card when you type their name where you pick an event's place. The address you choose is written into the event, looked up for a map pin and synced like any place you pick, the same way an address you type is. Kalendars never writes to Apple Health. It writes to your contacts in exactly two places: when you use "Add a birthday" and press Save, the birthday you chose is saved to that person's contact card, because that is where your phone keeps birthdays; and when you pick a photo for someone who has none, that photo is saved to their contact card. For someone who is not in your contacts yet, Apple's own new-contact form opens instead, filled in, and nothing is saved unless you tap Done. Those are the only changes Kalendars can make to your address book, and only when you ask for them.

• Reminders: if you allow it, Kalendars reads and writes the reminders on your iPhone, to show them in its Tasks tab, to check one off when you check it off in Kalendars, and to create one when you ask. They stay on your device and in your Reminders app, and are not uploaded to our servers. When you ask Ask Kuberdon to add a task, what you ask goes to our AI provider as section 5 describes, and the reminder itself is written on your iPhone.
• Photos: Kalendars opens your photo library only when you pick a photo yourself: as your profile picture, as a group photo, for a contact card, or as a screenshot you attach to feedback. Only the photo you pick is used.
• Camera: used only when you choose Take photo, to take a photo for a contact card.
• Microphone: used only while you speak to Ask Kuberdon. The recording is not kept and is never sent to our servers.
• Speech recognition: what you say to Ask Kuberdon is turned into text by Apple's speech recognition, on your iPhone when it can, otherwise by Apple. You see the text before anything is planned, and only that text goes on to Ask Kuberdon (section 5).

Some features deliberately send limited information. Section 3: people you add and hashed identifiers sync to your account; current app versions keep their raw phone numbers and email addresses on your device. With mutual discovery on (the default once you verify a phone number or email), hashes of permitted contacts also go to our server for matching, including against the email addresses of other Kalendars accounts that let contacts find them by email. Section 4: typing a plan never leaves your device. Section 5: what you ask Ask Kuberdon, the assistant, goes to our AI provider to be answered. Section 6: when you share a plan by link, that one plan is stored so the page can show it, and when you let Kalendars send the invitation, the guest's email address or phone number passes through our server to deliver it. Section 7: to put a face on a guest, a hash of their email goes to our server, never the address.

The weather works the same way. When you pick a city for the weather, the words you type in that search go to Photon, a place search run by Komoot. The coordinates of the city you chose then go to our server, which asks Apple WeatherKit for the forecast. If you have allowed location and have not picked a city, or you tap "Use my location", the weather follows where your device is instead: your device rounds its position to about a kilometre, asks Apple for the name of the town, and sends those rounded coordinates to our server, which asks Apple WeatherKit for the forecast and stores that forecast filed under the rounded coordinates, not linked to you or your account. Where your device is never syncs to your account; only a city you picked does.

You need an account to use Kalendars: it is what your subscription belongs to, and what lets you share plans with other people. This is everything we hold for it:

