Privacy

Calandrea is a family calendar, chores and lists app for a wall display and the family's phones. This page explains how you sign in, what it reads from the calendars and to-do lists you connect, what else it keeps, what it does with it and how to remove it. Calandrea is run by Keiso Group Pty Ltd in New South Wales, Australia. For the short version, see privacy and security in plain English.

Signing in

Adults sign in with Apple, Google or a code sent to their email. Signing in only tells Calandrea who you are; it doesn't connect a calendar.

• Sign in with Apple: your name (the first time only) and an email address, which may be a private relay address if you choose Hide My Email. Apple handles the sign-in under its own privacy policy. Calandrea keeps a token from Apple so it can withdraw its access when you delete your account or stop using Apple to sign in.
• Google sign-in (openid, email, profile): your name, email address and Google account id.
• Email codes: your email address. Sign-in codes and invite codes are emailed through Resend. No passwords are kept.
• Invites match the email they were sent to. If you sign in with a different or hidden email, Calandrea can send a code to the invited address to check it's yours; it keeps a scrambled copy of that code for 15 minutes.
• If an adult chooses Email the invite, Calandrea emails the invite link to the address they entered, with their first name, the household's name and their sign-in email (so a reply reaches them). It's sent through Resend, without tracking.

Calendar data we read and write

Calandrea shows the calendars you connect: Google, Microsoft Outlook, iCloud (and other CalDAV calendars), and calendar links (a school or club calendar shared as a web link). It reads the same things from each, and only from the calendars you choose to show.

Google

• Your list of calendars (calendar.calendarlist.readonly): each calendar's name and whether you can edit it, so you can choose which calendars show on the wall and whose they are.
• Events (calendar.events): events on the calendars you choose, from 30 days ago to 180 days ahead (title, time, location, notes, repeat, and the email addresses of its organiser and guests), so the wall and phones can show them and show whose event it is. When you add, change, move or delete an event in Calandrea, it writes that change to Google Calendar, and Google emails the guests if you choose to send invitations. It also asks Google to tell it when those calendars change, so the wall stays up to date.
• Google Photos (photospicker.mediaitems.readonly): only the photos you pick in Google's photo picker for the wall's screensaver. Calandrea copies each picked photo, resized for the screen. It can't see the rest of your library.

What leaves Calandrea from Google: only an event's location, to show weather and a map for it. The location is looked up with Google Maps (or Apple Maps) to find where it is, and that spot is sent to Apple Weather for the forecast. Nothing else about the event (its title, notes, time or guests) is sent. No other Google Calendar or Google Photos data is shared with anyone, except the hosting services that store it for us (see Where it's kept).

Microsoft Outlook

• Microsoft sign-in (openid, email, User.Read, offline_access): the account's email address, so you can see which account is connected, and a token that lets Calandrea keep the calendar up to date when you're not using it.
• Calendars and events (Calendars.ReadWrite): each calendar's name and whether you can edit it, and events on the calendars you choose, from 30 days ago to 180 days ahead (title, time, location, notes, guests and repeat). Changes you make in Calandrea are written back to Outlook, and Calandrea asks Microsoft to tell it when those calendars change.

iCloud and other CalDAV calendars

• An app-specific password: to connect iCloud you make an app-specific password at appleid.apple.com and give it to Calandrea with your Apple ID email (never your Apple ID password). Calandrea keeps it on the server only, encrypted. Apple limits such a password to calendars and contacts, and you can revoke it at any time; Calandrea only uses it for calendars (and, with other CalDAV services, a to-do list you choose to sync: see Lists synced with other apps). Yahoo and Fastmail work the same way with an app password made in your Yahoo or Fastmail account, and so do other CalDAV services (Nextcloud, Synology).
• Calendars and events: each calendar's name, and events on the calendars you choose from 30 days ago to 180 days ahead (title, time, location, notes, guests and repeat). Calandrea checks those calendars for changes every 5 minutes, and writes changes you make in Calandrea back to them.

