Co-Op Calendar privacy policy (beta draft)

Effective date: October 19, 2026.

Co-Op Calendar finds the times when everyone in your group is free. Our server sees when you are busy, never what you are doing, and your group sees only the times when everyone is free, unless you choose to show someone items from your schedule. This page lists everything the app and our server handle.

What our server keeps

Your email address

• What: The address you sign in with.
• Why: Signing in: a one-time code is sent to this address. There are no passwords and no phone numbers.
• How long: Until you delete your account. When you delete your account, we keep the address alone (not linked to anything) until it has been removed from our email delivery service's do-not-mail list, usually a few seconds; if that fails, we try again every few minutes until it works, then delete it. Either way it is gone within 8 days of the deletion, the same window as everything else a deleted account leaves in our backups.
• Who can see it: You. Our email delivery service handles it to deliver each code, and the people who run Co-Op Calendar can access it to operate the service. Group members never see it.

Your account ID and sign-in sessions

• What: A random account ID, and a random token for each device you are signed in on. Sessions record no IP address and no device or browser details. We keep only a hash of each token, never the token itself, so a copy of our database can't be used to sign in as you.
• Why: Keeping you signed in and connecting your groups and schedule to your account.
• How long: The account ID until you delete your account; each session until you sign out, 30 days after you last used it, or 90 days after you signed in however much you use it, whichever comes first, then deleted within 60 seconds.
• Who can see it: Not shown to anyone; the people who run Co-Op Calendar can access it to operate the service.

Sign-in codes

• What: The one-time code sent to your email, and the email address it was sent to, even if that address never becomes an account. Our server keeps only a hash of the code.
• Why: Checking that the person signing in can read that email.
• How long: Until used. After 3 wrong tries it stops working and is deleted at the next try. Otherwise it expires after 10 minutes and is deleted within 60 seconds. A code replaced by a newer one stops working and is deleted at the next try or when it expires. The email address is kept with each code and deleted with it.
• Who can see it: You, in your inbox. Our email delivery service handles the code to deliver it.

Sign-in limits for an email address

• What: When a code was sent to an email address, and when a wrong code was tried for it, filed under a scrambled form of the address (a keyed hash), never the address itself. Nothing else: not your account, your IP address or the code.
• Why: Stopping anyone from flooding an inbox with codes or guessing someone's codes, however many devices they use: at most 5 codes an hour and 10 a day for one address, and at most 5 wrong codes in 15 minutes and 10 a day, after which the waiting code is deleted and sign-in waits.
• How long: 24 hours, then deleted within 60 seconds. Never in logs.
• Who can see it: Not shown to anyone. The people who run Co-Op Calendar can't turn it back into an address without the server's secret key.

Your display name

• What: The name you choose to show your groups, 1 to 40 characters. A nickname is fine. You have none until you choose one. Display names and group names can't include a word from our list of slurs and explicit terms; labels you show someone are checked against it on your phone only, and nothing about a check is kept or sent.
• Why: Letting the members of a group see who is in it and who proposed a time.
• How long: Until you change it or delete your account.
• Who can see it: Members of your groups. The people who run Co-Op Calendar can access it to operate the service.

Your IP address, for limiting sign-in and invite-link requests

• What: The IP address a sign-in or invite-link request comes from, held in the server's memory with a count of recent requests.
• Why: Stopping anyone from flooding an inbox with codes, or guessing sign-in codes or invite links.
• How long: At most 2 minutes after your last such request, in memory only. It is never written to the database, to disk or to logs.
• Who can see it: No one; it is not stored.

Your groups

• What: The name of each group you create or join, which accounts are in it, when someone last joined or left, in a group of two, when each of you agreed to see the other's free times, whether you turned off notifications for it (only you see that), and whether your schedule counts in its free times (only you see that; the group sees only how many members' schedules count, never whose). One account can be in at most 100 groups, and can make at most 20 groups, 100 invite links and 100 proposed times a day: to count them, we also keep the time you made each, and nothing else, for 24 hours, even if the group, link or proposal is deleted sooner.
• Why: Finding the times when everyone in a group is free.
• How long: Your membership until you leave the group or delete your account. A group stays while it has members, so a group name you typed stays visible to the members who remain. The times you made groups, invite links and proposals are deleted 24 hours later (within 60 seconds), or with your account.
• Who can see it: Members of the same group see the group name. They never see your email. What they can learn about your schedule is under "When you are busy". IDs are random, so only someone who has seen an ID can check whether that group exists; they learn nothing else about it. The people who run Co-Op Calendar can access it to operate the service.

