Privacy Policy

Last updated: 29 October 2026

1. Controller

Responsible for data processing within the meaning of Art. 4 No. 7 GDPR is:

Name

Private Calendar – Julius Kramer

Address

c/o Online-Impressum #9643
Europaring 90
53757 St. Augustin
Germany

Email

info@privatecalendar.de

If you have any questions about data protection or exercising your rights, you can contact us at the email address above. Further information is in the Legal notice.

2. Basic principle: end-to-end encryption

Using the calendar requires an account. The operator cannot view the encrypted stored and synchronized calendar content. The voluntary email calendar invitation for bookings is explained separately in Section 9. For an explicitly subscribed external iCal calendar, the Android and iPhone apps load the source directly and encrypt the local copy before synchronization. Details are in Section 8.

• A key is derived from your password on your device that decrypts a random master key. The keys for the individual calendars are derived from this.
• Appointments are encrypted with AES-256-GCM before every network transmission. The server only receives the finished ciphertext.
• The server never receives your password in plain text, only a sign-in verification value (verifier) derived from it.
• Account recovery is also zero-knowledge: the recovery key is created in your browser and is never sent to the server in plain text.
• When sharing calendars, the calendar key is encrypted via ECDH for the recipient. The server cannot unpack it.

3. Processed data

To operate the account and synchronization, the server processes the following data:

Note on metadata: Even if the content is encrypted, the server sees technically necessary metadata – in particular, that an account exists, how many calendars there are, what time periods appointments are in and when the last synchronization took place. This information is required for the allocation and synchronization of the data blocks.

4. Purposes and legal bases

Provision of account and synchronization: Art. 6 Para. 1 lit. b GDPR

Processing account data, calendar blocks, key material and shares to perform the usage agreement.

Security of the service: Art. 6 Para. 1 lit. f GDPR

Processing of IP address, user agent, failed attempt counters and hashed installation identifier to prevent attacks and misuse and to notify you of security-relevant account events. Our legitimate interest is the secure and stable operation of the service.

Reporting and blocking of sources for appointment requests: Art. 6 Paragraph 1 Letter f GDPR

The owner of a booking link can report an incoming request and block its source for their own booking links. The server only uses an HMAC of the source IP formed with a separately kept key, not the IP address itself; the block serves to protect against harassment and automated abuse.

Access log and misuse detection: Art. 6 Para. 1 lit. f GDPR

The server briefly records each request in an access log and sends the controller grouped reports of rejected access. Our legitimate interest is to detect attacks and investigate them afterwards: silently rejecting requests can leave an ongoing attack unnoticed. We protect your interests through the short seven-day retention period, restriction to technical connection data, and exclusion of content, headers, passwords and verification codes from the log. Details are in Section 6.

Two-factor authentication: Art. 6 Paragraph 1 Letters b and f GDPR

Optional and can be activated at any time in the account settings to further protect accounts against unauthorized access. The TOTP secret is only processed when two-factor authentication is activated. Our legitimate interest is the secure operation of the service.

Account deletion and technical deletion control: Article 6 Paragraph 1 Letters b and f as well as Article 17 GDPR

Account association, identity verification through the stored account email address, a cancellable 48-hour waiting period and execution of the explicitly confirmed account deletion, unless cancelled using the account password. The IP address and user agent protect the deletion process that requires no sign-in from abuse. The temporary deletion control record prevents delayed replication from recreating data for the deleted account and allows a required Stripe subscription cancellation to be retried until confirmed. Our legitimate interest is to carry out your requested deletion and contract termination securely and verifiably in full. A similar record serves the same purpose when you delete an individual calendar: it contains only your account identifier, the deleted calendar’s random identifier, timestamps and retry status until its offsite encrypted blocks have actually been removed.

Change of account email address: Art. 6 Paragraph 1 Letters b and f GDPR

Carrying out your expressly requested change of address, checking both mailboxes and protecting against unauthorized account takeovers. An existing Stripe customer receives the confirmed new address; old invoice documents and their historical addresses remain unchanged.

Termination and withdrawal via email code: Art. 6 Paragraph 1 Letters b and c GDPR

Identity verification via the stored account email and execution of the confirmed cancellation or confirmed withdrawal. Providing these routes without sign-in also fulfils legal obligations (§ 312k BGB, § 355 BGB).

Proof of confirmed termination: Art. 6 Paragraph 1 Letters b, c and f GDPR

The declaration itself and its timing are part of the contract execution and the legal confirmation obligation of Section 312k Paragraph 4 BGB. The fact that we also keep the data record as evidence is based on our legitimate interest in being able to prove the content and receipt of a termination in the event of a dispute – the same interest also protects you, because your termination is therefore certain even if Stripe or email delivery fails.

Direct termination and withdrawal function: Art. 6 Paragraph 1 Letters b and c GDPR

Receipt, forwarding, manual processing and confirmation of receipt of a declaration of termination or withdrawal for contract processing and to fulfill the legal obligations under Sections 312k and § 356a BGB. The server does not make any automatic changes to Stripe via these forms.

Legal notice contact form: Art. 6 Paragraph 1 Letters b and f GDPR

In the case of inquiries about an existing or initiated contract, the processing takes place to implement the contract or to carry out pre-contractual measures (Art. 6 Para. 1 lit. b GDPR). We process general messages based on our legitimate interest in having an accessible electronic contact point and answering factual concerns (Art. 6 Para. 1 lit. f GDPR). The mandatory tick only documents that you have read this privacy policy; it is not consent.

Protection of public forms: Art. 6 Para. 1 lit. f GDPR

Cloudflare Turnstile and server-side size and rate limits prevent automated abuse in the contact and feedback forms and in the code-secured account deletion, cancellation and withdrawal processes. The direct statutory cancellation and withdrawal functions remain independent of Cloudflare and other third-party scripts; only an invisible bot field and server-side size and rate limits protect these functions. Our legitimate interest is the availability and security of these routes.