• Your account: your email address, the phone number you verify in Kalendars (so you can also sign in with it), plus your name and profile picture if you set one. Profile pictures are stored in a private file bucket, readable only by you and by us.
• Your contact details and discovery: linking your own contact copies its phone numbers and emails into local, account-specific storage. Its name can fill your account profile. Linking does not verify ownership or enable discovery. When you request verification, the chosen phone number goes to Twilio for an SMS, or the email address goes to Resend for a code. The identity directory stores server-keyed matching tokens and encrypted hashes, not those raw destinations. A phone number you verify is also saved on your account as a way to sign in (see above). Hashes are still personal data. Discovery is on by default: once you verify a phone number or email, people who are in your contacts, and who have you in theirs, can find you, unless you turned discovery off earlier (choosing "Not now" when the app asks counts as off). You can turn it off at any time in Settings, Account, with "Let mutual contacts find me". While it is on, it sends hashes of the phone numbers and emails your Contacts permission allows us to read. A match is visible only when both accounts have discovery on and have saved each other's verified details, or when you are connected through a plan (see Your connections). People can also find you by the email of your account: when someone has one of your account's email addresses in their contacts (the one you sign in with, one from a linked Apple or Google sign-in, or one you verified in Kalendars), and they have discovery on themselves, Kalendars shows them that you use it. This is on by default, also for accounts made before it existed, and you can turn it off at any time in Settings, Account, with "Let contacts find me by email". It is also off if you turned "Let mutual contacts find me" off. For this, our server compares the hashes of their permitted contacts with hashes it computes from your account's addresses at that moment; it stores nothing new, never shows anyone your address, and shows nothing of your calendar. It only marks you as a Kalendars user; it does not let them send you invitations in the app. Blocking, unlinking an identity or disabling discovery removes the corresponding matches. Contact assertions expire after 30 days unless refreshed; identity verification expires after 180 days. Codes expire after 10 minutes and attempts are limited.
• Your people: the names of the people you add to Kalendars, and of the people it suggests to you from the guest lists of your events, plus any note you write about someone and the groups you make (their name and photo). Their email addresses and phone numbers are kept as hashes (section 2).
• Your connections: when you are signed in and answer Going or Maybe to a plan someone sent you by link, you and the person who sent it are connected in Kalendars, both ways, whether or not discovery is on. We store only that the two accounts are connected and when. A connection shows each of you the other's Kuberdon account name and the Kalendars mark in the Kalendars filter of your people, and lets your next invitation to each other arrive inside Kalendars instead of as a link. It shows nothing of either calendar. Blocking the other person stops the connection working for both of you; it is deleted with either account.
• Your settings: what you set up in Kalendars, so it follows you to a new device. That is the categories and quick-create templates you make (their names, emoji and note templates), your sleep, working and lunch schedules, which calendars you show, their colours and whether each is work or personal, saved under each calendar's name and the name of its account (often an email address), the city you chose for the weather, and the per-event choices from section 2: the category you picked for an event, whether it can move, a new time you moved it to, and a place you picked for it (its name and position), each stored against an identifier for that event.
• Your tasks: the tasks and lists you make in Kalendars, meaning their titles, notes and due dates, so they sync between your devices.
• Your device for notifications: if you allow notifications, the push token of your device, so we can deliver them.
• Your partner: if you link a partner, their name and an internal identifier sync with your settings, never their email or phone number.
• Plans you shared by link: when you tap Send invite, we store that one event, meaning its title, time, location and your name, plus the name you have for the person you sent it to and the answer they give. That is what the page they open is made of. Only the plans you deliberately shared, never your calendar, and we delete all of it 30 days after the event.
• Invitations Kalendars sends for you: nothing beyond the plan above. The guest's email address or phone number is used to send that one message and is not stored on our server. We keep a count of the invitations each account sends (for the limits in section 6), the time an invitation email bounced if it could not be delivered (so you see it failed, without the address), and, if someone unsubscribes, a one-way hash of their address. On your phone, Kalendars remembers which address you picked for a person and which guests it emailed about a plan, so a change or a cancellation reaches them too; that stays on your device. If a guest answers an older invitation that came with a calendar file, from their own calendar app, their calendar emails that answer to a reply address made for that one invitation. We read the answer, record it the same way as the buttons in the email, and forward the reply to you. We do not store that email or the guest's address.
• Private events: one random encryption key for your account, so Kalendars can read the names of your private events on your devices. In your calendar a private event is called "Private Event" and its real name is stored there, encrypted, in its notes. We never see the names.
• If you applied to an earlier test of Kalendars: what you sent when you applied: your first name, your email, the calendar you use now and, if you wrote one, what you wanted Kalendars to fix, kept so the founder can review your application.
• Sign-in and abuse records: a record of each sign-in (your email address, the app or site you used, and your IP address), and your IP address against the public forms so they cannot be flooded.