When you are busy

• What: Start and end times only, rounded out to 30 minutes, for the next 8 weeks, and how far ahead your last update reaches. Never titles, places, notes or who you are with.
• Why: Working out the times when everyone in a group is free.
• How long: Replaced each time your phone updates them. A block that has ended is deleted within 60 seconds. Only times up to 8 weeks ahead are accepted, rounded out to the next 30 minutes, plus 30 minutes for clock differences between your phone and our server. All of it is deleted when you leave your last group, or stop counting your schedule in every group, and with your account.
• Who can see it: Our server uses them to work out free times, and the people who run Co-Op Calendar can access it to operate the service: our server sees when you are busy, never what you are doing. Your groups see only the times when everyone is free. In a group of two, each of you can work out from those times when the other is free, and the app says so. Free times appear only once at least 3 members have added their schedule and count it in that group (everyone, in a group of two or three), and in a group of two only after both of you agree to it. In a bigger group, members who have not added their schedule yet, or who don't count it in that group, are treated as free, so the times can change. The app says how many members' schedules the times are based on, never whose. Even so, members who know their own schedule can learn something about the others' from the shared free times, especially in small groups.

Proposed times and replies

• What: A time someone in a group proposes, up to 2 years ahead and at most 14 days long, who proposed it, how many times it has been changed and when it last was, a random ID for its current version (so an answer counts only for the time it was given to), whether the time was checked against members' free times (a time past the group's free times isn't), and each member's yes or no. A no never records why. If a proposer changes the time, your answer is cleared and kept only for you, so you can re-send it with one tap. The old time is not kept.
• Why: Letting a group agree on a time.
• How long: Until 7 days after the proposed time ends, then deleted within 60 seconds. A proposal is deleted sooner if its proposer withdraws it, leaves the group or deletes their account; your replies in a group are deleted if you leave it or delete your account.
• Who can see it: Members of that group see the proposed time, who proposed it and each member's reply, by display name. An answer cleared by a change of time is shown only to you; to the others you have not answered yet. The people who run Co-Op Calendar can access it to operate the service.

Who can see your schedule

• What: The people you choose to show items from your schedule to, and the people who show theirs to you: for each, a random ID for that choice and when it was made, never which group it was made from. Requests to see someone's schedule: who asked whom, when, and whether the person who asked cancelled it, and the times of their asks to that person in the last 60 seconds (at most 10), with, after 10 in that time, when they can ask again. For a request you declined, that you declined it and when.
• Why: Letting you show chosen people chosen items from your schedule, and ask to see someone's.
• How long: A share lasts until either of you ends it ("Stop sharing" or Hide, or a block), you are no longer in any group together, or either account is deleted; sharing again later makes a new one, with nothing picked. A request is shown to the person asked for 7 days and deleted then (within 60 seconds), or sooner when it is accepted, when you are no longer in any group together, or with either account. A cancelled request is deleted once it can no longer count toward the limit on asking many times in a row: 60 seconds after the latest ask, or at the end of a 20-minute wait. Declining doesn't delete it sooner: to the person who asked, it looks the same as no answer until then.
• Who can see it: The two people only. Other members never see who shares with whom, who asked whom, or what anyone picked. The person who asked is never told you declined or muted them: to them it looks exactly as if you hadn't answered. The people who run Co-Op Calendar can access it to operate the service.

People you muted or blocked

• What: For each person whose requests to see your schedule you muted, or whom you blocked: their account, which of the two, and when. Never why.
• Why: Keeping their requests from notifying you or showing in the app, without telling them. For a block, also hiding their name in your groups, not notifying you of their plans, and never showing you their schedule.
• How long: Until you unmute or unblock them, or either account is deleted. A mute also ends when you are no longer in any group together; a block is kept across groups, so leaving and rejoining one can't undo it.
• Who can see it: Only you. The person you muted or blocked is never told. A block ends the sharing between you, which to them looks like an ordinary stop; nothing else they can see changes. The people who run Co-Op Calendar can access it to operate the service.

Reports you send

• What: When you report a display name, a group name, an item someone showed you from their schedule, or a person: the reason you picked, what was reported (the person's account or the group; a copy of the display name or group name as it was when you reported it, which our server takes itself; or, for an item, the one label you chose to send us), your optional comment in your own words (at most 500 characters; an emoji can count as more than one), when you sent it, and, once we have looked at it, when we closed it and what we did. Never anything else from your screen: no times, other labels, other members or free times. At most 20 reports a day: to count them, we also keep the time you sent each report, and nothing else, for 24 hours, even if the report itself is deleted sooner.
• Why: Letting you tell us about an offensive name, label or person, so we can act on it.
• How long: When we close it, what was reported (the copy of a name, or the label) and your comment are deleted at once; the rest (the reason, the kind of report, the account or group it was about, when, and what we did) is kept until 30 days after we close it (so we can see repeat reports), then deleted within 60 seconds. A report we never close is deleted whole 90 days after you sent it. Deleted sooner with your account, with the reported person's account, or with the group it was about. The time you sent it is deleted 24 hours later (within 60 seconds), or with your account.
• Who can see it: You, in your export, and the people who run Co-Op Calendar, who read it to decide what to do. Your export shows what you sent (the reason, and until we close it your comment and the label for an item), never the copy of a name our server took. Never the person you reported, who is not told who reported them, and never anyone else in your groups. The email that tells us reports are waiting says only that, never what they say or who sent them, and comes at most once every 10 minutes however many there are.