Entry cookie “pc_seen”: Section 25 Paragraph 2 No. 2 TDDDG, Art. 6 Paragraph 1 Letter f GDPR

The cookie is strictly necessary so that the address “/” returns the calendar app to the same browser instead of the home page; without this switch, the expressly desired service could not be provided. Therefore no consent is required. It contains no identifier or personal reference, is not evaluated and does not enable recognition across websites. Our legitimate interest is that the service operates as expected.

Local review requests: Art. 6 Paragraph 1 Letter f GDPR

Our legitimate interest is voluntary product feedback after sufficient use. The counters used for this remain exclusively on the device and are used to display a request rarely; they are neither transmitted for usage analysis nor linked to an account. You decide for yourself whether and how you rate in the respective store.

Data backup: Art. 6 Para. 1 lit. f GDPR

Encrypted backup copies to protect against data loss.

Technical operational monitoring: Art. 6 Para. 1 lit. f GDPR

Process aggregated system, resource, database, queue and backup metrics to detect and resolve problems early. Our legitimate interest is the availability, integrity and security of the service.

Referral programme: Art. 6(1)(b) and (f) GDPR

Attribution happens when you enter a referral code. We check the first paid Premium order and credit the agreed free months. Technical payment and idempotency identifiers as well as limited redemption counters prevent double rewards and ensure reliable billing; this is our legitimate interest. Referral codes can be accessed in the account and shared voluntarily. We do not send invitations for this programme to other people’s email addresses.

Why this information is required

Providing an email address and password is required to use the calendar because using the calendar requires an account. You are not legally or contractually obliged to provide us with this data; however, without them it is not possible to use the service. Setting up two-factor authentication, marking a device as trusted, and subscribing to external calendars are voluntary.

Automated decision making

In principle, there is no automated decision-making and no profiling within the meaning of Art. 22 GDPR. In particular, the temporary block after several failed login attempts serves solely to prevent technical misuse and has no legal effect on you.

An exception applies to ordering Premium. Germany is billed directly through Stripe; Austria, Switzerland, Finland, Denmark, the Netherlands, Ireland and Sweden through Link (Stripe Managed Payments). The billing-country and payment-route checks are automatic, without human involvement. We explain this under Article 13(2)(f) GDPR:

Logic of the decision

After completing the payment process, Stripe will send us the country code of the billing address you provided there. A direct order with a billing address other than Germany or a managed payments order with a billing address in Germany or an unsupported country will be rejected. Additionally, it is checked whether Stripe actually identifies the subscription as managed payments. No other personal characteristics are taken into account: There is no assessment of your person, no creditworthiness or fraud assessment and no profiling.

Scope and intended effects

The order is not accepted, so a contract is not concluded. Any amount that has already been collected will be fully refunded via the payment method used, and the Premium functions will not be activated, not even on a temporary basis. We will inform you of the rejection and refund by email to your account address. Your account, your calendar data and the free plan remain unaffected.

Legal basis

Art. 22 Paragraph 2 Letter a GDPR. The check is necessary for the decision to conclude the contract because direct foreign orders can trigger VAT obligations that we do not fulfill via direct payment channels; international orders offered are therefore processed exclusively via Stripe Managed Payments.

Your rights in this case

You have the right to request the intervention of a natural person, to express your own point of view and to challenge the decision (Article 22 (3) GDPR). All you need to do is send an informal message to the email address listed in Section 1; you can also simply reply to the rejection email. We will then look at the case manually and answer you.

5. Email delivery and feedback

Bug reports and feature requests

You can report a bug or request a feature without signing in at /feedback and /en/feedback. Your email address, category, platform, subject and description are required; the form language and receipt time are also processed. Your email address allows us to ask follow-up questions and is not verified as belonging to an account. The apps open the form in your system browser and pass only the category and platform in the URL. No account ID, session token, calendar content, diagnostic logs or device identifiers are attached automatically.

The operator can read your message; it is separate from end-to-end encrypted calendar synchronisation. Please do not send passwords, recovery keys, confidential calendar content or other people’s personal data. You can optionally select one image or video file up to 10 MiB (PNG, JPEG, WebP, MP4, MOV or WebM). It may contain personal information, images, audio and embedded metadata. Please remove such information before submitting. Images and videos are stored encrypted on the existing hosting server for up to 72 hours; the operator receives a random, unguessable download link by email. Downloading also requires a password known only to the operator; the link alone is not enough. The email provider can also see the link but cannot download the file without that password. It is not publicly listed; please do not share it. Expired links stop working immediately; files are automatically cleaned up at server startup and every minute. There is no public directory. There is no public wish list or automatic confirmation email. Your message is sent to the operator’s mailbox through the existing Scaleway email service; hosting and technical security logs are processed as described below.

We process bug reports relating to a contract under Article 6(1)(b) GDPR, and general bug reports and feature requests under Article 6(1)(f) GDPR. Our legitimate interest is to respond to your feedback and improve the reliability and functionality of the service. Providing your data is voluntary; the form cannot be submitted without the required fields. Your use of the calendar is unaffected.

Feedback, including attachments, has the same deletion periods as contact correspondence: after final handling, within 30 days at the latest, unless a legal retention obligation applies. The server processes messages temporarily in memory for delivery and does not save them in its database or file storage. Images and videos use the encrypted storage described above, with 72 hours of download access and automatic cleanup; they are not included in database backups. Downloaded copies and mailbox copies are subject to the 30-day deletion period. Any descriptions retained longer in an internal bug or feature list must be truly anonymised, with no link back to the person who submitted them. Submissions are not automatically forwarded to external bug trackers or AI services.

