Privacy Policy
This policy explains how Calendito (“Calendito”, “we”, “us”), operated by PlsFix LLC, collects, uses, stores, shares and deletes information when you use calendito.com, the Calendito TV display and any Calendito apps (together, the “Service”).
The short version
- We use your data only to run the family calendar you asked for: showing events on your TVs and keeping linked calendars in sync.
- Access to Google, Microsoft and Apple calendars is read-only. We never create, change or delete anything in those accounts.
- We do not sell your data, use it for advertising, or use it to train AI or machine-learning models.
- Access tokens and passwords for linked calendars are encrypted. You can unlink a calendar or delete your account at any time.
1. Information we collect
Information you give us
- Account: your email address. Sign-in uses a one-time code sent by email; we do not ask you to create a password.
- Calendar content: calendars, events (title, time, location, notes, repeat rules, “critical” flag) and the names and colours you choose. Events may mention other people, such as family members; please add only information you have the right to share.
- Sharing: if a calendar is shared between Calendito accounts, which accounts can see or edit it.
- Support: what you send us when you contact us.
Information collected automatically
- TV pairing: a random device token stored on the TV, the pairing code, and the time it was last used. To stop abuse of pairing, we keep a one-way hash of the requesting IP address for a short time.
- Security and logs: IP address, browser type, request times and error details in the logs of our hosting providers, used to run, secure and debug the Service.
- Bot protection: the sign-in page uses Cloudflare Turnstile, which processes signals from your browser and IP address to tell people from bots (see Cloudflare’s privacy policy).
We do not use advertising trackers, analytics cookies or third-party marketing pixels.
2. Linked calendars (Google, Microsoft, Apple)
You can choose to link an external calendar so its events appear on your Calendito TVs. Linking is optional and always read-only.
| Provider | Permissions we request | What we access and why |
|---|---|---|
| Google Calendar | calendar.calendarlist.readonly, calendar.events.readonly, plus openid and email |
The list of your calendars (names and colours) so you can choose which one to show; the events of the calendar(s) you choose (title, start/end time, all-day flag, time zone, location, repeat rules and exceptions, and whether an event is private) so the TV can display them; your Google account email so you can tell linked accounts apart. |
| Microsoft (Outlook.com, Microsoft 365) | Calendars.Read, offline_access, openid, email, profile |
The same calendar list and event fields as above, and your account email and name to label the linked account. offline_access lets the TV stay up to date while you are not using the app. |
| Apple iCloud and other CalDAV servers | Your Apple ID (or CalDAV username) and an app-specific password that you create | Used only to read the calendar list and events you choose from the CalDAV server. We cannot use an app-specific password to sign in to your Apple account itself. |
| Calendar links (ICS / webcal) | The link you paste | We download the feed to show its events. Private links work like passwords, so we store them encrypted. |
- Read-only: we never create, edit or delete events, calendars, contacts, email or anything else in your external accounts.
- Minimum data: event descriptions (notes) are not copied by default, and events marked private or confidential are copied only as “Busy” with their times. We copy events from 60 days in the past to 2 years ahead.
- Who sees it: linked events are visible to you, to people you share that Calendito calendar with, and on TVs paired to it. Remember that a TV is usually in a shared room.
- Credentials: OAuth refresh and access tokens, app-specific passwords and private calendar links are encrypted with AES-256-GCM before they are stored, kept in a database area that is not reachable from the app or TVs, and decrypted only by our sync servers while they fetch your events.
3. Google user data and Limited Use
Calendito’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, for data we receive from Google APIs (“Google user data”):
- We use it only to provide and improve the user-facing feature you asked for — showing your chosen Google calendars in Calendito and on your paired TVs and keeping them in sync — and for security (for example, preventing abuse).
- We do not transfer it to anyone else, except to the service providers listed below that host and run Calendito on our behalf, when needed to comply with law, as part of a merger or acquisition with your notice, or when you ask us to (for example, by sharing a calendar with a family member).
- We do not use it for advertising, including retargeting, personalised or interest-based ads.
- We do not sell it, and we do not use it to determine credit-worthiness or for lending.
- We do not use it to develop, improve or train generalised or non-personalised AI or machine-learning models.
- No person at Calendito reads your Google user data unless you give us permission for a specific message (for example, a support request), it is needed for security purposes such as investigating abuse, it is needed to comply with law, or the data has been aggregated and anonymised for internal operations.
The same commitments apply to data from Microsoft and Apple.
4. How we use information
- To provide the Service: sign you in, store and sync your calendars, show events on your TVs, and let you share calendars.