Account suspension

• What: If we suspend your account after reports of abuse: when we suspended it, and which report we decided on. Nothing else. While it is suspended you stay in your groups, but the app can only export your data or delete your account.
• Why: Stopping an account that broke our terms from using Co-Op Calendar, while its owner can still take their data or delete the account.
• How long: Until we lift the suspension, or the account is deleted. Which report it was decided on is forgotten when that report is deleted (30 days after we close it).
• Who can see it: You, in your export (when it began, never the report). Never the other members of your groups, who aren't told. The people who run Co-Op Calendar can access it to operate the service.

Moderation record

• What: For each action we take about reports (looking at them, closing one, resetting a name, removing someone from a group, suspending or lifting a suspension, deleting an account): which action it was, which report it was for if any, when, and which of the two of us took it (as a fixed code, not a name). Nothing about any person: no account, no group, no name and no text.
• Why: Keeping an honest record of what we did about reports, and when.
• How long: 365 days, then deleted within 60 seconds. Which report an entry was for is forgotten when that report is deleted.
• Who can see it: Not shown to anyone; the people who run Co-Op Calendar can access it to operate the service.

Your shared schedule, encrypted

• What: For each person you chose, a copy of the items you picked for them (up to 20): each item's label and its times over the next 4 weeks, rounded out to 30 minutes. Your phone encrypts each copy to that person's phone key before it is sent, so our server stores only bytes it can't read. Every copy is padded to one fixed size (32 KB) whatever it holds, so its size says nothing about what you picked. With it, the server keeps which share and which two phone keys it is for, when it expires, and when it was last updated. Apart from the copy, it keeps a counter that puts the copies in order: for that share and those two phone keys, the number of the newest copy it has accepted. Never the items you didn't pick, and never events from your phone's calendar.
• Why: Showing the people you chose the items you picked for them, even while your phone is offline.
• How long: A copy is replaced by each newer copy for that person. It is deleted when the share ends, at the end of its 4-week range (within 60 seconds), when either phone's sharing key is replaced or removed, or with either account. The counter stays after its copy reaches the end of its range, so an older copy that arrives late can't replace a newer one; it is deleted when the share ends, when either phone's sharing key is replaced or removed, or with either account.
• Who can see it: Only the person it is for can read it, on their phone. Our server can't read it: it sees when each copy was updated, not what it says. Our server hands out the phones' keys, so you rely on it to give your phone the right person's key. Other members never see it. The people who run Co-Op Calendar can access it to operate the service, but only as the unreadable bytes.

Your phone's sharing key

• What: If you use schedule sharing: the public half of your phone's sharing key, a random key ID and a random device ID, both new with every key, and when it was registered. The secret half never leaves your phone.
• Why: Encrypting copies to your phone, and letting your phone check that a copy really came from the person who shared it.
• How long: Until you sign out, your phone replaces it with a new one (after a reinstall, on a new phone, or after erasing its data, the next time sharing is used), or you delete your account. When you sign out, your phone asks the server to delete it, and asks again the next time you sign in, in case the server didn't get the first request. Removing it deletes every copy made with it or for it.
• Who can see it: You, and the people you share with or who share with you. The people who run Co-Op Calendar can access it to operate the service.

Change list for catching up

• What: For each record you can see (your profile, the groups, members, proposed times and replies in your groups, and, if you use schedule sharing, your shares and requests, the sharing keys of the people you share with, the encrypted copies addressed to you, and the people you muted or blocked), which one changed, a counter for the order (counting only your own changes), and whether it was deleted; and how far your old deletion markers have been cleared. Never the record's contents: those are read at the moment your phone asks. Never your busy times, free windows, invite links or acknowledgements.
• Why: Catching your phone up after it has been offline, without sending everything again.
• How long: One entry per record, replaced on each change, until the record or your account is deleted. When a record is deleted, a marker saying so is kept for 30 days, then deleted within 60 seconds. Deleting your account deletes all of your entries, and at the same moment every entry or marker in other people's lists that names your account; their phones then catch up from a fresh copy instead.
• Who can see it: Only your own phone reads your list. The people who run Co-Op Calendar can access it to operate the service.

