Privacy Policy

1. What We Collect

We collect only what is necessary to run the Service:

• Email address — used for passwordless sign-in and service notifications
• OAuth tokens — encrypted credentials that allow us to access your Google and Microsoft calendars on your behalf
• Apple iCloud credentials — if you connect iCloud, your Apple ID (email address) and an app-specific password you generate for twocal. The app-specific password is encrypted with AES-256-GCM before it is stored. Apple does not let app-specific passwords be limited to calendars, so technically the password can also access other iCloud data such as mail and contacts; twocal only ever connects to iCloud's calendar (CalDAV) server and never uses it for anything else
• Calendar metadata — calendar names and IDs needed to configure sync pairs
• Calendar events — read and written during synchronization as configured by you

2. How We Use Your Data

Your data is used exclusively to:

• Authenticate you and secure your account
• Perform calendar synchronization as you configure it
• Send transactional emails (sign-in links, important notices)
• Monitor service health and diagnose errors

We do not use your data for advertising, profiling, or any purpose unrelated to providing the Service.

3. Google, Microsoft and Apple Calendar Data

twocal's use of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We access your Google Calendar data only to sync events as you direct, and we do not transfer this data to third parties except as necessary to provide the Service. Specifically, twocal does not use your Google or Microsoft calendar data to train generalized or artificial-intelligence models, does not sell or rent it, and does not allow humans to read it except (a) with your explicit consent, (b) where necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) where the data has been aggregated and anonymized. The same principles apply to Microsoft Calendar data accessed via Microsoft Graph.

The same principles also apply to Apple iCloud Calendar data. twocal uses your Apple ID and app-specific password only to connect to iCloud's calendar (CalDAV) server and sync the calendars you choose. We do not access your iCloud mail, contacts, files, or any other iCloud data, even though an app-specific password would technically permit it.

4. Data Storage and Security

• OAuth tokens and iCloud app-specific passwords are encrypted at rest using AES-256
• All data is transmitted over TLS
• Data is stored in a managed PostgreSQL database hosted on Neon (region: US East)
• We retain your data as long as your account exists
• Encrypted database backups may retain deleted data for a limited period after account deletion before they expire automatically

5. Data Sharing

We do not sell or rent your personal data. We share data only with:

• Google / Microsoft / Apple — to perform calendar sync via their APIs (for Apple, iCloud's CalDAV calendar server)
• Stripe — payment processing; after account deletion Stripe retains the transaction records it is legally required to keep
• Postmark — transactional email delivery; delivery logs expire automatically after ~45 days
• Fly.io — hosting and database infrastructure
• Sentry — error monitoring (no calendar event content is sent); error events expire automatically after ~90 days
• Google Analytics / Cloudflare — aggregate web analytics to measure visits and sign-ups (no calendar data is sent)
• Microsoft Clarity — session replays and heatmaps of our public pages and the app's setup screens, with on-screen content masked (no calendar data is sent)

See our full list of sub-processorsfor the data each provider handles.

6. Your Rights and Choices

• Access & export — download a copy of your data any time from Settings ("Download my data")
• Deletion — delete your account from Settings; syncing stops immediately and your data is permanently removed after a 30-day grace period, during which you can sign back in to restore your account
• Synced copies — events twocal created in your own calendars belong to you; when deleting your account you can optionally have us remove them first
• Revoke calendar access — remove twocal from your Google or Microsoft account permissions at any time; for iCloud, revoke the app-specific password at account.apple.com under Sign-In & Security → App-Specific Passwords

7. Cookies and Tracking

To keep you signed in, twocal uses a short-lived session token (stored in your browser's localStorage) and an httpOnly session cookie used to refresh it.

We also use privacy-conscious analytics to understand how visitors discover and sign up for twocal:

• Google Analytics — measures visits to our public marketing pages and records a single event when a new account is created, so we can see how visitors become sign-ups and which sources they came from. It sets first-party cookies (e.g. _ga) for this purpose and never receives your calendar data. Within the signed-in app it runs only to record that one sign-up event — it does not track your activity in the product.
• Cloudflare Web Analytics — aggregate, cookieless measurement of visits to our public pages.
• Microsoft Clarity — records how visitors move through our public pages and the app's setup screens (signing in, connecting calendars, creating or editing a sync, and the dashboard) as session replays and heatmaps, so we can see where people get stuck. Whatever you type is masked, and inside the app all on-screen text is masked in your browser before anything is sent, so Clarity never receives your calendar data, event details or email address. Inside the app it does not run in account settings or billing, or for accounts with HIPAA mode on (our public pages can't tell who you are, so they are recorded the same for everyone). It sets first-party cookies (e.g. _clck, _clsk), and Microsoft processes the data under the Microsoft Privacy Statement. We do not load Clarity for visitors in the EEA, the UK or Switzerland, or when your browser sends a Global Privacy Control or Do Not Track signal — turning either on opts you out.
• tc_vid — a first-party anonymous visitor ID we set on our public pages (it lasts up to a year) to measure visits and sign-ups. It is a random identifier that holds no calendar data, and we do not share it with anyone. A visit is counted only after your browser has loaded the page: a small script on the page reports the page address (with only its campaign tags, no other query parameters) and the referring site's name to our own servers, and nowhere else. Because this count stays with us and is never shared or sold, it does not change when your browser sends Global Privacy Control or Do Not Track.
• tc_exp — a small first-party marker (value baseline, same lifetime) that tells us we have already counted your visit. It holds no personal data.

You can block these with your browser's privacy controls or a tracker blocker without affecting sign-in or sync.

8. Children's Privacy

The Service is not directed at children under 13. We do not knowingly collect data from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email. Continued use of the Service after changes constitutes acceptance.

10. Contact

The data controller for the Service is Unleash Your ADHD LLC, which operates twocal.app. Questions or requests regarding your data? Email us at [email protected].