We process your email address to send you functional messages about the operation of the Service and your account security; after successful email confirmation, this includes a one-time welcome email confirming your registration and a link to the website or browser version. This also includes confirmation codes for an account deletion requested via the public deletion page, as well as separate codes and security confirmations to the previous and new address if you request an address change. The legal basis is the fulfillment of the contract (Art. 6 Para. 1 lit. b GDPR) and the legitimate interest in security and operation (lit. f). These messages may contain your email address and security-relevant technical information, such as time, IP address and user agent when signing in from a previously unknown installation, not calendar content. A separately selected booking calendar invitation contains the title and time of the individual appointment; Section 9 explains this exception. We do not send advertising.

Depending on the occasion, the recipients are yourself, if you share the calendar, the person you are sharing with or who is sharing with you (the other email address will be visible), as well as the controller for contact, security, operational and payment matters. The reporting of paid Premium contracts and extensions serves the existing contract and payment management (Art. 6 Para. 1 lit. b GDPR); it does not contain any calendar content or card details.

Messages are sent through the transactional email service of Scaleway SAS, 8 rue de la Ville-l’Évêque, 75008 Paris, France. The email address and message content are transmitted. For direct cancellation and withdrawal, this includes the complete declaration, receipt time and reference number. Security-code requests and invitations also tell the provider that calendar sharing between two addresses is intended or exists. Security notifications may contain the access metadata described above. Processing takes place within the European Union.

Automatic messages to account holders contain direct links to the legal notice and this privacy policy at the end.

Calendar shares do not send calendar content or public security codes via email. The request email only explains where you can find your public security code locally in the app or browser; you should send it back directly to the person inviting you, if possible via an end-to-end encrypted chat. The name of the shared calendar is also not in the invitation: it is end-to-end encrypted, not known to the server and is only displayed in the app after it has been decrypted.

Bot protection of public forms

The feedback form, the legal-notice contact form and the forms requiring no sign-in for account deletion, cancellation with an email code (“/en/cancellation/automatic”) and withdrawal with an email code (“/en/withdrawal/automatic”) use Cloudflare Turnstile, provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Turnstile loads only when you open the relevant form. It processes the IP address, TLS fingerprint, user agent, site key and accessed origin to distinguish people from automated access. The browser loads code and a verification frame from challenges.cloudflare.com; the server verifies the short-lived token through Siteverify. Email addresses, subjects, messages and verification codes entered in the form are not sent to Cloudflare. If a valid widget token is missing or verification fails, that submission requiring a code is rejected. The direct statutory functions at “/en/cancellation” and “/en/withdrawal” load no Cloudflare scripts and send no data to Cloudflare. They remain available if that provider is unavailable or blocked.

Cloudflare processes the security signals partly as a processor and partly under its own responsibility to improve bot detection. If data is transferred to the USA or other third countries, Cloudflare bases the transfer on the EU standard contractual clauses in accordance with its data processing agreement. Further information is contained in the Turnstile Privacy Notice from Cloudflare.

Online-Impressum.de does not process the entries in the contact form. The form is provided directly by Private Calendar; the application server sends its contents directly to the controller via Scaleway Transactional Email.

6. Hosting and Backups

The service runs on servers provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The data centre used is in Nuremberg, Germany.

Encrypted database backups are created daily. They are encrypted with AES-256-GCM before writing, and the latest fourteen daily backups are stored locally.

Encrypted copies are also stored with Exoscale (Akenes SA, Boulevard de Grancy 19A, 1006 Lausanne, Switzerland) in the ch-dk-2 zone near Zurich, Switzerland. The storage provider receives only ciphertext and holds no key.

Transfer to a third country

Storing the backup copies at Exoscale means transferring them to Switzerland and therefore to a country outside the EU and the EEA. For Switzerland, there is an adequacy decision by the European Commission in accordance with Art. 45 GDPR; Switzerland thus guarantees a level of data protection comparable to that of the EU, so that no additional guarantees are required for this transfer. Regardless of this, only encrypted data leaves our server; Exoscale cannot decrypt or view the stored content.

Server access logs

The server records each request in an access log. The information stored is Time, IP address, HTTP method, accessed path, technical query parameters, response status, response size, processing time and user agent. Request and response contents as well as HTTP headers are not logged; email addresses, verification codes, and tokens are removed from the query parameters before the row is written. The legal basis is our legitimate interest in secure and trouble-free operation (Art. 6 Para. 1 lit. f GDPR).

The log files are deleted after seven days. The server creates exactly one file per calendar day (UTC) and removes all files whose date is longer than this period when it starts and several times a day thereafter. An evaluation for other purposes – in particular reach measurement, profile creation or advertising – does not take place. Separately, the upstream web server keeps a technical error log of connections that do not reach the application server (e.g. broken TLS connections); it is limited in size and number and is constantly being overwritten.

7. Payment processing for the Premium subscription

If you take out a paid Premium subscription, we process the payment and contract data required to process the contract. The legal basis is the fulfillment of the contract (Art. 6 Para. 1 lit. b GDPR) as well as the fulfillment of legal, especially commercial and tax obligations (Art. 6 Para. 1 lit. c GDPR).

Payment is processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Stripe receives your email address, name, billing address, billing country and payment details. Complete card details are processed only by Stripe and never reach our server; payment takes place on a Stripe-hosted page. We receive only payment and subscription status and invoice metadata from Stripe.

Stripe’s data protection role depends on the processing purpose: Stripe acts as a processor when it processes payment data solely under our instructions; its data processing terms apply. For its own purposes — particularly fraud prevention, payment infrastructure security, legal compliance, internal billing and payment-service improvement — Stripe acts as an independent controller under its own terms. Details and the respective roles are in the Stripe Data Processing Agreement and Stripe privacy policy.

Stripe may also transfer data to group companies and service providers in the USA for these purposes. According to its contractual documents, Stripe uses the applicable transfer mechanisms, in particular EU standard contractual clauses.