- To keep it secure and working: prevent abuse and fraud, rate-limit, debug and fix problems.
- To communicate with you about your account: sign-in codes, security notices and important changes. We do not send marketing email without your consent.
- To meet legal obligations.
Where the GDPR applies, our legal bases are: performing our contract with you (running the Service), our legitimate interests (security, abuse prevention and improving reliability), your consent (linking an external calendar, which you can withdraw by unlinking), and legal obligations.
5. Sharing and service providers
We do not sell or rent personal information, and we do not “share” it for cross-context behavioural advertising as defined by the CCPA. We use these service providers (processors) to run Calendito; they may process data only on our instructions:
| Provider | What they do |
|---|---|
| Supabase | Database, authentication and server functions (including calendar sync). Data is stored in the United States (AWS us-east-1). |
| Vercel | Hosts and delivers the calendito.com website. |
| Cloudflare | DNS, network security and Turnstile bot protection on the sign-in page. |
| Resend | Sends sign-in codes and account emails. |
When you link a calendar, we connect to that provider (Google, Microsoft, Apple or the server in your link) on your behalf to read it. We may also disclose information if required by law, to protect the rights and safety of users or the public, or as part of a merger, acquisition or sale of assets, in which case we will notify you and this policy will continue to apply.
6. Storage and security
- All connections use HTTPS (TLS). Data is encrypted at rest by our database provider; linked-calendar credentials are additionally encrypted by Calendito with AES-256-GCM.
- Database access is restricted per user with row-level security. TVs get read-only access to the one calendar they are paired to, and never see linked-account credentials.
- Calendar addresses you provide are checked so our servers only connect to public internet hosts.
No system is perfectly secure. If we learn of a breach affecting your personal information, we will notify you and the authorities as required by law.
7. Retention and deletion
- Unlinking a calendar (Manage → the linked calendar → Unlink) immediately deletes the copied events and the stored tokens or passwords for that account. For Google we also revoke our access with Google. Microsoft and Apple do not offer this, so we show you where to remove access: Microsoft at account.live.com/consent/Manage (personal) or myapplications.microsoft.com (work or school), and Apple by revoking the app-specific password at account.apple.com. You can also remove Calendito’s Google access at myaccount.google.com/permissions; syncing then stops, and unlinking in Calendito deletes what we stored.
- Deleting your account (Manage → ⋯ → Delete account) immediately deletes your account, your linked accounts and their credentials, and calendars only you can edit, together with their events and paired TVs. Calendars you share with other editors stay with them.
- Unpairing a TV deletes its device token. Unused pairing codes expire after 15 minutes and are deleted shortly after.
- Backups and logs: deleted data may remain in encrypted database backups for up to 7 days and in hosting-provider logs for up to 30 days, after which it is overwritten.
- Otherwise we keep your data while your account is active. If you want your data deleted and cannot use the Manage page, email us at privacy@calendito.com.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a portable copy of your personal information, to object to or restrict certain processing, and to withdraw consent at any time.
- EEA, UK and Switzerland (GDPR / UK GDPR): you may also lodge a complaint with your local data protection authority.
- California (CCPA/CPRA): you have the right to know, delete and correct personal information, and to opt out of its sale or sharing — we do neither. We do not use sensitive personal information to infer characteristics, and we will not discriminate against you for exercising your rights. You may use an authorised agent.
You can delete linked calendars and your account yourself on the Manage page. For any other request, email privacy@calendito.com. We will verify your request by confirming control of your account email, and respond within the time required by law (generally 30 days under the GDPR and 45 days under the CCPA).
9. Cookies and local storage
We do not use advertising or analytics cookies. The Manage page stores your sign-in session in your browser’s local storage, and TVs store their device token and display preferences in local storage, so they stay signed in and paired. Cloudflare Turnstile may set what is strictly necessary for its bot check on the sign-in page.
10. Children
Calendito accounts are for adults managing a household calendar. The Service is not directed to children under 13, and we do not knowingly collect personal information from them through accounts. Parents may add children’s activities to a family calendar; that information is controlled by the parent and can be deleted at any time. If you believe a child has created an account, contact us and we will delete it.
11. International transfers
We are based in the United States and store data in the United States. If you use Calendito from elsewhere, your information is transferred to the United States. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses with our providers.
12. Changes and contact
We will post changes to this policy on this page and update the effective date. If changes are material, we will tell you by email or in the app before they take effect. We will not use previously collected data in a materially different way without your consent.
Questions or requests: privacy@calendito.com
PlsFix LLC, PO Box 1241, Amherst, NY 14226