Record of changes sent from your phone

• What: For each change your phone sends (your name, a group, a proposed time, a reply, leaving a group), the random operation ID your phone chose, which request it was (its method and address, with the IDs of the records it changes), whether it worked, and, if it was refused, the error code. Never the change's contents, and never anyone's name.
• Why: A change your phone has to send again, for example after losing signal, is not applied twice. A repeat is answered with what the record looks like now.
• How long: 7 days, then deleted within 60 seconds. Deleted with your account, and so is any record of someone else's that names your account (such as their mute of you).
• Who can see it: Only your own phone, when it sends the same change again. The people who run Co-Op Calendar can access it to operate the service.

Notification token for your phone

• What: If you allow notifications: to get it, your phone sends Expo the token Apple (or Google) gave it and a random ID for this install of the app (see "Notification registration on this phone"). We keep the token Expo gives your phone for sending it notifications, which platform it is (iOS or Android), when it was registered and last seen, and a random ID for that registration. The notifications themselves say only that a time was proposed, changed or cancelled in one of your groups, never which group, who, or when, and carry only the group's and the proposal's random IDs, so a tap opens the right screen.
• Why: Telling you when a plan in one of your groups is proposed, changes or is cancelled, even when the app is closed.
• How long: Until you sign out, turn notifications off, or delete your account, or until the phone it belongs to asks for it to be deleted (the next session on that phone does, if your sign-out could not); deleted sooner if Expo reports the phone no longer takes notifications, and after 60 days unused (deleted within 60 seconds).
• Who can see it: Not shown to anyone. Expo, Apple and Google receive it to deliver notifications (see "Services that handle your data for us"). The people who run Co-Op Calendar can access it to operate the service.

Invite links

• What: A random token that lets someone join one group, once. We keep only a hash of the token (never the token itself), with the group, who created the link and when it expires.
• Why: Inviting friends without sharing anyone's email or phone number.
• How long: Kept until used, revoked, expired (after 7 days, then deleted within 60 seconds), or its creator leaves the group. Also deleted if the group is deleted or its creator deletes their account.
• Who can see it: Anyone who has the link can see the group's name, the display name of the person who invited them and when the link expires, and can use it once to join, so share it only with people you want in the group. Their phone is also sent the group's ID, a random code the app never shows, so a phone already in the group can tell; on its own it opens nothing. The app shows the link only on the screen where you made it and never stores it. If you copy it, it stays on your phone's clipboard until something else is copied, where other apps can read it and Universal Clipboard can carry it to your other Apple devices.

Error and request logs

• What: For each request to our server: which kind it was (the route, such as "/v1/groups/:id", never the IDs in it), whether it worked, and an error code if not. Also rare service events, such as an email that could not be sent, with only the mail service's status and error codes. When we act on a report, one line saying which action we took and the report's random ID, nothing else. Our logs never record your account ID, IP address, email, name or schedule.
• Why: Finding and fixing problems with the service, and keeping a record of what we did about reports.
• How long: 14 days.
• Who can see it: Not shown to anyone; the people who run Co-Op Calendar can access it to operate the service.

Backups

• What: Encrypted copies of the server data above, made every night and encrypted on our server before they leave it, so it can be restored after a failure. Only we hold the key.
• Why: Not losing everyone's groups if a server fails.
• How long: 7 days, then deleted (allow a day more: our storage provider removes expired copies within about a day). After you delete your account, your data is gone from the backups within 8 days. If we ever have to restore a backup, we first delete again every account deleted since it was made and make again every removal in "List of recent removals"; everyone is signed out and has to sign in again; and anything made or changed since the backup is lost (new groups and joins, names chosen, proposals and replies, shares, requests, mutes and blocks made). Removals are copied to backup storage within about a minute; if copying fails, which raises an alert for us, removals made since the last successful copy could come back after a restore.
• Who can see it: Not shown to anyone; the people who run Co-Op Calendar can access it to operate the service, including restoring it after a failure.

List of deleted accounts

• What: The random ID of an account that was deleted, when its deletion began, when the copy below was written, and when we last tried to finish the deletion if it stopped half way. Nothing else: no email, no name, nothing from the account. While a deletion is finishing, this record is also what stops the account being used.
• Why: So that restoring a backup after a failure deletes those accounts again.
• How long: 8 days after the account is deleted (one day longer than any backup is kept), then deleted within 60 seconds. A copy of the ID and the time the deletion began is kept with the backups for 8 days, written before anything is deleted, so a failure of our server can't lose it.
• Who can see it: Not shown to anyone; the people who run Co-Op Calendar can access it to operate the service, to delete those accounts again after restoring a backup. Cloudflare stores the copy with the backups (see "Services that handle your data for us").