For a new Premium order with a billing address in Austria, Switzerland, Finland, Denmark, the Netherlands, Ireland or Sweden, we use Stripe Managed Payments. Sold through Link, LLC (USA) acts as merchant of record on the provider’s behalf for payment, invoicing and indirect taxes; Private Calendar remains your contractual partner. Link acts as an independent controller for the order and customer data needed for payments, invoices, indirect taxes, fraud prevention and payment support. This may include your name, email address, phone number, billing address, payment information and purchase details collected in Stripe/Link Checkout. Stripe also receives the billing country selected before Checkout in the order metadata. Calendar content and keys are not transmitted. We explain this payment route on the order page before redirecting you. Existing subscriptions and new German purchases are not automatically converted to Managed Payments. Details are in the Link privacy policy and the Link terms displayed in Checkout.

The billing country, payment route, agreed contract version and corresponding cancellation policy are stored for each subscription so that confirmation, cancellation and refunds follow the agreed terms. A later address change does not automatically change an existing contract.

Retention: Invoices and accounting records, including the invoice metadata we store, are generally retained for eight years under sections 147 AO, 257 HGB and 14b UStG. Accounting books, inventories, opening balance sheets and annual accounts generally require ten years; commercial and business correspondence generally requires six years. A period may be extended in an individual case, for example while records are needed for unfinished tax or legal proceedings. Data is retained for the applicable period even after account deletion and is restricted to that purpose.

With the referral programme, Stripe also receives a random referral identifier in the metadata of the associated checkout session and subscription, as well as a random reward renewal identifier. Stripe does not receive the name or email address of the referring person. We retrieve payment status including refund and payment dispute status and, if rewards are valid, adjust the next billing date. Card data remains with Stripe.

For people in Switzerland, we also observe the applicable Swiss data protection law. The recipients mentioned above are located in Germany, France, Ireland, Switzerland and the USA. For transmissions via Stripe and Link, the applicable transfer mechanisms apply according to their contractual documents, in particular the standard contractual clauses adapted for Switzerland. You can also assert your data protection rights via the contact address in Section 1.

8. External calendar subscriptions

The first retrieval takes place when you create the subscription in the Android or iPhone app. Automatic updates are then attempted no sooner than approximately every six hours, provided at least one signed-in Android device or iPhone is permitted to perform background work and the network and source are available. Tapping “Refresh” in the app fetches the source immediately. Browsers can create a subscription and display a copy subsequently synchronized with encryption by a mobile app, but do not retrieve the source themselves. Android, iOS, the device manufacturer, network or source may delay or prevent updates.

When such a retrieval occurs, the operator of the source you have chosen receives the IP address of your Android device or iPhone or its Internet access, the technical user agent "Private Calendar Android" or "Private Calendar iOS" and the time of retrieval. The legal basis for the retrieval initiated by you is Article 6 Paragraph 1 Letter b GDPR. Only use iCal URLs that you are allowed to access on this device; secret subscription links should be treated like access data.

9. Booking and availability links as well as appointment requests

When you publish a booking link, we store its public identifier, encrypted offer, creation, modification and expiry times, active status, link mode (booking or availability) and association with your account. The legal basis is performance of the contract (Article 6(1)(b) GDPR). Like a sharing link, this link is a secret: anyone who receives it can see the shared available or busy times and pass it on. You can pause or delete a link at any time; it also expires automatically.

Availability mode: You can use a link as an availability-only page. It shows only combined grey “Busy” blocks within your selected weekdays, hours and preview period, without event titles, descriptions, locations or calendar names. You can exclude individual calendars. Time windows, busy periods and calendar selection are calculated on your device or stored encrypted; the server database contains only ciphertext and the technical availability link mode. The server accepts no new event requests for these links. Changing the mode does not delete existing requests; pausing, expiry and deletion work as they do for booking links.

If you request an appointment via a booking link, you don't need an account. The following are then processed: the encrypted request itself (including the information you entered, which cannot be read by us), an irreversible short value of the selected time so that the same time is not assigned twice, an ephemeral public key from your browser, the time of receipt and the processing status. The legal basis for the transmission initiated by you is Article 6 (1) (b) GDPR; Art. 6 Para. 1 lit. f GDPR applies to the protection against automated misuse (IP address in the access logs, rate limitation, bot protection). An email address that you provide in the request is part of the encrypted content: we do not send anything to it and cannot read it. You can access the processing status via the address that you receive after sending.

Reporting and blocking. The owner of a booking link can report a request received in the app and choose whether to block further requests from the same source on all of their own booking links. To do this, the server stores the request identifier, the account, the time and the blocking status as well as an irreversible HMAC of the source IP formed with a separately kept key. The raw IP address is not stored in the database for this. The operator receives an empty message with an account and request ID, but never a name, email address, message, appointment time, request content or source IP. The legal basis is Article 6 Paragraph 1 Letter f GDPR; our legitimate interest is to protect the link holders and the service from harassment and abuse.

Optional email notifications. Both checkboxes are off by default. If you choose general notifications, you receive an email when a request is accepted, changed, declined or cancelled, without an event title, date, time, host, location or message. Only your email address is processed in readable form for delivery and stored encrypted at rest. The legal basis is your consent (Article 6(1)(a) GDPR).

Separate consent to a calendar invitation. Only by selecting a second checkbox, unchecked by default, do you permit the event title, date, time, duration and time zone for this event to be sent in readable form to the server and Scaleway Transactional Email. This email contains an importable calendar file (.ics), or the corresponding update if the event changes or is cancelled. The host, location, message and calendar owner’s account email address are excluded. A declined request has no confirmed event and no calendar file. Consented event data is processed for delivery and retained encrypted in a durable outbox until SMTP acceptance. Failed attempts are retried; withdrawal of consent, deletion of the request or account deletion removes an unsent job. Notification consent from the previous booking page does not count as consent to this new calendar invitation.