"Dinner with Sam on Thursday at 8" is read on your iPhone, by a parser that ships inside the app. Nothing about it leaves the phone: not the sentence, and not the events around it. It works signed out, offline, and when everything of ours is down.

Kalendars uses AI in one place only, Ask Kuberdon, the assistant, and only when you choose to (section 5).

Ask Kuberdon is the assistant in Kalendars: you ask it in words or by voice to add, move or plan something, or about your week, and it answers or suggests an action you approve. It needs an AI model, and that model does not run on your iPhone. So when you use Ask Kuberdon, this goes through our server to a third-party AI provider, through their API:

• what you ask, and the conversation so far;
• your first name, and the names of the people you mention, so the right person is found (names only, never their phone number or email address);
• the current date and time, your time zone and the language you are using;
• your work and sleep hours, from your day settings: when you wake up and go to bed, your work hours and work days, your lunch time, when your evening starts and your usual event length;
• when you ask about them, your plan requests in Kalendars (their title, the other person's name and the times offered), which are on our server already (section 6);
• only if you allow it, the titles and times of the events on the days you ask about, and your free time on those days. Notes, places and guests of your events are not sent.

Kalendars asks for your consent once, before you first use Ask Kuberdon, and you can turn it off at any time in Settings. Without that consent nothing from your calendar is sent.

We use AI models from OpenAI and Anthropic; which one answers can change as we test them. The information above goes to whichever one answers, through its API, and to nobody else.

We do not store what you ask or what comes back: not your messages, not the answers and not your calendar. The AI provider may keep what it receives through its API for a limited time under its own policy, for example to monitor for abuse; what we say here about storing is about us. The conversation lives on your iPhone. What our server keeps is a count per day: how many requests you made (for the daily limit), how much the AI model was used, its estimated cost and which model answered, linked to your account. Our logs hold counts, timings and errors, never the text. Ask Kuberdon never saves anything to your calendar by itself: every change it suggests waits for you to approve it.

When you send someone a plan, they see that plan: what it is, when it is, where it is, and who invited them. They see nothing else about your week, and they need no Kuberdon account, no app and no sign-in to open it. Nothing is shared by default, and there is no way for anyone to see the shape of your week unless you deliberately send it to them.

When you are invited to a plan through Kalendars, everyone invited to that plan can see your name and your answer (Going, Maybe, Can't make it, or no answer yet).

Sending a link is the one moment a plan leaves your phone. We store that single event so the web page can show it, and the name you have for the person you sent it to, so the page can greet them and so their answer comes back to the right face in your app. Anyone holding the link can see the plan, so treat it like any other message: if you send it to the wrong thread, you can turn the link off from the event, which stops every copy of it working, including forwarded ones. We delete the plan and the name 30 days after the event, whether or not you turn the link off. If the person you invite opens the link signed in to Kalendars and answers Going or Maybe, the two of you become connected (section 3, Your connections).

Your first name and your profile photo appear on that page, so the plan arrives from a person rather than from a stranger. Only your first name: your last name stays on your account and is never published. The app tells you this before the first link is created, and only links you make from then on carry your photo. Because the page reads your profile as it is now, changing your name or your photo changes what a link you already sent will show; taking your photo off in the app takes it off those pages too. One thing turning a link off cannot undo: if a preview of it is already sitting in a chat, that picture stays in the conversation, because messaging apps keep their own copy.

