Terms & Privacy
Privacy Policy
The short version
- CalmList works without an account. Then your tasks never leave your browser.
- With an account, your tasks are stored so they sync between your devices, and nobody else can read them.
- No analytics, no ads, no tracking, no cookies beyond what signing in needs, and nothing is sold.
- AI features, AI assistant connections and Google Calendar are off until you turn them on.
Who is responsible
The controller under the EU and UK General Data Protection Regulation (GDPR) is Jonah Chang, who operates this site. Contact for questions and requests about your data: github.com/corund207/CalmList/issues.
What we process, why, and on what legal basis
- Account (email, name, hashed password; Supabase keeps sign-in times): to give you an account. Basis: contract, Art. 6(1)(b).
- Your content (tasks, projects, sections, labels, filters, comments, completion history): to store and sync it. Basis: contract, Art. 6(1)(b).
- Consent record (terms version, when you accepted, that you confirmed you are 16 or older): to show what you agreed to. Basis: legal obligation and legitimate interest, Art. 6(1)(c) and (f).
- AI assistant tokens (a name, a hash of the token, its last four characters, your timezone, when it was last used): so assistants you connect can reach your tasks. Basis: contract, Art. 6(1)(b).
- Security logs (IP address, time, request path) kept briefly by our hosting providers: to keep the service secure and working. Basis: legitimate interest, Art. 6(1)(f).
- Service statistics (uptime checks and counts such as total and active accounts, with no one identified): to publish the service's health. Basis: legitimate interest, Art. 6(1)(f).
We do not make decisions about you by automated means (Art. 22), and we don't use your data for advertising, profiling or training AI models.
Features you switch on
- On-device AI. Built-in rules keep everything local. The in-browser model and on-device speech recognition download once from Hugging Face, GitHub and jsDelivr, which see your IP address; after that your text never leaves the device. Ollama or your own server receives text only at the address you enter.
- Cloud AI (Claude, ChatGPT, Gemini, Grok). Only after you agree, and only the text of the feature you use, goes straight from your browser to that provider under its terms, with your own key. Your keys stay in your browser. Basis: consent, Art. 6(1)(a), which you can withdraw in Settings → AI.
- AI assistant connections (MCP). An assistant you connect (for example Claude or ChatGPT) can read and change your tasks through your token. What you say to that assistant is handled by its provider under its own privacy policy. Tasks an assistant adds are marked as AI-made, in line with the transparency duties of the EU AI Act. Revoke a token at any time in Settings → Integrations.
- Google Calendar. When you connect, your browser gets short-lived access limited to calendars CalmList creates. It makes one calendar named “CalmList” and copies in open tasks that have a date or time (title, notes, date, repeat rule, link). We store no Google token, and your other calendars are never read. Disconnecting removes the CalmList calendar. CalmList's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Storage on your device (cookies)
CalmList uses your browser's local storage for your tasks, settings and sign-in session. This is strictly necessary for features you ask for, so under the ePrivacy Directive (Art. 5(3)) it needs no consent banner. There are no tracking or advertising cookies. Google sets its own cookies in its sign-in window only if you connect Google Calendar.
Who receives data
- Supabase, Inc.: database, sign-in and account emails (processor).
- Vercel Inc. and GitHub, Inc.: serve the website, the app and the AI-assistant endpoint (processors).
- Providers you choose yourself: AI providers, Google, and model hosts, as described above.
Nobody else, unless the law requires it.
International transfers
These providers may process data in the United States. Transfers rely on the European Commission's Standard Contractual Clauses in each provider's data processing agreement and, where the provider is certified, the EU–US Data Privacy Framework.
How long we keep it
- Account and content: until you delete your account. Deletion is immediate; provider backups roll over within their retention window.
- Deleted items: kept as empty markers so your other devices learn about the deletion, and removed with your account.
- Uptime checks: 90 days. Hosting logs: as briefly as each provider allows.
Your rights
- Access and portability (Art. 15, 20): Settings → Data & Privacy → Export JSON gives you everything in a machine-readable format.
- Correction (Art. 16): edit your tasks anywhere; change your name and password in Settings → Account & Sync.
- Erasure (Art. 17): Settings → Account & Sync → Delete Account removes your account, content and tokens at once.
- Restriction and objection (Art. 18, 21), and withdrawing consent (Art. 7(3)) at any time, without affecting what happened before.
- Complaint (Art. 77): you can complain to the data protection authority where you live or work.
We answer requests within one month.
Security
Everything travels over HTTPS. Row-level security in the database keeps each account's data apart, and automated tests check that one account can never read or change another's. Passwords are hashed by Supabase, and assistant tokens are stored only as hashes. If a breach puts your data at risk, we will notify the supervisory authority within 72 hours and tell you without undue delay.
Children
Accounts are for people aged 16 or older.
Changes
If this policy changes materially, the version date above changes and the change is recorded in the project's history on GitHub.
Terms
The service
CalmList is free, open-source software under the MIT License. The hosted sync service is free, provided as-is, without guaranteed uptime, and may change or end. If it ends, you'll have at least 30 days to export your data. Keep your own exports of anything important.
Your account
You must be 16 or older and give a working email address. Keep your password and assistant tokens safe: you are responsible for what happens under your account. Your content stays yours; you let us store and transmit it only to provide the service to you.
Fair use
Don't use the service to break the law, store content you have no right to, attack or overload the service, or try to get at other people's data. Accounts that do may be suspended or removed, with notice where possible.
AI output
AI features and connected assistants can be wrong. Check what they suggest before relying on it.
Liability
To the extent the law allows, we are not liable for lost data, lost profits or indirect damages from using CalmList. Nothing here limits liability for intent or gross negligence, or rights you have under consumer law that cannot be waived.
Open-source licenses
CalmList is MIT licensed. The components it ships with and their licenses are listed in licenses.txt.
Changes and contact
Material changes update the version date above. You can stop using the service and delete your account at any time. Questions: GitHub issues.