Full details and calendar download. Confirmed details are encrypted on the calendar owner’s device. Your browser decrypts them using the complete status link and creates the calendar file locally. The key after the hash sign is neither sent to the server nor included in emails. Save the complete status link: on another device, or if you lose the link, the email link alone cannot open the details.

Revoke consent: On the status page linked in every email without a key, click “Unsubscribe from notifications”. The address and both consent flags are deleted immediately, and no further emails or calendar files are sent. Without notification consent, an address you provide remains exclusively in the encrypted request.

Older app versions already installed: For events confirmed previously, older clients may still send the title and time in readable form for the former email feature. If a calendar email is newly selected, older clients may also send the host. The server does not use additional details for delivery and attaches no calendar file without new, separate consent. Current clients check for the new consent before sending readable event data.

A new request sends the account holder an email notification without request content, without the name, message or time. Only acceptance creates an event in their end-to-end encrypted calendar. The person who gave you the link is responsible for handling information you provide in a request; address requests for access to or deletion of that content to them.

10. Mobile Apps (Android and iPhone)

The Android and iPhone apps process the same account and calendar data as the web app and contain no third-party advertising, analytics, tracking or crash-reporting libraries. They send account and synchronized calendar data to the Private Calendar service, where the hosting, email and encrypted backup recipients described here apply. Only an iCal subscription you create also connects directly to your selected source, as described in Section 8.

Notice of updates

The Android app displays a message when a newer version is available in the Google Play Store. The update interface from Google Play is used for this. The app asks the Play Store application installed on your device whether a newer version is available; it does not establish its own connection to Google and does not transmit calendar content or account data. The update will only be loaded and installed after your express confirmation.

This check and download takes place via Google Play Services. Responsible for this in the European Economic Area is: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Which data Google Play processes as part of the app distribution is determined by Google's data protection information and is independent of the use of this app; Google Play regularly checks for updates to installed applications anyway. Anyone who obtains the app outside of Google Play will not receive such a notice; the query then silently fails.

Updates via the App Store (iPhone and iPad)

The iPhone and iPad app is provided and updated via the App Store. Depending on your system settings, the App Store installs updates automatically or you initiate them there yourself.

To notify you of a newer app version, our server retrieves the publicly available app version through Apple’s public interface at startup and then approximately every six hours, and caches it. This query contains no user data. The app receives the version through the existing Private Calendar service rather than querying Apple, then compares it with the installed version on your device. No calendar content or account data is transmitted, and neither your IP address nor account data is forwarded to Apple. A newer version produces a notice that you can dismiss for the day. Only tapping “Update now” opens the App Store page, where Apple’s privacy information applies.

The data Apple processes for app distribution depends on the Data protection information about the App Store; calendar content or Private Calendar account data are not transmitted by the app.

Voluntary app reviews

After sufficient use, the app can request the rating dialog from Google Play or the App Store. For this purpose, counters of successfully created appointments and active days, the first and last active date as well as the last request time with the counter readings at that time remain stored on your device. They do not contain appointment or account identifiers or calendar content, are not synchronized and are not transmitted to us, Apple or Google. A request is made at the earliest after seven days and 20 successfully created appointments or 14 active days, then no sooner than another 180 days and a new usage milestone. You can close the dialog; the app does not know whether you have rated or what rating you have given.

Android uses Google Play’s in-app review library, while iPhone and iPad use StoreKit. The store decides whether the dialog appears and independently processes any star rating or review text you choose to submit, under the Google privacy information or App Store privacy information. The app sends no calendar content or Private Calendar account data for this.

Silent wake-up notifications

To deliver changes even while the app is closed, the server can send the mobile apps an empty wake-up signal. It contains only a general type of change (calendar, sharing, booking request or account security): no title, no time, no calendar name, no appointment identifier and no content of a request. The app then loads the relevant encrypted or account-related status and decrypts it on the device. The wake-up signal itself is not displayed. Only then can the app generate a visible notification on your device about a new invitation or booking request, a change in a received calendar or an ended session; their readable content is not sent to Apple or Google.

Delivery uses the platform system services: Apple Push Notification service (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) and Firebase Cloud Messaging (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The service assigns your device a random platform-specific delivery or installation identifier, which the app sends to the Private Calendar server: on iOS, an Apple Push Notification service device token; on Android, the Firebase Installation ID for this app on this device. It is stored encrypted at rest with the account and used only for the wake-up signal. Apple or Google learns that a signal is sent to a device, but not what it concerns. Android connects to Google only after sign-in; the library is disabled by default and contains no advertising, analytics or crash-reporting components.

The delivery or installation identifier is deleted when you sign out of the app, when Apple or Google reports that the device is no longer reachable, no later than six months after the device’s last sync, and immediately on account deletion. The wake-up signal speeds up synchronization but is not required: both apps also attempt a background sync no sooner than approximately every two hours, if the operating system permits it. Already scheduled reminders also work offline.

Permissions

• Haptic feedback: The apps provide short tactile feedback for selected interactions. Android uses the normal vibration permission without an additional prompt. This feedback is generated entirely on the device; no personal data is stored or transmitted.
• Biometric app lock (Android): the optional app lock uses Android’s system dialogue for strong biometrics. Fingerprint and facial data remain with the operating system; the app receives only the unlock result and sends no biometric features to the server.
• Internet and network status: Synchronization with the server and direct HTTPS retrieval of explicitly subscribed iCal sources; network status controls when changes are uploaded and subscriptions are updated.
• Notifications: optional reminders of appointments as well as locally generated notices of invitations, booking requests, changes in received calendars and ended sessions. Permission is only requested after successful sign-in and can be rejected. The silent wake-up signal itself described above is never displayed and does not need it.
• Face ID or Touch ID (iPhone, optional): only if you turn on app lock; the biometric check remains on the device and its result is not sent to the server.