List of recent removals

• What: When something is removed: you leave a group (or we remove you from one), a schedule share ends, a mute or block is lifted, a request to see a schedule is withdrawn or declined, a phone's sharing key is removed, you stop a group counting your schedule, a proposed time is withdrawn, an invite link is revoked or used, or we close a report, reset a name or lift a suspension. We keep which kind of removal it was, when, and a one-way fingerprint of what was removed, made with a secret key that is kept apart from our database and its backups. Never the IDs themselves, and nothing you wrote.
• Why: So that restoring a backup after a failure makes those removals again, instead of bringing back a group you left, a share you ended, a link you revoked or busy times you had us delete.
• How long: In our database until it is copied to backup storage, which happens within about a minute; if copying fails, which raises an alert for us, it stays until copying works again (at most 8 days). The copy is kept for 8 days, one day longer than any backup.
• Who can see it: Not shown to anyone; the people who run Co-Op Calendar can access it to operate the service, to make those removals again after restoring a backup. Cloudflare stores the copy with the backups (see "Services that handle your data for us"), and can't tell what any fingerprint stands for.

What stays on your phone

The app keeps or reads these on your phone and never sends them to us.

Events in your phone's calendar

• What: Titles, places, notes, attendees and times of the events on your phone.
• Why: Working out when you are busy, only when you tap Import.
• How long: Not kept by the app. Read on your phone when you import.
• Who can see it: No one. Only rounded start and end times leave your phone.

Your My schedule items

• What: What you enter, every week (such as "Tue and Thu, 3-4 pm") or just once on a date (such as "Sat, Oct 10, all day"), and its label. Kept in an encrypted database on your phone.
• Why: Turning your routine, and one-off busy times, into busy times.
• How long: On your phone until you delete them; an item for just one date is deleted 7 days after it ends, as soon as the app is next opened or brought back after that. Signing out keeps them, locked, until you sign in again with the same account. They are erased when a different account signs in on this phone, when you choose "Sign out and erase this phone's data", or when the app is deleted. They exist nowhere else: once erased, or if the app is installed again or its database key is lost (for example when a backup is restored to another phone), they are gone and cannot be recovered.
• Who can see it: Only you, and, for each item, the people you picked it for, who see its label and times in their encrypted copy. Otherwise only rounded start and end times leave your phone.

The key that unlocks schedules shared with you

• What: The secret half of your phone's sharing key, with its random key ID and device ID, made on your phone the first time you use schedule sharing. Stored in the iPhone Keychain (the Android Keystore) like the database key: readable only on this phone, only after it has been unlocked once since it was turned on, and never in a backup.
• Why: Opening the copies people share with you, and encrypting yours so only the people you chose can read them.
• How long: Until you sign out, choose "Sign out and erase this phone's data", or delete the app. A reinstall makes a new one: iOS can keep Keychain items after the app is deleted, and a reinstalled app never uses one it finds.
• Who can see it: No one. It never leaves your phone.

What Cal's widgets show

• What: For the next 24 hours: which picture of Cal to show, which of his fixed lines to show, and when your next My schedule item starts. Never its label, a group, a person or a place. Kept in a shared area on your phone that only Co-Cal and its widgets can read. While you are signed in, each entry also carries a random code made when you signed in and kept in the iPhone Keychain (this device only, never in a backup), so the app can tell its own entries from an earlier sign-in's; it says nothing about you. The last entry is marked as the last, the same 24 hours on whatever your schedule holds.
• Why: Showing Cal and a countdown to your next item in widgets you add, also on the Lock Screen.
• How long: Replaced whenever your schedule changes or you open the app. Replaced by a signed-out picture when you sign out, erase this phone's data, or a different account signs in; if that reset fails, the app tries again each time it opens and shows nothing from your schedule there until it has. The random code is forgotten when you sign out. Deleted with the app.
• Who can see it: Anyone who can see your Lock Screen, StandBy or Today View, if you add a Co-Cal widget. If your iPhone hides widget data while locked, Cal's line and the countdown are covered by the same block whatever they say. It never leaves your phone.

