Privacy policy

Calmr is developed and operated in the United Kingdom by Jacob Oakley, who acts as the data controller for the personal data described in this policy and processes it in accordance with UK data protection law, including the UK GDPR and the Data Protection Act 2018.

When you create an account, we collect your name and email address, together with the password you choose for Calmr. The password is stored only as a salted one-way hash (PBKDF2-SHA256) and is never retained in a recoverable form. You may also add a profile photo.

Additionally, we store the content you create so that it is available on each of your devices: documents, chapters and images in Compose and the files you add to a document's Blueprint (images, audio, PDFs and text files), as well as tasks, thoughts in your mind dump, workbenches, pages, notes and the folders you sort them into, letters (their titles, the sender and recipient names and addresses, the sender's contact details, markings such as “Private & Confidential”, references, subject lines, text, the name and role you sign off with, people copied in, and enclosures), timelines, comparisons, calendar events (with their places, times and repeats), habits and their check-ins, weigh-ins, blood pressure readings, health conditions, your medication (with its schedule, stock and the doses you take), your height, your finances (banks, outgoings, income, money owed to you and debts, with their history) and your settings (including the sender address you save for your letters). To maintain your sign-in, we also hold a hash of each device's session token, together with its expiry date, and any password reset links you request.

Some of this information, such as weigh-ins, blood pressure readings, medication, habits and any other health-related records, may constitute health data, which is a special category of personal data under UK data protection law. We process it only where you choose to record it, and solely to display it to you. We also record the date you gave your consent. The measurements in your weigh-ins and blood pressure readings, your height and your BMI ranges are also encrypted at the column level in our database using AES-256-GCM, with the key held outside the database.

If you subscribe to Calmest, we also hold your Stripe customer reference, your plan (monthly or yearly), its status and its renewal date. Calmest is sold to you by Link, Stripe's consumer service, as the seller (merchant of record). You pay on Stripe's own checkout page, so your card details and billing address go to Stripe and Link and never reach Calmr. They use your address to work out any VAT or sales tax that applies, and keep it. Stripe sends us only the payment's outcome and the plan's status.

If Calmr fails or encounters an unexpected error, a technical error report is sent to our own error-tracking server. It contains the error message, where in the code it happened, your device or browser type and operating system, and your IP address. Reports never include your name, email address, content or health data, and personal details are removed before sending.

We use your information mainly to provide your account and to synchronise your content across your devices, as this is necessary to deliver the service you signed up for. Where that information includes health data, we instead rely on your explicit consent, which you give in a notice shown before you first log a weigh-in or blood pressure reading. You can withdraw it at any time on the Account page, which permanently deletes your weigh-ins, blood pressure readings, health conditions, medication and height.

We also rely on our legitimate interest in protecting your account and the service in order to keep Calmr secure. For this purpose, our security logs record sign-ins, failed sign-in attempts, lockouts, password resets, email address changes, account deletions and rate-limit events, together with your account ID and IP address. They never record your email address. To enforce limits on actions that could be abused, we also keep a count of recent attempts against a hash of your IP address, email address or account ID, deleted within an hour of the limit resetting. We use error reports for the same purpose, to identify and correct faults.

We use your email address only for messages relating to your account: a welcome message, a link to verify your email address, a link to confirm a new email address (which we keep until it is confirmed or the link expires an hour later), password resets, notices that your password or email address has changed, the copy of your data you ask for, a warning a week before an account unused for a year is deleted, confirmation of account deletion, and occasionally a message from us about your account. We do not send newsletters or marketing emails. If you subscribe, we use your plan details to give you Calmest and to show your subscription in Billing. We do not use your information for any other purpose: no AI reads, summarises or trains on your content, and we never sell your information or share it for marketing.