Calendar links

• When you add a calendar link, Calandrea's server fetches it about once an hour and keeps its events from 30 days ago to 180 days ahead. Calandrea never changes those events. The link itself can carry a private token, so it's stored encrypted and never shown again.

Calandrea only uses this data to show and change your family's calendar and screensaver in Calandrea. It never reads calendars you don't choose to show.

Calandrea only fetches events from 30 days ago to 180 days ahead, and keeps calendar data only while the account or link is connected. Removing the account or link deletes it (see Disconnecting and deleting below).

Lists synced with other apps

An adult can link a Calandrea list to one list in Google Tasks, Microsoft To Do, Apple Reminders or another CalDAV to-do app (Fastmail, Nextcloud and others), so the two stay the same. Nothing is synced until an adult chooses a list in Edit lists > Sync with…, and Calandrea only reads and writes that one list: never your other task lists or reminders.

• What syncs: each item's text, notes, whether it's ticked, and its due date (and time, where the other app keeps one). Calandrea writes items added, changed, ticked or deleted in Calandrea to that list, and brings in the ones changed there. Who an item is for and the list's order stay in Calandrea only.
• Google Tasks (tasks): asked for only when an adult links a list to Google Tasks, never at sign-in or for an account that only syncs calendars. Calandrea checks the linked list for changes every 5 minutes, and can create a new task list when you choose one.
• Microsoft To Do (Tasks.ReadWrite): asked for only when an adult links a list to To Do, through the Outlook account they connected. Calandrea checks the linked list for changes every 5 minutes, and can create a new To Do list when you choose one.
• CalDAV to-do lists: through a CalDAV account already connected in Settings > Calendars, with the same app password. Calandrea only offers that account's to-do lists, checks the linked one every 5 minutes, and can create a new to-do list when you choose one.
• Apple Reminders: Apple has no server access to Reminders, so it syncs through the Calandrea app on the iPhone of the adult who linked the list, after they allow Reminders access on that iPhone. The app reads only the linked Reminders list, and sends only that list's items to Calandrea's server. Walls and other phones never use Reminders. You can turn access off at any time in the iPhone's Settings > Apps > Calandrea.

Linked list items are kept like the rest of your lists. They're never sent to an AI service, and are used only to keep the two lists the same. Calandrea keeps each item's id in the other app, so it knows which items belong together, until you stop syncing or delete the list.

Other information we keep

• Your household: its name, time zone and settings, and its home location, which is used for weather and to suggest nearby places. If you set a wall PIN, only a scrypt hash of it is kept.
• Family profiles: each person's name, colour, emoji and picture. See Children below.
• Profile pictures: if an adult adds a picture for someone, Calandrea keeps a small square copy of it (256 pixels across). It's shrunk on your device and then re-saved on the server with its location and every other detail from the camera removed. Only the people in your household and its wall displays see it. We never look at it, show it to support or in our admin tools, put it in logs or error reports, send it to AI services, or analyse it (no face recognition, no tracking, no advertising). It's deleted when it's removed in Settings, or with the person or the household.
• What you add: chores, stars and rewards, lists, messages, countdowns, bin days and whiteboard drawings.
• Screensaver photos: the photos you pick in Google Photos or upload from your phone or computer for the wall's screensaver. Calandrea keeps its own copy of each, resized for the screen and stored privately. An uploaded photo is resized on your device and then re-saved on the server with its location and every other detail from the camera removed; only the date it was taken is kept. A photo is deleted when you remove it in Settings, or when the household is deleted. Removing a Google account leaves the photos on the wall until you remove them.
• Devices and invites: paired wall displays (stored as hashed tokens), phones that get notifications (their push subscription), the Calandrea app version each of those last reported, and the email addresses of adults you invite.
• Where your household started: whether it was set up on the web or in the iPhone, iPad or Android app (not which device), so we can see how families find Calandrea.
• Your subscription: if you pay for Calandrea, which plan you're on, when it started and renews, whether it's in a trial, the store or payment provider it was bought through, the country it was bought in, and that provider's transaction id. See Payments below.
• Checkouts: when the subscription screen opens and whether a checkout went through, was cancelled or failed (with the store's error code, never what you typed), so we can fix checkouts that don't work. It's kept with your household for a year and never used for advertising.
• Trial reminder: if you start a free trial, we email you and send a notification 2 days before it ends, saying when your plan starts and how to cancel. It goes to whoever started the trial, and we record that it was sent so you get it once.
• Your first day: a new household can look around for a day before starting the free trial. Near the end of that day its owners get a notification, and if no trial has started, one email when it ends. We record when the day ends and that each was sent, so you get them once. So that each email address gets the day once, we keep a scrambled code made from the address of the adult who set the household up (never the address itself) for 2 years.