Cal's reminders

• What: Which of your My schedule items you turned "Remind me" on for, and whether 15 minutes before or at the start; for the next 7 days, the reminders your iPhone holds to show: a time and one of Cal's fixed lines each, at most 4 a day, each named with a random code made when you signed in; and a log of this phone's reminder times: fire times only, each kept through its own day and the day after, so the daily limit and the 30-minute spacing hold when the app plans them again (a time still to come is kept until then, also if you sign out first). Never the item's label, its time, a group, a person or a place. The choices and the times are kept in the encrypted database on your phone, the random code in the iPhone Keychain (this device only, never in a backup), and the reminders themselves are held by iOS, on your phone.
• Why: Reminding you, only for the items you choose, that something is coming up.
• How long: Planned again whenever your schedule or a reminder changes and whenever you open the app. All of them cancelled and the random code forgotten when you sign out, erase this phone's data, or a different account signs in; if the cancel doesn't go through, the app finds the leftovers by that code and cancels them before planning any more. The log of times is kept through sign-out and deleted when you erase this phone's data or a different account signs in; each time in it is deleted once the day after it has passed, checked each time the app opens or comes back. A choice is deleted with its item, and all of them with the rest of the database. Deleted with the app.
• Who can see it: Anyone who can see your phone when one shows, as a notification. It never leaves your phone: no server, ours or anyone else's, is told about it.

Cal's daily nudge and evening peek

• What: Whether you turned on "Show me my day each morning" or "A peek at tomorrow each evening", the time of day you picked for each, and whether Cal has offered the morning one; for the next 7 days, the notifications your iPhone holds for them: a time, one of Cal's fixed lines and the date its tap opens each, at most one of each a day and only for days with something on My schedule, named with the same random code as Cal's reminders; and the times of the ones planned, each kept through its own day and the day after, so none is sent twice in a day (a time still to come is kept until then, also if you sign out first). Never what is on your schedule: no label, time of an item, group, person or place. The settings and the times are kept in the encrypted database on your phone, and the notifications themselves are held by iOS, on your phone.
• Why: Showing you, at a time you pick, that your own day or the next has something on. Off until you turn it on.
• How long: Planned again whenever your schedule or a setting changes and whenever you open the app. Cancelled with Cal's reminders when you sign out, erase this phone's data, or a different account signs in. A planned time is deleted once the day after it has passed, checked each time the app opens or comes back. The settings and the times are kept through sign-out, deleted when you erase this phone's data or a different account signs in, and deleted with the app.
• Who can see it: Anyone who can see your phone when one shows, as a notification: it shows that the day has something on, never what. It never leaves your phone: no server, ours or anyone else's, is told about it.

Weekly check-ins with Cal

• What: Whether you turned on "Weekly check-ins with Cal"; the weeks that counted, each as the date of its Monday; and, for the week now under way, how many days so far you opened your day with Cal (1 or 2) and the date of the last of them, kept only until that week counts or ends. Never the time of day, which other days, or anything on your schedule. Nothing is kept until you first turn it on. Kept in the encrypted database on your phone.
• Why: Counting the weeks you opened your day with Cal on at least 3 days, and showing what Cal has collected, one thing for each such week. Off until you turn it on.
• How long: The days of the week under way are deleted when that week counts, when you turn the switch off, and once the week has ended, checked each time the app opens or comes back. Turning the switch off stops the counting; the switch itself and the weeks that counted, and so what Cal collected, stay. All of it is kept, locked, when you sign out or are signed out. It is deleted when you erase this phone's data, when a different account signs in on this phone, when you delete your account, and with the app.
• Who can see it: No one but you, in the app. It never leaves your phone: no server, ours or anyone else's, is told about it. It is never in a notification, a widget or on the lock screen.

Your answer about Cal

• What: The date Cal's reminders or his daily nudge were first turned on on this phone; your one-tap answer to "Cal is: too much, just right or too little", or that you skipped it; and, after "too little", whether Cal's offer of the evening peek is still waiting for a yes or a no. Kept in the encrypted database on your phone.
• Why: Asking the question once, two weeks after you started using Cal's reminders, and never again; and tuning this phone to your answer: "too much" turns the evening peek off, "too little" has Cal offer it. We have no analytics, so this is not counted or collected anywhere.
• How long: Kept with Cal's settings: through sign-out, deleted when you erase this phone's data or a different account signs in, and deleted with the app.
• Who can see it: No one. It never leaves your phone: no server, ours or anyone else's, is told your answer or that you were asked.

Who you show which items to

• What: For each person you share with, which of your My schedule items they see (up to 20; never events from your phone's calendar), and, for each person's copy, a counter and when it was last sent. Kept in the encrypted database on your phone.
• Why: Building each person's copy from what you picked for them, and only that.
• How long: Until you change them. A person's picks are deleted when your share with them ends, so sharing again starts with nothing picked. Kept, locked, when you sign out; erased when a different account signs in on this phone, or with "Sign out and erase this phone's data".
• Who can see it: No one. They never leave your phone, except as what each person's encrypted copy contains.