When Kalendars sends the invitation for you. After you save a plan with someone on it, Kalendars can send them the invitation itself, but only when you tap Send and only to the address or number you picked. For that, the plan (its title, time, place unless you hid it, your first name and photo) and the guest's email address go through our server to Resend, which delivers the email from [email protected]. Each guest gets their own email with Going, Maybe and Can't go buttons that open their plan page from this section, where they can answer and add the plan to their calendar; nothing is attached. Replies go to your email address, and if you keep "Copy me" on you get a copy of each email, so your address is on it too. If you choose a phone number instead, the number and the link go to Twilio, which sends a text with your first name and the link, not what the plan is. If you change or cancel the plan, the guests Kalendars emailed get the update. Every invitation has an "Unsubscribe from Kalendars invitations" link: after that, Kalendars never sends an invitation to that address again, from anyone, and all we keep is a one-way hash of it to check against. Each account can send at most 50 invitations per plan and 200 a day.

Kalendars shows a face next to the people on your plans. For someone whose photo is in your address book, that photo is matched on your device, as section 2 describes. For someone who is not, the app asks our own server for the picture that person deliberately published on a public avatar service, Gravatar or Libravatar. What the app sends is a one-way hash (SHA-256) of that person's email address, in the address of an image request: not the address itself, not their name, not which plan they are on, and not your account. The request works the same signed out, so our server cannot tell whose calendar asked. Those avatar services receive the same hash anyone who knows the address could compute, and nothing else. Our own dashboard uses the same lookup for members without a profile picture. For a company domain we may also fetch the logo the domain owner published in DNS (BIMI) or as a favicon.

What our server keeps is the hash, which source answered, and a small copy of the picture so it does not have to be fetched again, stripped of any hidden metadata, with no link to any member. Per-source detail is deleted after 90 days; a picture nobody has asked for in 180 days is deleted with its record. On your phone the picture is cached like any other image and is never written into your contacts or your account. Anyone can ask never to be looked up at kuberdon.eu/kalendars/avatar/opt-out: confirm by email, and that address is suppressed permanently and everything held for it is deleted.

We do not sell your personal information. This is the whole list of companies involved:

• Supabase: the database, the private file bucket, and sign-in.
• DigitalOcean: hosting for our websites (kuberdon.eu, and the pages your shared plan links open) and our API.
• OpenAI: what you ask Ask Kuberdon, when one of its models answers: your request, your first name, the names of the people you mention, your work and sleep hours, your plan requests and, only with your consent, the titles and times of the days you ask about (section 5).
• Anthropic: when one of its models answers, what you ask Ask Kuberdon, the same information as described for OpenAI (section 5).
• PostHog (EU): product analytics. Which screens get opened, which features get used and which steps get finished, as names, counts and yes-or-no answers: for example that a plan was made, that an invitation went to two guests by email, or how many of our widgets are on your Home Screen. It also gets the app's version and build and whether it came from TestFlight or the App Store. What PostHog never gets: your event titles or notes, task names, the names, email addresses, phone numbers or other contact details of people, places or addresses, anything you type, and any Health values (workouts, routes, heart rate, sleep). When you are signed in, the analytics are linked to your email address and name, and the same person is recognised on our website. We can look at one member's activity there, to understand a problem.
• Sentry: crash and error reports, so a bug on your device becomes something we can fix. When you are signed in, a report carries your user ID and email address, and can include what the app was doing when it failed, such as a place you were searching for. Feedback you send from inside the app (your message, and the name, email address and screenshots you add to it) goes to Sentry too.
• RevenueCat: manages your membership with the App Store. It receives your Kalendars user ID, so a subscription belongs to your account.
• Expo: delivers notifications to your device, with Apple, using your device's push token.
• Komoot (Photon): the words you type when you search for a city for the weather, as section 2 describes.
• Resend: our email, meaning sign-in and identity verification codes, replies to your application, and the invitations Kalendars sends for you (the plan and the guest's email address, section 6).
• Twilio: the phone number you choose to verify, to deliver and check its verification code, and a guest's number with the plan link when you choose to send an invitation by text (section 6).
• Apple: Sign in with Apple; speech recognition for Ask Kuberdon when your iPhone cannot do it on the device (section 2); and Apple Maps when you search for a place to put on an event: the words you type in that search, or the address from a contact's card when you tap it, go to Apple, along with roughly where you are if you have allowed location so the results near you come first, the same way they do in the Calendar app, and nothing else does. Apple WeatherKit, for the forecast of the city you chose or of roughly where you are, and Apple's place names, to name the town your device is in for the weather. Apple Push Notification service, to deliver notifications. When you subscribe, the payment itself is collected by Apple through the App Store, the way the Terms describe. We never see or store your card details.
• Gravatar, Libravatar and Google: a hash of a person's email, or a company domain, when the app or our dashboard looks up a public avatar or logo, as section 7 describes. Never the address.
• Google (sign-in): if you choose Sign in with Google, Google confirms who you are and gives us your name and email address.
• Google (Meet): only if you choose Google Meet for video calls, as section 2 describes: your Google sign-in, made on your device, and a request for a new meeting link each time you add a video call. Nothing about the event goes with it.
• People you invite: the plan you chose to send them, and the names and answers of the others invited to it (section 6).