Storage on the device

Calendar data, including personal default reminders for each calendar, the iCal subscription URL and its read-only copy, is stored in a SQLCipher-encrypted database on Android and iPhone. Its random key is redundantly protected by two independent Android Keystore keys on Android and two independent, device-only Keychain entries on iPhone, so the failure of one local key wrapper does not permanently block access. Both apps also store a random installation identifier in protected device storage. They send it only with sign-in, 2FA, password-change and email-change requests required for account security; the server stores only its hash. Non-sensitive display preferences are stored in local app settings, along with the rating counters and request times in Section 10 (Android: review_prompt/progress_v1; iPhone: review_prompt_progress_v1). To prevent duplicate booking-request notices, the apps also store up to 500 irreversible SHA-256 hashes of random request identifiers there; these are neither synchronized nor sent to the server and are deleted on sign-out. Event content is never written in plain text to logs, settings or system backups. Reminders and visible change notices are generated only after decryption on the device.

Premium widgets on the Home Screen

For optional Premium widgets, the apps also keep a limited local display copy encrypted separately with AES-GCM. It contains calendar names and colours, selected appointments with titles and times, the display range, time zone, language, and entitlement and update markers, but no descriptions, iCal URLs, session tokens or master keys. Android protects the display key with the Keystore; on iPhone, the app and widget extension share a separate device-only Keychain key and App Group storage excluded from system backups. The copy is removed on sign-out or when an invalid session is detected. It is separate from the authoritative encrypted calendar data and the queue of unsent changes.

For each widget, choose between busy times and appointment titles. Busy times appear as grey blocks without titles, matching the availability display. Visible content can be read outside the biometric app lock and is managed by the operating system or launcher. Busy times without titles are shown by default.

Widgets show the latest locally available data. Changes on other devices appear after the next successful sync. The operating system may delay or prevent updates; being offline, power saving and force-stopping limit freshness. The display shows the last successful sync. Widgets do not replace reliable deadline monitoring.

On a key change or revocation of a share, the apps preserve unsent changes in an encrypted local recovery archive before replacing data. This includes the original encrypted blocks and the keys needed to restore them. An independent key protected only on this device secures the archive. Readable entries are offered as a personal recovery calendar. The archive is not synced and remains after recovery and sign-out until local app data is explicitly deleted. The browser retains corresponding archives and unreadable blocks in its encrypted local vault.

11. No analytics, no advertising, and what is stored on your device

The service uses no analytics or advertising trackers and embeds no external fonts or advertising networks. The technical access log described in Section 6 serves only security and troubleshooting purposes, is deleted after seven days, and is not used to measure audience reach or create profiles. The Roboto font is served locally by Private Calendar; viewing a page makes no request to Google or another font provider. The technically necessary Cloudflare Turnstile bot protection described above is loaded only in the feedback form, the legal-notice contact form and on the pages for account deletion, cancellation with an email code and withdrawal with an email code that require no sign-in. The direct statutory cancellation and withdrawal functions remain free of third-party services. No advertising cookies are set. A single cookie, “pc_seen”, has the fixed value “1” and a lifetime of one year. It is created when you open the calendar app and serves only to display the app again at “/” instead of the homepage. It contains no identifier, is not analysed and cannot recognise you across websites; you can delete it in your browser settings at any time. Sign-in tokens are stored encrypted locally on your device and used exclusively to maintain your session. The browser app also stores a random installation identifier locally and sends it only with the account security requests mentioned above. It is not used for analytics, advertising or cross-site recognition and is removed when browser data is deleted.

The web app does not offer calendar use without an account. Any unencrypted legacy from previous versions or old trust tokens in unencrypted local storage will be automatically and completely removed from your device when the new version is loaded, so that no unencrypted calendar or login data remains on the device.

Language (Auto based on the device language, German or English) is a per-account setting: it applies to the interface on all signed-in devices and to account emails. We store it as a functional account setting until it is changed or the account is deleted (Article 6(1)(b) GDPR); with “Auto”, emails follow the device language in effect when the setting was last chosen. It is also kept on each device so that the interface matches before sign-in: under pc_ui_language in the browser, in Android app settings and in iPhone UserDefaults. This device copy remains until it is changed or website/app data is deleted. The language is not calendar content. For explicitly requested booking notifications, the language selected on submission is stored with the request for its existing retention period. Calendar content and user-entered text are not translated. Product translations are prepared in advance; no text or account data is sent to a translation service during use.

Storage on your device (browser)

To ensure that the calendar works offline and your data only leaves your device encrypted, the browser app stores data locally. They remain on your device; the server does not receive them additionally. You can remove them at any time via your browser settings (“Delete website data”).

When switching languages on public pages, the destination page and scroll position are temporarily stored in sessionStorage. The entry is removed when the destination loads and is used only for up to sixty seconds. It serves only to preserve your current view when changing languages and is not sent to the server.

Database “calendar” (IndexedDB)

After signing in, this holds the encrypted vault: your calendars and events, including personal default reminders for each calendar, the session token and the master-key wrapper encrypted with your password. The raw master key is not stored permanently. The session expiry time is also stored unencrypted on this device so an already expired session leads directly to sign-in when online. It contains no token or key and remains until updated or the website data is deleted.

Local storage (localStorage)

The server address, last signed-in account email address for account association, selected colour scheme, “Stay unlocked on this device” preference and duration, a flag for a dismissed installation notice, and the random installation identifier. If selected, this also includes your pause or dismissal of the referral reminder (pc_referral_reminder_v1). Once the encrypted vault is set up, calendar data and tokens are stored only encrypted in the vault database.

Session storage (sessionStorage)

A random key that can be used to open the vault within the same browser session without re-entering the password. It is discarded when the tab is closed and does not reveal the master key on its own. If you tap the order button on the pricing page, a note with the selected plan and the time will be added for a maximum of ten minutes; it ensures that an order actually originates from there and is consumed immediately when the order is opened. It does not contain any personal identification.