Names of people you blocked

• What: For each person you block or unblock from this phone: their account, whether you blocked or unblocked them, when, and for a block the display name it was showing for them then (if it had one). Kept in the encrypted database on your phone.
• Why: Telling your blocks apart in Account → Blocked, since once you block someone our server stops sending you their name; and treating them as blocked, or unblocked, on this phone at once, before the next sync confirms it.
• How long: A block's name is kept until you unblock them; an unblock is kept only until the next sync confirms it. Deleted sooner when a different account signs in on this phone, you choose "Sign out and erase this phone's data", or you delete the app. Kept, locked, when you sign out.
• Who can see it: No one else. It is never sent to our server.

Schedules people share with you

• What: The items each person chose to show you, as your phone decrypted them: labels and times. Kept in the encrypted database on your phone.
• Why: Showing you those schedules, also without a connection.
• How long: Replaced by each newer copy. Deleted when that share ends, when either phone's sharing key changes, when the copy expires, when you sign out, when a different account signs in on this phone, and with "Sign out and erase this phone's data". Times that have passed are not shown.
• Who can see it: Only you, on this phone.

Your time zone

• What: The time zone your phone is set to.
• Why: Showing times in your time zone and placing your responsibilities at the right hour.
• How long: Read from your phone when needed; not stored by the app.
• Who can see it: No one.

Your sign-in token on the phone

• What: The session cookie that keeps this phone signed in: a random token the server sets when you sign in. Stored in the iPhone Keychain (the Android Keystore), readable only on this phone and only after it has been unlocked once since it was turned on; never in a backup. The app sends it itself with each request, so the system's shared cookie storage never holds it. Next to it, kept the same way, a marker that says this phone is signed out; it holds nothing about you.
• Why: Staying signed in without a password.
• How long: Until you sign out, which deletes it from this phone (the server is told too when it can be reached), or until the server ends the session. If the phone refuses the delete, the app stays signed out anyway, and the token is replaced at the next sign-in or stops working when the server ends the session. iOS can keep Keychain items after the app is deleted, so sign out first to remove it; a reinstalled app deletes any it finds before signing anyone in. The signed-out marker is removed when you next sign in.
• Who can see it: No one else on the phone.

Which account this phone is signed in to

• What: Your account's random ID and your email address, as the server returns them when you sign in. Kept in the encrypted database on your phone.
• Why: Knowing whether a later sign-in is the same account or a different one, and showing "Signed in as" with your address.
• How long: Kept, locked, when you sign out, so the same account signing back in finds its data. Replaced when a different account signs in (the old data is erased first); erased with "Sign out and erase this phone's data" or when the app is deleted.
• Who can see it: No one else on the phone.

Offline copies

• What: The server data you can see, as last downloaded: your profile, your groups, their members' display names, the times proposed in them and the replies, your groups' free times, and, if you use schedule sharing, your shares and requests, the sharing keys of the people you share with, the encrypted copies addressed to you, and the people you muted or blocked. With them, your own changes not yet sent, such as a group you created, renamed or left while offline: what the change is, never a copy of anything else. And the random IDs of groups you have left or been removed from, so that nothing still on the phone brings one back. And which plans changed since you last looked, and the time you last saw each one at (the server keeps no old time). Kept in an encrypted database on your phone, so the app works without a connection.
• Why: Seeing your groups, proposed times and free times on a train or without signal, and seeing when a plan has moved: "Changed: Sat 2:00 → Sun 3:00".
• How long: Updated on each sync; a change of yours goes once the server has it and the phone has caught up with the server, once the server has refused it, or once you have left the group it is for (then it is never sent). A left group's ID goes if you join it again. The time you last saw a plan at is replaced once you have seen its new time, and goes with the plan, or when you leave its group. Kept, locked, when you sign out; erased when a different account signs in on this phone or with "Sign out and erase this phone's data". If the app is installed again or its database key is lost, it is downloaded again.
• Who can see it: No one else on the phone.

Your settings on this phone

• What: Whether Effects is Standard or Minimal, whether Vibrations is on, and whether you chose "Not now" when asked for your name. Kept in the encrypted database on your phone.
• Why: Remembering how you want the app to move and vibrate, and not asking for your name again on this phone.
• How long: Until you change them. Kept when you sign out; erased when a different account signs in on this phone, with "Sign out and erase this phone's data", or when the app is deleted.
• Who can see it: No one else on the phone.