Children

Calandrea is for families, so it holds some information about children. Only adults (18 or over) can create an account, sign in or pay. A child is a profile an adult adds, never an account.

• What we keep about a child: the name (a first name or nickname is all it needs), colour, emoji and picture the adult chooses, plus the chores assigned to them, the chores they tick off, their stars and the rewards set for them.
• What we don't: a child has no email address, password, birth date, location or device of their own in Calandrea. We never contact a child, profile them, show them ads or sell anything to them.
• Who can see it: the adults in that household, and anyone looking at the household's wall display. Nobody outside the household.
• Who's responsible: the adult who adds a child must be their parent or guardian, or have their parent or guardian's agreement.
• Removing it: deleting a child's profile (Settings > People) deletes their chores, ticks, stars and rewards straight away.
• Photos you pick or upload for the screensaver, or as a profile picture, may show children. They stay private to your household, we never look at them, and they're never sent to AI services.

Where it's kept

• In a Supabase database in Sydney, Australia, which only your household can reach. The app's server code runs on Vercel.
• Google and Microsoft access tokens, iCloud and CalDAV app passwords, and calendar links are kept on the server only, encrypted at rest (AES-256-GCM). The wall and phones never see them and never talk to a calendar service directly, except that the Calandrea app on an iPhone reads and writes the one Reminders list its adult linked (see Lists synced with other apps).
• Screensaver photos, picked or uploaded, are kept in private storage and shown on the wall through short-lived links.
• Profile pictures are kept with each person's profile in the database, which only your household can reach. The apps only ever show the stored copy and never load a picture from anywhere else.

What we never do

• Sell your data, or share it with anyone beyond the services listed under Other services below.
• Show ads, or use your data for advertising.
• Use data from Google APIs, Microsoft data or anything from a calendar link to develop, improve or train non-personalised or generalised AI or machine learning models.
• Send events or anything else from Google Calendar, Google Tasks or Google Photos to an AI service (see AI reading below).
• Let people read your data, except where you ask us to help, where the law requires it, or for security.

Calandrea's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The policy is at developers.google.com/terms/api-services-user-data-policy.

Other services

• Weather comes from Apple Weather (WeatherKit), which is sent the household's home location and event places. If Google Maps isn't set up, event locations are looked up with Apple Maps.
• When you search for your home address, the text you type goes to Google Maps, or to OpenStreetMap's Nominatim if Google Maps isn't set up.
• If Google Maps is set up, what you type in an event's Location is sent to Google Maps to suggest places, with the household's approximate home area to rank the results. Showing a place on the wall's map also sends that place to Google Maps (Apple Maps on the Calandrea app's wall).
• If you agree to AI reading, some of what you import goes to Anthropic. See AI reading below.
• If you pay for Calandrea, Apple, Google or Stripe handles the payment. See Payments below.
• Phone notifications go through your phone's push service (Apple or Google) if you turn them on.
• Sign-in codes, invite codes and invite emails are sent through Resend.
• Before sending a sign-in code, Cloudflare Turnstile checks the request comes from a person. It looks at your browser or the app and your connection, not your email address, and doesn't track you across sites.
• Error reports: when something goes wrong in Calandrea (a page fails, the app crashes), Calandrea sends a report to Sentry so we can fix it. A report has the error and where in Calandrea's code it happened, the device type, system and app version, whether it's a wall or an adult's phone, and a scrambled code for the household (not its name or id). It doesn't include your name, email address, IP address or sign-in, or what's in your family's events, notes, lists or messages; anything like that is removed before the report is sent. It isn't used to track you or for advertising, and Sentry deletes reports after 90 days at most.
• Feedback: what you send from Settings > Leave feedback is kept with your name, your family's name, your email address and the app version, and emailed to us so we can read it and reply. Deleting your account deletes it.
• There are no analytics or advertising trackers.

