Privacy policy

Who this is about

This page covers CalFree, which runs CalFree at calfree.dev. It describes what CalFree stores and how we handle it.

Questions, or a request about your data: [email protected].

Hosts: what we store about you

• Your account. Email address, name, chosen username, time zone, and your display preferences (12- or 24-hour clock, which day your week starts). Your email is how you sign in.
• Your page. A welcome message, and a profile photo and logo if you upload them.
• Your scheduling setup. Event types, questions, weekly hours and date overrides.
• Calendar and meeting connections. If you connect Google, Outlook or Zoom, a refresh token encrypted at rest with AES-256-GCM, the account’s email address, and your choices about which account checks conflicts and which receives bookings. Busy times read from your calendar are cached for sixty seconds and never stored in the database.
• Your plan. If you subscribe to Pro or Teams: the plan, billing interval, number of seats, status and renewal date, and the identifiers our payment provider gives your subscription. Your card details go to the provider and never reach us.
• Account activity. A log you can read in Settings of the changes made on your account (event types, availability, keys, connections, teams, plans and so on) and of bookings made, moved or cancelled, each with the time and, for sensitive changes such as keys and connections, the kind of browser it came from. No IP address is kept in it, and it never holds a key or a password.
• Teams, polls and routing forms. The members and pending invitations of a team (names and email addresses), the polls you create, and the routing forms you build.
• Webhooks. The address you want messages sent to, a signing secret, and a log of recent deliveries and their results.
• API keys. A name, the first few characters so you can tell keys apart, and a SHA-256 hash of the key. The key itself is shown once at creation and never stored, which is why we cannot show it to you again.
• Sessions. A signed session cookie, and sign-in tokens that expire.

Invitees: what we store about them

When someone books a meeting with you, CalFree stores their name, email address, time zone, the chosen time and their answers to your questions. It also stores:

• A hash of the token in their reschedule and cancel links, so those links work without an account.
• Which channel created the booking — the page, the REST API or an agent over MCP — and, if one was used, an idempotency key.
• A cancellation reason and who cancelled, when a meeting is cancelled.
• Your private notes on the booking. These are never shown to the invitee and never appear in email.

If you use other features, CalFree also stores:

• For a meeting poll, the name and email address of each person who votes, and the times they chose.
• For a routing form, the answers someone gave and where they were sent.

As the host, you decide what to ask. Questions are yours to write, so please don’t ask invitees for more than the meeting needs — particularly anything sensitive, like health information.

Why we store it

To run the service you asked for: showing the right open times, creating meetings, sending confirmations, reminders, reschedule and cancellation notices, and keeping your calendar in step. Where this is governed by the GDPR, the basis is performance of a contract for hosts, and for invitees the legitimate interest of arranging the meeting they requested.

We also keep a record of each email sent about a booking so that a reminder is not sent twice and a failed send can be retried.

Who else sees it

Only the services needed to deliver a booking, each doing one job:

• DigitalOcean hosts the application, its Postgres database and its Redis cache on servers in Bangalore, India.
• Resend sends sign-in links, confirmations and reminders. Recipient addresses and message contents pass through it.
• DigitalOcean Spaces stores nightly database backups, outside India, encrypted before they leave our server so it cannot read them.
• Cloudflare also sits in front of the site, filters bots and attacks, and runs a bot check (Turnstile) on sign-in and on forms anyone can fill in. Traffic passes through it, so it sees your IP address and browser details.
• Better Stack checks that the service is up and shows an incident notice on our public pages while there is one. Your browser contacts it when those pages load, so it sees your IP address and browser details, but no booking or account data.
• Dodo Payments sells and bills Pro and Teams as merchant of record, and holds your card details and invoices.
• Sentry receives a report when something on our server fails: the kind of error, where in the code it happened and which page it was on, with email addresses and keys removed. It gets no booking answers, no request contents and no account details.
• Google and Microsoft, only if you choose to sign in with them: they tell CalFree your name and email address, and nothing else.
• Google, Microsoft and Zoom, only if you connect them: booking times, titles, the invitee’s email and any meeting link are written to your calendar or meeting account.

The DPA lists these as sub-processors. Because they are in different countries, your data may be processed outside your own. Nothing is sold, shared with advertisers or used to train anything.

How long we keep it

• Your account and its bookings: until you delete the account.
• Account activity: 90 days.
• Backups: nightly backups are kept for 30 days, and one a month for about 13 months. Data you delete leaves them as they expire.
• Past bookings: kept so you both have a record of what happened and when.
• Idempotency keys: 24 hours, after which a key can be reused.
• Sign-in and verification codes: minutes. A verification code lasts ten.
• Cached calendar busy times: sixty seconds.

Your rights, and the buttons that honour them

Rather than ask you to write in and wait, the rights that can be automated are built into the app, under Settings → Your data:

• Export everything. A JSON file of your account, event types, availability, bookings and the metadata about your API keys. Secrets are deliberately excluded — no key hashes and no calendar tokens — because an export file ends up in places nobody controls.
• Delete your account. Confirm with your email address and CalFree stops any plan you pay for from renewing, cancels your upcoming meetings so invitees are told and their calendar events removed, revokes calendar access at Google rather than merely forgetting the token, deletes email records and stored API responses, and then deletes the account with everything attached to it. Dodo Payments keeps its own records of past payments and invoices, as the law requires of it.

Deletion is immediate and cannot be undone. If you are an invitee rather than a host and want your data removed, the host can delete the booking; you can also write to [email protected].

Security

• Calendar refresh tokens are encrypted with AES-256-GCM before being stored.
• API keys and the tokens behind reschedule links are stored only as SHA-256 hashes.
• Sessions are signed, and uploads and exports are protected against cross-site requests.
• Responses carry nosniff, strict-origin-when-cross-origin, SAMEORIGIN framing, a permissions policy denying camera, microphone, geolocation, payment and USB, and HSTS in production.
• Rate limits cap booking attempts and API calls, so a scraper cannot enumerate your calendar.

No system is perfect. If you find a security problem, please write to [email protected].

Cookies and tracking

There is no analytics, advertising or tracking script on any CalFree page. The cookies that exist are functional: a signed session cookie once you sign in, and a short-lived cookie during the sign-in exchange. Your theme and sidebar preferences are kept in your browser’s local storage and never sent to us.

Children

CalFree is not directed at children, and accounts are not intended for anyone under 16.

Changes

If this policy changes in a way that affects you, the date at the top changes and hosts are told by email before it takes effect.