Notification registration on this phone

• What: Whether you allowed notifications in the app or chose "Not now". If you allowed them: the token Expo gave this phone, the token Apple (or Google) gave it, and when the token was last sent to our server, in the encrypted database on your phone; and, in the iPhone's Keychain (this device only, never in a backup), a random ID for this install of the app, which the app sends to Expo to get the token, and the last token this phone registered, until our server confirms it deleted it. The app never uses Expo's own installation ID, which iOS would keep after the app is deleted.
• Why: Registering this phone for notifications, sending the token again when it changes (and at most once a day, so an unused one expires), and deleting it from our server when you turn notifications off or sign out. If a sign-out could not delete the token (for example, offline), the phone keeps it and asks our server to delete it again at the start of the next session on this phone, whoever signs in, whether or not they use notifications; if they do, the token moves to their account instead. So the last account's notifications stop once anyone signs in on this phone again and the phone is online. Until then, or if no one signs in again, they can still arrive on this phone for up to the 60 days a token is kept unused.
• How long: The tokens are deleted when you turn notifications off or sign out (your choice stays, so signing in again registers the token again), and erased with the rest of the database when a different account signs in, with "Sign out and erase this phone's data", or when the app is deleted. The random ID is kept for as long as this install of the app; iOS can keep it after the app is deleted, but the app replaces it when it is installed again and never uses an old one. The Keychain's copy of the last token is deleted once our server confirms the token is gone; it can outlive deleting the app, and the app installed again uses it only to ask our server to delete that token.
• Who can see it: No one else on the phone. Expo receives the tokens and the random ID (see "Services that handle your data for us").

The key to the database on your phone

• What: A random key, made on your phone, that encrypts the app's database there. Stored in the iPhone Keychain (the Android Keystore), readable only on this phone and only after it has been unlocked once since it was turned on; it is never in a backup.
• Why: Keeping your schedule, settings and offline copies unreadable to anyone who gets the database file alone.
• How long: Deleted and replaced with a new one whenever the database is erased (a different account signing in, or "Sign out and erase this phone's data"), and replaced when the app is installed again. iOS can keep Keychain items after the app is deleted; the key is useless without the database, which is deleted with the app.
• Who can see it: No one. It never leaves your phone.

Services that handle your data for us

How the beta is installed

• The beta is installed through Apple TestFlight. Apple handles your TestFlight invitation and any crash reports or feedback you choose to send; Apple's privacy policy covers that.
• The app does not include Expo's over-the-air update service. It contacts Expo's servers only to get a notification token, and only if you allow notifications (see Push delivery above).

What we never do

• No advertising, ad networks or selling of data, ever.
• No analytics, tracking or session-replay tools, and no third-party code in the app that collects data.
• No location, contacts, photos, microphone or phone number.
• Our own server logs never record IP addresses, emails, names or schedules.

Deleting and exporting

• Delete account takes you out of every group by the same rules as leaving one, then deletes your email, account, sessions, sign-in codes, name, your phones’ notification tokens, busy times, invite links, the times you proposed (with every reply to them), your replies, your change list and the record of changes your phone sent, your shares and requests both ways, your phone’s sharing key and every encrypted copy sent with it or to it, all at once. It is deleted, not hidden. A group you were the last member of is deleted with everything in it; a group name you typed stays visible to the members who remain. We also ask Cloudflare to delete its record of your address, if it has one (see Email delivery). Copies stay in our backups for the time given under Backups, then are gone. The app then clears its data on your phone. From the moment you ask, your account cannot be used or signed into again; if our backup storage cannot be reached just then, the deletion finishes as soon as it can.
• Export my data gives you one file with everything our database keeps about you: your email and when you signed up, how you sign in, how many sign-in codes are waiting and when they expire (not the codes), your name, the dates of your sessions (not their tokens), your phones’ notification tokens (which kind of phone and their dates, not the tokens), your groups and their names, your busy times, the invite links you made (their IDs and expiry, not the links), the times you proposed, your replies with the times they answer, the people you share your schedule with and who share theirs with you (and since when), the requests you sent (as you see them) and received (with your own decline, if any), your phone’s public sharing key, and when the encrypted copies you sent were updated. Never the copies addressed to you, which only your phone can read, and never labels or picks, which exist only on phones. Nothing about other members. Our logs are not in it because nothing in them says whose request it was, and nor are your change list and the record of changes your phone sent, which hold no content, only which records changed and whether each change worked. The app writes the file on your phone only while you share it, then deletes it. On Android, the app shares it as text rather than as a file.

Children

Co-Op Calendar is for people 13 and older. We don't knowingly collect data from children under 13. If we learn that an account belongs to a child under 13, we delete it within 24 hours of learning it, in the same way as Delete account. A parent or guardian can write to us at privacy@co-cal.com.

Changes to this policy

For a material change, such as a new kind of data we keep, a new use of it, or a new service that handles it, we post the new version here at least 14 days before it takes effect, with the date it takes effect, and the old version applies until then. Other changes take effect when we post them. The date at the top of this page is when this version takes effect.

Contact

Questions about your privacy, or a request about your data: write to privacy@co-cal.com.