Offline cache storage

The service worker stores the app itself as well as accessed public pages, fonts and symbols so that the app starts without a network connection. Calendar content is not there.

To make switching months faster, the browser first loads the displayed period and then gradually preloads more calendar data up to twelve months before and after it when capacity is available. The downloaded data and sync state stay in the existing encrypted vault on this device. Previously loaded older periods are not automatically deleted. Storage after signing out and deleting website data are described below.

The app also asks the browser to keep this storage persistent, so that low disk space does not cause it to be automatically discarded along with changes not yet synchronized.

The storage required for calendar operation, sign-in and expressly selected functions is strictly necessary for the service you want (§ 25 Para. 2 No. 2 TDDDG) and therefore does not require consent. They are not used for analysis, advertising or recognition across websites.

An occasional notice reminds you of the referral programme. Its timer runs temporarily in memory; no usage counters are created and mobile review counters are not used. Closing it or choosing “Later” saves only your chosen ninety-day pause locally. “Don’t show again” saves your permanent dismissal. These flags respect your choice; they contain no account identifiers or calendar content and are neither synchronized nor sent to the server. The setting is stored under pc_referral_reminder_v1 in the browser, review_prompt/referral_reminder_v1 on Android and referral_reminder_v1 on iPhone.

Referral codes and reward levels are only temporarily displayed in memory on the apps' account pages; the codes and reward levels are not additionally persisted in browser or app storage. An invitation link contains the random code as a URL parameter and can therefore be in your browser's history. If you explicitly choose to copy, the code or link goes to your device's clipboard.

When you start a full key renewal, newly encrypted calendar blocks are prepared separately. They replace the active data together with the new keyring. The server receives no unencrypted content or keys. Preparations that have not been activated expire after 48 hours and are cleaned up on server startup and every minute; successful activation or account deletion removes them immediately.

For this operation, the browser keeps an encrypted resumption record in the local vault. It contains the key versions needed to continue and the new recovery key. It remains until the local transition and share updates have completed and you have confirmed saving the recovery key, including after sign-out if interrupted. It is not synchronised as calendar content and is removed when you delete website data.

Pending acceptances and time changes for booking requests are stored in the encrypted event with your notification choice until the server acknowledges processing. To avoid duplicate decisions, the server stores a technical operation identifier and revision until the associated request is deleted. This provides no additional event content.

On Android, the encrypted calendar database, including changes that have not yet been synchronised, remains on the device after sign-out. The session ends; signing back into the same account lets synchronisation continue. Local data is removed when you delete app data or explicitly confirm a local repair.

12. Storage period and deletion

“Log out everyone else” ends other full sessions and revokes all trusted devices in the same action. Your current session stays active. If two-factor authentication is enabled, the next sign-in requires a code again.