Calmr uses a small number of trusted service providers, each of which receives only the information it requires to provide its service. Cloudflare delivers traffic to Calmr, tells Calmr which country each visit comes from so that prices are shown with or without VAT (we don't keep it), and stores Compose images, profile photos and workbench images using Cloudflare R2. Postmark delivers account emails and therefore processes your name, email address and the content of those emails. Stripe runs the checkout page and the subscription for Calmest and therefore processes your email address, your payment details, your billing address and your billing history, and is responsible for the security of the payment page. If you buy Calmest from the link in Calmr's Android app, Google Play gives that link a reference, and for each payment we tell Google the reference, the price, the tax and your country, so that it can charge its fee; Google receives nothing else about you from us. Calmr's iPhone and Mac apps check which App Store country your Apple Account uses, on your device and without sending it to us, to decide whether to show that link. Link, Stripe's consumer service, sells you that subscription as its own controller: it handles the tax, receipts and any disputes, and its support may answer billing questions. OVHcloud provides the virtual private server (VPS) on which the Calmr application server and its PostgreSQL database are self-hosted, in its London, United Kingdom data centre. It acts as our infrastructure processor, and the encryption keys for your health data are not held by OVHcloud. Proton's VPN carries the server's connections to the addresses you choose (your mail servers, calendar links, and pictures in the emails you open), so that those servers never learn the server's own address. Zoho Mail refuses connections from VPNs, so a Zoho mailbox is reached directly. These connections are encrypted with TLS, so Proton sees which server is being reached but not what is sent.

Error reports and our server logs are received by GlitchTip and OpenObserve servers that we host ourselves. No third party receives them.

Where any of these providers processes data outside the UK, the transfer is protected by UK adequacy regulations or the UK's approved international data transfer safeguards.

If you connect an email account, Calmr stores its server settings, its password or, if you sign in with Microsoft, the sign-in token Microsoft gives us, and any other addresses you tell us it can send as (encrypted with AES-256-GCM, with the key held outside the database), and nothing else about it. With Microsoft you sign in on Microsoft's own page, so we never see your Microsoft password, and you can withdraw Calmr's access in your Microsoft account at any time. Your messages stay with your mail provider, which remains the controller of the mail itself. Our server fetches them from your provider each time you open them and does not store them. While it does so, it holds them in memory for the length of the request, so it briefly handles the personal data of the people who wrote to you. It does not read them for any other purpose. When you reply to or forward a message, Calmr sends it through your provider's outgoing server, from your own address or one of those you added, and puts a copy in your Sent folder there. The recipients you type, including Bcc, and any files you attach go to your provider and are not kept by us.

For speed and offline use, the app keeps on your device the newest 50 message headers (sender, subject and date) of each folder you open, and the 30 messages you opened most recently, including their text. This is part of the offline copy described under "Data stored on your device", with the same protection and removal.

Message HTML is cleaned on our server and shown in an isolated frame with no scripts. Its fonts, colours and layout are kept, but anything that would load from the web is removed. Images hosted by the sender are held back until you ask for them, because loading one tells the sender that you opened the message and can reveal your IP address. You can load them for one message, or for all messages with the "Load images in email" setting.

Where a sender has a public Gravatar photo, Calmr shows it beside their messages. Our server asks Gravatar for it using a one-way hash of the sender's address, so neither your address nor your device reaches Gravatar and the address itself is not sent. Gravatar uses that request for its own service, as its own controller, and not on our behalf.

For a message your mail provider has recorded as passing the sender's DMARC check, Calmr may also show the sender's own logo. Our server searches the sender's domain for its DNS records, the logo it publishes under BIMI and, if there is none, the touch icon on its website. The sender's host sees a request from our server, not from you, and the request names only the domain, not you or the message. Domains of mailbox providers such as Gmail or Outlook are skipped. We keep what we find for up to 24 hours in server memory, and do not store it.

Your mail is not included in the copy of your data you can email yourself, because we do not hold it. Removing a connected account, or deleting your Calmr account, deletes its settings and its password or sign-in token immediately. Mail on your provider is not affected, and the copy on your device is removed as described above.

