Privacy policy

1. Who is responsible (controller)

The controller of your personal data is Andre Brito Dev.

Registered address: Rua das Flores, 123, São Paulo, SP, Brazil.

Our Data Protection Officer (Encarregado pelo tratamento de dados pessoais, under the LGPD) is Andre Brito Dev, reachable at privacy@calendblade.com.

You can reach us about any privacy matter at privacy@calendblade.com.

2. Personal data we process

Account data: your name, email address, time zone, language and, if you sign in with Google, your profile picture.

Connected calendar accounts: the email address of each Google account you connect and the OAuth tokens Google issues to us, encrypted at rest with AES-256-GCM.

Calendar metadata: identifiers, names, colors and access level of the calendars in the accounts you connect.

Sync bookkeeping: for each mirrored event, its identifiers, start and end time and a one-way fingerprint (SHA-256) used to detect changes. We do not store event titles, descriptions, locations or guest lists: they pass through our servers only while a mirror is written.

Activity logs: when each sync ran, what it changed (counts only) and error codes.

Billing data: Stripe customer and subscription identifiers, plan and status. Card details are collected and stored by Stripe, never by us.

Technical data: IP address and user agent in session records and server logs, used for security.

Consent records: your cookie choices and when you made them.

Optional, only with your consent: error reports from your browser and product-usage events linked to a pseudonymous identifier.

3. Why we process it and our legal bases

To provide the service you signed up for (create your account, sign you in, read and write the calendars you choose, send transactional emails such as sign-in links): performance of a contract (GDPR Art. 6(1)(b); LGPD Art. 7, V).

To keep the service secure and reliable (session security, rate limiting, abuse prevention, server-side error monitoring without personal identifiers): our legitimate interests (GDPR Art. 6(1)(f); LGPD Art. 7, IX). You can object at any time.

To bill your subscription and keep accounting and tax records: performance of a contract and compliance with legal obligations (GDPR Art. 6(1)(b) and (c); LGPD Art. 7, II and V).

Browser error monitoring and product analytics: your consent (GDPR Art. 6(1)(a); ePrivacy rules; LGPD Art. 7, I). They stay off unless you opt in, and you can withdraw consent at any time in Cookie settings without affecting earlier processing.

Optional notification emails (for example, when a connected account needs attention): legitimate interests; you can turn them off in Settings.

We do not sell personal data, do not use it for advertising and do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

4. Google user data

We request access to Google Calendar only to provide the feature you configure: reading events from the calendars you choose as a source and creating, updating or deleting mirrored events in the calendars you choose as a target. We never send invitations: mirrored events have no attendees and no reminders.

Calendblade's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not use it to train artificial intelligence or machine learning models, and no human reads it unless you ask us to (for support), it is necessary for security, or it is required by law.

5. Cookies

We use strictly necessary cookies and local storage (sign-in session, security, language and display preferences, your consent choice). Optional technologies run only if you accept them. Our Cookie Policy lists every cookie, and Cookie settings in the footer lets you change your choice at any time.

6. Who we share data with

We use service providers (processors) that act only on our instructions under data processing agreements: application hosting, a managed PostgreSQL database, transactional email delivery, payments (Stripe), and, only with your consent for the browser, error monitoring (Sentry) and product analytics (PostHog). Google receives the calendar operations you configure. The current list of sub-processors is available on request at privacy@calendblade.com.

We may disclose data when required by law or to protect rights and safety, and to a successor if the service is transferred, in which case you will be notified.

7. International transfers

Some providers process data outside your country, including in the United States. For transfers from the EEA, UK or Switzerland we rely on adequacy decisions (including the EU-U.S. Data Privacy Framework where the provider is certified) or on the European Commission's Standard Contractual Clauses. For transfers from Brazil we rely on the mechanisms of LGPD Article 33, including the standard contractual clauses approved by the ANPD. You can request a copy of the relevant safeguards at privacy@calendblade.com.

8. How long we keep data

Account, connection, calendar and rule data: while your account exists.

Sync activity logs: 90 days. Records of mirrors we removed: 30 days.

If your subscription ends: syncing pauses and your connections, rules and logs are deleted 30 days later.

When you delete your account: we revoke our access to your Google accounts and delete your data from our database right away; encrypted backups expire within 7 days.

Billing records are kept for the period required by tax and accounting law. A hashed (non-reversible) form of your email is kept for up to 1 year after account deletion only to prevent repeated free trials.

Consent records: while your account exists; the cookie storing your choice expires after 6 months, when we ask again.

9. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interests, to withdraw consent at any time, and not to be subject to solely automated decisions.

Under the LGPD (Art. 18) you have the right to confirmation that we process your data; access; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed with your consent; information about the entities we share data with; information about the possibility of not giving consent and its consequences; and revocation of consent.

You can exercise most rights yourself: edit your profile in Settings, download your data (Settings → Privacy → Download my data), change cookie choices (Cookie settings) and delete your account (Settings → Danger zone). For anything else, email privacy@calendblade.com. We may need to verify your identity, and we respond within the legal deadlines (15 days for a complete access request under the LGPD; one month under the GDPR).

10. Complaints

Please contact us first so we can help. You also have the right to lodge a complaint with a supervisory authority: in Brazil, the Autoridade Nacional de Proteção de Dados (ANPD, www.gov.br/anpd); in the EEA, the data protection authority of your country of residence, work or the place of the alleged infringement; in the UK, the Information Commissioner's Office (ico.org.uk).

11. Security

Data is encrypted in transit with TLS. OAuth tokens are encrypted at rest and never sent to your browser. Access to production systems is restricted to the people who operate the service, and we would notify you and the competent authorities of a personal data breach where the law requires.

12. Children

Calendblade is intended for adults (18+). We do not knowingly process data of children or adolescents. If you believe a minor has created an account, contact privacy@calendblade.com and we will delete it.

13. Changes to this policy

We will publish any change on this page with a new date and, for material changes, notify you by email before they take effect. Where a change requires your consent, we will ask for it.