• Referral codes, allocations and reward credits remain stored until the account is deleted so that the redemption limits apply during the account term. If deleted, your identifier and your technical payment transactions will be removed from the referral data; another person who still exists only retains their own reward balance and identity-free proof of redemption. Once both accounts have been deleted, this proof will no longer apply. This does not change existing statutory retention periods for invoices. Copied codes and links remain on your device until the clipboard or browser history is overwritten or deleted.
• Encrypted deletion markers for individual entries remain with the calendar without a fixed age limit so that a device returning after a long offline interval cannot resurrect deleted events. They contain technical identifiers and deletion times, without titles or descriptions. Deleting the calendar or account removes them under the deletion rules described here.
• Account details and calendar blocks will be saved as long as your account exists.
• A single calendar that you deleted is removed from the active database immediately. Its offsite encrypted blocks are removed within 30 days; the associated technical deletion job is then removed as well.
• Daily versions of offsite encrypted blocks — an encrypted intermediate state is retained for each calendar day alongside the current state — are removed within 30 days.
• A locally selected pause or dismissal of the referral reminder remains stored on the device until the browser or app data is deleted, even after you sign out. A pause expires after 90 days; a permanent dismissal remains in effect. No account IDs, calendar data or usage counters are stored for it.
• Sessions and trusted devices expire automatically and are then removed.
• Hashed identifiers of known installations will be removed no later than 365 days after the last successful use or immediately upon account deletion. The raw identifier only remains local until the app data or browser data is deleted.
• Local Android key wrappers remain exclusively on the device until the app data is deleted or reset via the explicitly confirmed local repair. This local reset does not delete any data on the server.
• Local Android appearance and introduction flags, including the flag for the background-work notice already shown, remain on the device until the app data is deleted.
• Local iPhone keychain entries and appearance flags remain on the device until the app data is deleted or reset via the explicitly confirmed local repair. This local reset does not delete any data on the server.
• Local review counters and request times remain on the mobile device after sign-out to avoid repeated requests. They are deleted when local app data is deleted or explicitly reset. They are not synchronized.
• Local hashes of previously reported booking requests remain on the respective Android or iPhone device until you sign out or delete the app data. They won't sync.
• Unconfirmed registrations will be automatically deleted if the email address is not confirmed within seven days.
• Confirmed account deletion starts a 48-hour waiting period. The account and data remain intact during this period. The pending deletion — request time, scheduled execution time, source, IP address and user agent — is stored in the server database and reported to signed-in devices through account status without the IP address or user agent. Cancelling it removes the pending deletion immediately. Otherwise, the account, sessions, key containers, shares, booking links and active encrypted calendar blocks are deleted at the scheduled time. Offsite encrypted blocks are blocked immediately and permanently removed within thirty days; encrypted full backups are also removed within thirty days. A record without an email address or calendar content is retained to manage and verify these steps. It contains the internal account identifier, timestamps and retry status; for Premium, it also temporarily contains the Stripe subscription identifier and technical error details until Stripe confirms cancellation. Once offsite deletion and any required subscription cancellation are complete, this record is deleted after a further thirty days. If a step fails, it is retained until a retry succeeds.
• Email-change requests are valid for fifteen minutes. Successful confirmation, cancellation, five failed attempts, a new request or partially failed code delivery removes or replaces the request. Expired entries are deleted periodically; codes are stored only as HMAC verification values. Abuse counters are scheduled for deletion after at most 24 hours and cleaned periodically. Pending security messages and Stripe address updates are retried for at most seven days and then deleted periodically; account deletion removes them immediately. There is no general directory of previous account addresses. Original wrapping addresses required by existing calendar shares remain until the share is deleted or rewrapped.
• Hashes of public account deletion codes become unusable 15 minutes after they are created. After successful confirmation of the scheduled deletion, five incorrect entries, a new code request or failed sending, they will be immediately removed or replaced; the ongoing periodic cleanup will remove expired records within a maximum of another six hours. No deletion code record is created for unknown or unverified email addresses.
• Hashes of the cancellation and withdrawal codes are in separate data sets and follow the same time limits: 15 minutes validity, immediate removal after successful confirmation, five failed attempts or a new request.
• Proof of confirmed termination is retained independently of your account until the end of the third calendar year following the year of the declaration or, if later, the actual contract end. It is then deleted automatically. Outstanding processing or confirmation tasks are retained until completed. It is used solely to administer the contract and provide evidence of the declaration.
• Declarations submitted through the direct cancellation and withdrawal functions are not stored in the server database. They are sent by email to the controller and as a confirmation of receipt to the confirmation address provided. The associated correspondence will be removed after final contract processing, unless there is a legal obligation to retain or provide evidence to the contrary.
• Contact and feedback messages and related correspondence, including optional attachments and email copies, are deleted after final handling, within 30 days at the latest, unless a legal retention obligation applies. The Private Calendar server does not save messages in its database or file storage. Images and videos remain available encrypted for up to 72 hours; links then become invalid and files are automatically cleaned up every minute.
• Turnstile verification tokens are used by the Private Calendar server only for the immediate check and are not stored. The security signals processed by Cloudflare are subject to the time limits described in the linked Turnstile Privacy Notice.
• Invoices and accounting records for Premium, including stored invoice metadata and its internal account identifier, are generally retained for eight years even after account deletion, and removed after the eighth calendar year following the record year. If a record is also subject to a longer statutory period or required for unfinished tax or legal proceedings, deletion occurs only when that reason no longer applies. Other accounting records may require ten years, and commercial or business correspondence generally six. The account-to-Stripe-customer association, current subscription status and order-confirmation delivery proof are removed and the subscription cancelled on account deletion.
• Data stored locally in the browser remains on your device. Signing out ends the session and discards the key from memory, but the encrypted vault intentionally remains on the device: calendar data should survive changes to sign-in state and remain available offline. The vault is locked and readable only after password entry; automatic unlocking is removed on sign-out. Without a vault, the saved sign-in record is removed on sign-out. In both cases, the offline cache, account association based on server address and last signed-in email address, dismissed installation-notice flag and installation identifier remain. Clearing your browser’s website data removes them all. After permanent account deletion following the 48-hour waiting period, active account and calendar data is removed from the server. You may need to remove local vault data yourself or replace it by signing in with another account.
• The order flag in the session store is valid for a maximum of ten minutes, is used immediately when the order is opened and is discarded at the latest when the tab is closed.
• The initial cookie “pc_seen” lies exclusively in your browser and expires one year after your last visit. It is removed when clearing the browser data; the server does not save anything.
• Server access logs are deleted after seven days. The server creates one file per UTC calendar day and removes outdated files at startup and several times daily. The upstream web server’s technical error log is limited in size and number and is overwritten on a rolling basis.
• Abuse detection counters are kept only in memory and are lost whenever the server restarts.
• Booking links are stored until deleted or expired, then removed with their event requests no later than seven days after expiry. An email address supplied for notifications is deleted immediately on unsubscribe, or at the latest with its request. Event requests are retained for ninety days after a decision and then deleted; pending requests remain while the link exists. Related reports are removed with the request. A source block contains only an irreversible HMAC and expires after 180 days. Account deletion immediately removes links, requests, reports and blocks.
• Delivery addresses for silent wake-up signals are removed as soon as you sign out of the app, as soon as Apple or Google report the device as no longer reachable, at the latest six months after this device last synchronized, and immediately when the account is deleted.
• Backup copies are overwritten on a rolling basis (the latest fourteen daily backups are retained locally).
• Technical operational monitoring only saves last processing times, the active warning status and a hash of the technical warning text as long as the service is in operation.

You can delete the account yourself at any time in the settings. This requires a confirmation phrase, your password and a twelve-digit code that we send to your account email. If you cannot sign in, you can also use the public Delete account page: a twelve-digit code valid for 15 minutes is sent to the account email address on file. After confirmation, the deletion is scheduled for 48 hours later – it is not carried out during this period. Each signed-in device displays a notice; cancelling it requires a signed-in session and your account password. Without cancellation, the active account and calendar data are irrevocably deleted when the period ends. Exceptions and follow-up periods for backup copies, the technical deletion control record and invoice data that must be retained by law are listed immediately above.

13. Your rights

You have the following rights against the controller:

• Information about the data processed about you (Article 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Deletion (Article 17 GDPR)
• Restriction of processing (Article 18 GDPR)
• Data portability (Art. 20 GDPR): the app also offers an export of your data as JSON or ICS
• Objection to processing based on legitimate interests (Art. 21 GDPR): see Section 14
• Withdrawal of consent given, with effect for the future (Article 7(3) GDPR)

You also have the right to complain to a data protection supervisory authority about the processing of your personal data (Article 77 GDPR). To do this, you can contact the supervisory authority of your usual place of residence, your place of work or the place of the alleged violation.

14. Right to object

15. Changes to this privacy policy

We will adapt this privacy policy if the functions of the service or the legal situation change. The current version is available at this address. You can find the date of the last change above under “As of”.