Privacy policy
Last updated: May 19, 2026
We collect the minimum needed to run a calendar that understands you, use it only to provide and secure the service, and never sell it or use it for advertising.
Controller
Smart Calendar is controlled by Smart Calendar. Postal address: Warsaw, Poland.
For privacy requests, data exports, deletion requests, processor questions, or complaints, contact hello@smartcalendar.app.
What we collect
When you sign in we store an email (for magic-link auth) or your Telegram identifier (for the bot). When you create events we store the title, time, location, notes, attendees, and any photos or files you attach. If you connect Google Calendar we store an encrypted refresh token scoped to your calendar.
We also store parser audit rows: source type, input hash, short input summary, model name, token counts, cost, latency, confidence, errors, and linked result event. These rows help debug parser behavior and monitor abuse and cost.
Purposes and legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Account, authentication, and security | Email, Telegram identity, session tokens, request metadata | Contract; legitimate interests in security and abuse prevention |
| Calendar, reminders, sharing, and uploads | Events, categories, reminders, share tokens, attachments | Contract |
| AI-assisted parsing | Text, voice transcripts, images, attachment-derived content, parser logs | Contract; legitimate interests in improving reliability and fraud prevention |
| Google Calendar integration | Google OAuth tokens, calendar identifiers, synced event metadata | Consent for Google connection; contract for sync after connection |
| Legal and compliance requests | Account and request records needed to answer rights requests | Legal obligation; legitimate interests |
What we don't do
- Sell or rent your data.
- Use your events for model training.
- Track you across other websites.
- Store your Google credentials in plain text — refresh tokens are AES-GCM encrypted at rest.
Processors and transfers
We use service providers only where needed to operate Smart Calendar. The current processor and transfer register is below.
| Provider | Role | Transfer | Safeguard |
|---|---|---|---|
| Railway | Hosting, PostgreSQL, Redis, and deployment infrastructure | EU deployment region; Railway may use subprocessors outside the EEA | Railway DPA and transfer clauses |
| Anthropic | AI parsing for text, voice transcripts, screenshots, and selected attachment content | May process outside the EEA | Commercial Terms incorporate DPA and SCCs |
| Sentry | Error monitoring and diagnostics | May process outside the EEA | Sentry DPA and cross-border transfer mechanisms |
| Google Calendar OAuth and calendar sync when connected by the user | May process outside the EEA | Google Cloud Data Processing Addendum and SCCs | |
| Resend or configured email provider | Magic-link, invitation, and service email delivery | May process outside the EEA | Provider DPA; Resend publishes a DPA with SCCs |
| Telegram | Bot transport for messages forwarded to or sent through Telegram | Telegram is an independent service provider outside this app | Telegram privacy terms; avoid sending sensitive data through Telegram if not necessary |
AI-assisted features
Natural-language event text, voice transcripts, images, and selected attachment content may be sent to Anthropic Claude to parse calendar fields. The parser may make mistakes, so you should review important events before relying on them.
We do not use your content to train our own models. Anthropic states that API content is not used to train models by default. AI parsing does not make legal, financial, employment, credit, health, or other similarly significant decisions about you.
Cookies and storage
We use only essential cookies and browser storage for login, session refresh, security, uploads, and preferences you request. We do not use advertising cookies or cross-site tracking.
See the Cookie and storage notice for names, purposes, and retention periods.
Retention
- Account and calendar data: kept while your account is active.
- Deleted accounts: disabled immediately, recoverable for 30 days, then hard-deleted.
- Uploaded files: deleted with the account or when you delete the attachment.
- Parser logs: retained for up to 90 days.
- Basic operational request metadata: retained for up to 30 days.
- Google refresh tokens: encrypted at rest and deleted when you disconnect Google or delete your account.
Your rights
Export everything as JSON from Settings → Account. Delete your account from the same screen — you have a 30-day recovery window, after which everything is wiped permanently.
Depending on where you live, you can ask to access, correct, erase, restrict, or export your personal data. You can object to processing based on legitimate interests and withdraw consent where processing is based on consent, such as a connected Google Calendar.
Reach us at hello@smartcalendar.app with any data-access or deletion request and we'll respond within 14 days.
You can also complain to your local EU/EEA data protection authority.
Changes to this policy
If we materially change how we handle data, we'll update this page and email anyone with a verified email on file at least 14 days before changes take effect.