Who we are
Caloday (“we”, “us”) runs the booking service at caloday.com. This policy explains what we collect, why, who else handles it, and what you can do about it.
Questions or requests: c@caloday.com.
What we collect
If you have an account (a host)
- Account: your email address and a password. We never see or keep your password in readable form; our sign-in provider stores a scrambled version of it.
- Google Calendar (only if you connect it): Google tells us when you are busy on your primary calendar, and which Google account it is. If you allow it, Caloday also adds each booking to your primary calendar as an event (the guest’s name and email, the time, any note they left, and your meeting link) and removes that event if you cancel the booking. We only ever create and delete events we made ourselves. We never read the titles, attendees or details of your other events. We keep a token that lets us keep asking Google, and you can remove it any time by disconnecting in Settings. See “Google user data” below.
- Sign in with Google: if you choose it, Google shares your name, email address and profile picture link with us. We ask Google for nothing else at sign-in. We don’t access your Google contacts, calendar or any other Google data unless you connect your calendar as described above.
- Page settings: your name, booking link, bio, brand color, meeting type, meeting link, working days and hours, appointment length, buffer, timezone, and whether the Caloday badge is hidden.
- Routines: the title, icon, time, length and days of each routine you protect.
- Bookings: for each booking, the guest’s name and email, an optional note, the date, time and length, and whether it is confirmed or cancelled.
If you book with someone (a guest)
The name and email you enter, an optional note, and the time you pick. You don’t need an account.
If you join the Pro waitlist
Your email address.
Automatically
Our hosting and database providers keep technical logs (such as your IP address, browser type, the page requested and the time) for security and troubleshooting. Your browser also stores a sign-in session and small preferences, like your theme, on your own device. We don’t use advertising or analytics cookies.
We also count visits to our public pages, and a few actions such as signing up or making a booking, with Plausible Analytics. It sets no cookies and doesn’t store your IP address. It keeps only rough details, such as your country, browser and device type, and can’t link your visits across days, devices or sites. For a booking page we don’t tell it whose page it was, and we send it nothing like a name or an email address. Page views inside a host’s dashboard are not counted.
How we use it
- To run Caloday: create your account, show your page, work out which times are free, record bookings and send the emails about them.
- To keep it safe and working: prevent abuse and double bookings, find and fix bugs.
- To understand how people find and use Caloday, from anonymous visit counts.
- To contact you about your account, and about Pro if you joined the waitlist.
We don’t sell your data, rent it out, or use it for advertising.
If you are in a place with data protection law (such as the EU or UK), our reasons are: running the service you asked for, our legitimate interest in keeping it secure and working and in understanding how it is used, and your consent where we ask for it (the waitlist).
What other people can see
Anyone with your booking link can see your name, bio, brand color, meeting type, the days and hours you offer, your timezone, and which times are open. Your routines appear to guests only as “Protected time”. Their titles and details are readable by you alone.
Your meeting link is private to you. Only you can read it in Caloday, and a guest receives it when they book with you, on their confirmation screen and in their confirmation email. Use a link you are comfortable giving to the people who book you.
A guest’s name, email and note go to the host they book. Bookings are readable only by that host. Hosts are expected to use guest details only to arrange and run the meeting.
If you connect Google Calendar, a guest’s page hides the times you are busy. Guests see only that those times are unavailable, never why.
If you let Caloday add bookings to your Google Calendar, each event holds the guest’s name, email, note and your meeting link. It lives in your own calendar, so anyone you have shared that calendar with can see it.
We send a confirmation email to the guest and a notification to the host when a booking is made.
Who else handles your data
We use a few providers to run Caloday. They handle data for us under their own terms and privacy policies:
- Supabase: our database and sign-in.
- Vercel: hosting the website.
- Resend: sending email (sign-up and password emails, booking confirmations).
- Plausible Analytics: counting visits to our public pages and a few actions, without cookies. It is hosted in the EU.
- Google: sign-in with Google and Google Calendar, if you use them. The site’s font is also loaded from Google Fonts, so Google receives your IP address and browser details when a page loads.
These providers may process data in countries other than yours. We don’t share your data with anyone else, except where the law requires it.
Google user data
If you connect Google Calendar, Caloday asks Google for three things, and nothing else:
- When you are busy on your primary calendar (the calendar.freebusy permission). The answer holds no titles or details. It is cut down to the days and hours you offer and reused for about a minute, so a busy booking page does not ask Google on every view. Old copies are deleted when you disconnect or delete your account.
- Permission to add and remove the events Caloday makes for your bookings (the calendar.events.owned permission), only if you allow it. When a guest books, Caloday creates one event on your primary calendar. When you cancel that booking, it deletes that event. It does not list, read or change any other event, and it does not invite the guest, so Google sends no emails.
- Which Google account it is (your email address), so Settings can say who is connected.
We use this only to hide your busy times from your booking page and to put your bookings in your calendar. We do not use it for advertising, we do not sell it or give it to anyone else, and people at Caloday do not read it unless you ask us to, to investigate abuse, or where the law requires.
The token that lets us keep asking Google is kept in a database table that no signed-in user and no visitor can read, not even you. You can disconnect in Settings at any time, which tells Google to stop sharing and deletes the token, the cached busy times and our record of the events we added. You can also remove Caloday’s access in your Google Account settings.
Caloday’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How long we keep it
- Your account, page settings, routines and bookings stay until you delete them or your account. A cancelled booking stays on record, marked cancelled.
- Waitlist emails stay until Pro launches or you ask us to remove yours.
- A Google Calendar connection stays until you disconnect it or delete your account. Disconnecting also tells Google to stop sharing, and removes the saved token, the short-lived copy of your busy times and our record of which bookings we added to your calendar. Events already in your calendar stay there, and you can delete them in Google Calendar.
- Technical logs are kept by our providers for limited periods under their own policies.
- Deleted data can remain in our providers’ backups for a while before it is cleared.
Your choices and rights
You can edit your page settings, delete routines and cancel bookings yourself in Caloday.
There is no delete-account button yet. To delete your account, or to get a copy of your data, email c@caloday.com from the address on your account. We will act within 30 days.
Depending on where you live, you may also have the right to access, correct, delete, restrict or move your data, to object to how we use it, to withdraw consent, and to complain to your data protection authority. Email us and we will help. If you are a guest, you can ask the host or us to delete your booking details.
Security
Caloday is served over HTTPS. Database rules mean only the owner can read their routines and bookings. No service is perfectly secure; if something goes wrong that affects you, we will tell you.
Children
Caloday is not for children under 16, and we don’t knowingly collect their data. If you think a child has signed up, email us and we will delete the account.
Changes to this policy
If we change this policy, we will post the new version here and update the date at the top.