Every company on this list receives only what it needs to do its part. Supabase, DigitalOcean, OpenAI, Anthropic, RevenueCat, Expo, Resend and Twilio run parts of Kalendars for us under data processing terms that are part of our agreement with each of them: they may use your data only to provide their service to us, and they are bound to protect it at least as well as this policy does. PostHog and Sentry offer the same kind of terms, which we have still to sign; until then, their own terms of service and privacy policies apply.

Komoot (Photon), Gravatar, Libravatar and Google's logo lookup are public services we have no agreement with. They get only what is described above: the name of the city you search for, sent from our server, or a hash of an email address or a company domain. Never your account, and never an email address itself. Apple and Google, when you use their sign-in, Google Meet, or Apple's maps, speech recognition, weather, notifications or payments, handle your data under their own privacy policies and your own agreement with them.

• We never sell your data, and we never hand it to advertisers or data brokers.
• We run no ads, and we never read your calendar to target anything at you.
• We never show anyone the shape of your week: not another member, not a company, not us in our own marketing.
• Kalendars is paid for by the people who use it, never by advertisers, so you are the customer. There is no second business model hiding behind the first.

What we store lives as long as your account does. You can delete your account in the app: open More, tap your name at the top, then Delete account. That deletes your account and what we store for it. Your calendar is not ours to delete: it stays on your device, untouched, whether the app is there or not. A plan you shared by link is the one thing on a clock of its own: it and the invited person's name are deleted 30 days after the event, whether or not you turn the link off and whether or not you keep your account. Application answers are kept so the founder can review your application, and are removed when you ask. When you write to us or we write to you, we keep those emails, or a short excerpt, together with notes about your application or account so we can follow up. We delete them on request and after 12 months. Sign-in and abuse-prevention records are kept for security, and you can ask for yours to be removed.

Under GDPR you have the right to access, correct, export or delete your personal data, and to object to how we handle it. Email [email protected] and a person answers. You also have the right to complain to the Belgian Data Protection Authority.

This applies whether or not you use Kalendars. If someone sent you a plan link, we hold your name and your answer because they invited you, and you can have both removed by writing to the same address. If Kalendars emailed you an invitation, the unsubscribe link in it stops all further invitations to that address. You do not need an account to ask, and you will not be asked to make one.

Everything travels over encrypted connections. Each member's rows are isolated at the database level, so one account cannot read another's even through a bug in our code. You sign in with Apple, with Google, or with a one-time code sent to your email or phone; we store no passwords. Kuberdon's founder can access the data that syncs to your account (what section 3 lists), because running the service needs it. He does not have your calendar itself: it is not stored on our servers, and what Ask Kuberdon sends with your consent passes through without being kept (section 5).

If a data flow changes, this page changes with it, in the same release. We will update the "Last updated" date above, and tell members directly when the change is material.

Questions about any of this, including the parts you think we got wrong:

JB CAPITAL BV, trading as Kuberdon
Email: [email protected]
Belgium