AI reading

Calandrea can use Claude, an AI model made by Anthropic, to turn things you give it into calendar events. It's off until an adult agrees. The first time you tap Import or the microphone, Calandrea asks you, explains what's sent, and records your answer (who, which version of the question, when, and on which kind of device). Each adult in a household is asked for themselves. If you choose “Not now”, Calandrea reads typed and spoken text on its own servers with a simple date parser, nothing goes to Anthropic, and you won't be asked again for 30 days. If what Calandrea sends ever changes, everyone is asked again before their next AI import.

• Wall displays: a wall has nobody signed in, so it only uses AI while AI reading is on and at least one adult in the household has agreed. Its Import and voice screens say that they read with Claude.
• Children's names: off by default. Unless an adult turns on “Use children's names to match events” (Settings > Calandrea > AI reading), children are sent as “Child 1”, “Child 2” and matched back on Calandrea's servers, and you pick who an event is for when you check it. Adults' first names are sent while AI reading is on.
• Turning it off: any adult can turn AI reading off at any time in Settings > Calandrea > AI reading. That's recorded, and nothing more is sent from that moment, from phones or the wall. Turning it back on asks you again.
• What's sent, only when you use it: the text you type, paste or say into an import, and the photos and PDFs you choose to import (a school newsletter, say). To read dates correctly, the request also carries your household's family profile names (children's only if you turn that on, as above), its time zone and today's date, and its school term setting. When you speak to Calandrea, it also carries the names of your lists (“Shopping”, “Hardware”), so it can tell which list you mean.
• What's never sent: events from any calendar you connect (Google, Outlook, iCloud or a calendar link), calendar names or links, account details or email addresses, screensaver photos, chores, stars, rewards, what's on your lists, or messages. Calandrea never runs AI over your data in the background; it only sends what you've just asked it to read.
• What happens to it: Claude returns a list of suggested events. Nothing is added to your calendar until an adult checks and confirms each one. Calandrea doesn't keep the photos or PDFs after they're read. It keeps a daily count of AI requests and their size for each household (not the content), to apply a fair-use limit, and deletes those counts after 90 days.
• At Anthropic: Anthropic processes this data on our behalf under its commercial terms, which say it doesn't train its models on it. Anthropic keeps it only for a limited period for safety and abuse monitoring, then deletes it. Anthropic is in the United States and its servers are mainly there, so using AI reading means this data goes overseas.
• Changes by voice: you can ask Calandrea to move or delete an event, add to or tick off a list, or mark a chore done. Claude only works out what you asked for (“move the dentist to Thursday”); it never sees your calendar, list items or chores. Calandrea finds the event, item or chore itself, on its own servers, and shows it to you: nothing changes until you tap to confirm. Only something said out loud can ask for a change; pasted text, photos and PDFs are only ever read for new events.
• Calandrea doesn't use AI to make decisions about you or your children, or to profile anyone.
• Talking to Calandrea: the app only listens after you tap the microphone, and stops when you finish. What you say is turned into text by your device's speech recognition: Apple's on an iPhone or iPad (on the device where it supports that, otherwise by Apple's servers under Apple's privacy policy), Google's on Android (under Google's privacy policy). Only the text is sent to Calandrea and, with AI reading on, to Claude. Calandrea never receives or keeps the audio.

Payments

• If you subscribe in the iPhone or iPad app, Apple handles the payment; on Android, Google Play does; on the web, Stripe does. Their own privacy policies cover what they collect.
• RevenueCat (in the United States) brings the three together: it receives your household's subscription from Apple, Google or Stripe, under an id for your household (never your name), and tells Calandrea which plan it's on and whether it's active. On the web, RevenueCat's checkout sends your receipts to the email you sign in to Calandrea with.
• We never see or store your card or bank details. The provider tells us which plan you're on and whether it's active, so Calandrea knows which features to switch on.
• We keep records of payments for as long as Australian tax law requires (7 years), even after an account is deleted.
• When a household starts a free trial or subscribes, we keep a one-way code made from each adult's email address for 2 years, even after the account or household is deleted, so the free trial can't be claimed twice. The code can't be turned back into the email address.

Information sent overseas

Some of the services above are outside Australia. Anthropic, Vercel, Sentry (error reports), Stripe, RevenueCat (subscriptions), Resend (sign-in and invite emails), Cloudflare (the sign-in check), Microsoft (for Outlook calendars and To Do lists you connect), Apple (for Sign in with Apple, iCloud calendars you connect, weather and finding places) and the push and payment services of Apple and Google may process data in the United States, Europe and other countries where they run. Your household's database stays in the region shown under Where it's kept. We only use providers that commit to protecting the data and using it only to provide their service to us.

Disconnecting and deleting

• Disconnect a Google account: Settings > Calendars, then remove the account. Calandrea revokes its access with Google and deletes that account's calendars and events from its database. A shared calendar that another connected account can also see stays, through that account.
• Disconnect an Outlook account: Settings > Calendars, then remove the account. Calandrea deletes its token, stops Microsoft's change notifications and deletes that account's calendars and events. Microsoft doesn't let apps give up their own access, so to remove it fully, also remove Calandrea at account.microsoft.com (Privacy > Apps and services).
• Disconnect iCloud: Settings > Calendars, then remove the account. Calandrea deletes the app-specific password and that account's calendars and events. Also revoke the password at appleid.apple.com (Sign-In and Security > App-Specific Passwords); revoking it alone also stops Calandrea, which then asks you to reconnect.
• Stop syncing a list: Lists > Edit lists, choose the list, then Stop syncing. Calandrea forgets the link and which items belong together; every item stays in both places. Deleting a linked list in Calandrea leaves its list in the other app. Removing the account a list syncs through stops that list syncing. For Apple Reminders, you can also turn off Reminders access for Calandrea in the iPhone's Settings.
• Remove list access, keep calendars: Settings > Calendars, then Remove list access on the Google or Outlook account. Lists syncing through it stop (every item stays in both places) and Calandrea stops using its to-do lists. For Google, Calandrea revokes its access and you sign in again for calendars only. For Microsoft, Calandrea stops asking for To Do; Microsoft keeps the permission until you remove Calandrea at account.microsoft.com, which also stops its calendars.
• Remove a calendar link: Settings > Calendars. The link and its events are deleted.
• Remove access from Google instead: at myaccount.google.com/permissions. Calandrea notices at its next sync (within 15 minutes), deletes the stored token and that account's events, and keeps your calendar choices so reconnecting the same account puts everything back.
• Delete your account: Settings > You > Delete my account. This revokes and deletes your Google and Outlook connections, withdraws Calandrea's access with Apple if you signed in with Apple, and deletes your sign-in. If you're the last adult in the household, it deletes the whole household and everything in it, including photos. Deleting your account doesn't cancel a subscription: cancel it first in your App Store or Google Play subscriptions, or in Settings > Subscription on the web.
• Deleted data is removed from the live database straight away. Copies in our hosting provider's backups expire on their own within 30 days.

Your rights

You can ask what information we hold about you, and ask us to correct or delete it, using the contact below. If you're not happy with our answer, you can complain to the Office of the Australian Information Commissioner.

Changes to this policy

When this policy changes, we update this page and the date at the top. If we change how Calandrea uses Google user data, or any other calendar data, we'll email the adults in each household before the change applies, and ask for your agreement again where the law or Google's policy requires it.

Contact

Questions, or want something deleted? Email support@calandrea.app.