If you add an external calendar by its link, Calmr stores the link (encrypted with AES-256-GCM, with the key held outside the database) and fetches it from our server to show its events beside your own. For each event we keep its title, place and times, so they remain available offline. Events the calendar has dropped stay in your history. The calendar's host sees a request from our server, not from you. Removing the calendar deletes its link and events.

Events from a calendar you subscribe to may include other people's names or details. We store them only to show them to you.

The app stores a copy of your data on your device so that it remains available offline. This copy is removed when you sign out, when your session ends, when you delete your account, or after 30 days without opening the app. On phones, tablets and Macs, it is encrypted with a key held in the system Keychain or Keystore. In a browser, it is protected only by the security your browser provides for site storage, so anyone using the same browser profile on a shared computer could access it. The next section describes everything Calmr stores in your browser.

Calmr sets a single cookie, calmr_session, which holds your sign-in session so that Calmr can identify you. It is sent only to Calmr, cannot be read by the page's scripts or used by other websites, and is removed when you sign out. Calmr does not use analytics or tracking cookies of any kind, and therefore does not display a cookie banner.

Calmr also uses your browser's storage (local storage and IndexedDB) for the following items, which are necessary for it to function. They remain on your device and are never sent to Calmr:

Your browser's session storage (which is cleared when you close the tab) also holds one item, calmr-tab-view, which remembers which view you had open so a reload returns you to it. These items are strictly necessary for the features you use, so they do not require consent. The app on iPhone, iPad and Mac works in the same way: it holds this information in its own storage and your session in the system Keychain.

Cloudflare, which delivers traffic to Calmr, may set a strictly necessary cookie (__cf_bm, which lasts 30 minutes) to distinguish people from automated bots and to protect the service. This cookie is not used to track you.

Signing out removes your session cookie, account details and offline copy. Any other stored data can be cleared in your browser's settings for this site, although you will then need to sign in again.

We hold your data for as long as you have an account. When you delete your account, your Stripe customer record is also deleted, which cancels any subscription immediately, although Stripe may keep payment records for as long as the law requires. Items you delete, such as tasks or documents, go to the Bin and are deleted permanently after 30 days, or sooner if you empty the Bin. If you do not open Calmr for a year, we email you a week before deleting the account, and then delete it as described above. When you delete your account, your data is removed from our database immediately and your images are deleted from storage shortly afterwards. Sign-in records are retained for a shorter period: sessions expire 90 days after they were last used, and each password reset link can be used only once, within one hour of being sent. Counts of recent attempts are deleted within an hour of their limit resetting, and no limit lasts longer than a day. Server logs, security logs and error reports are kept for 90 days and then deleted.

We disclose personal data to a law enforcement agency, court or other public authority only where we are legally compelled to do so, for example by a court order, warrant or other valid legal process under the law of England and Wales. Where practicable, we may also disclose the minimum necessary data without legal process where there is an imminent threat to someone's safety, to preserve life and limb, or otherwise to protect their vital interests. We review each request for its validity and scope, disclose no more than it requires, and do not respond to informal or unsubstantiated requests.

Your weigh-ins, blood pressure readings, health conditions, the names, strengths and notes of your medication, height and BMI ranges, and the names, amounts, notes and reasons in your finances, are stored in the database as AES-256-GCM ciphertext, and the key is held outside the database. A copy of the database or of a backup is therefore unreadable without that key, and the data in those fields cannot be produced from it. Other content, such as documents, is not encrypted in this way.

Unless we are prohibited by law or by the terms of the request, or doing so would create a risk of harm, we will notify you before disclosing your data so that you can object. We do not provide any authority with routine or bulk access to Calmr. Requests should be sent to [email protected].

You have the right to access, update, delete or receive a copy of your personal data, to object to or restrict its processing, and to withdraw your consent at any time. You can exercise most of these rights yourself on the Account page, where you can update your details or delete your account, with the option to email yourself a copy of all your data beforehand.

To exercise any other right, please contact us at [email protected]. If you are dissatisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office, the UK supervisory authority, although we would welcome the opportunity to resolve your concern first.

Calmr is not intended for children under 13, and we do not knowingly collect their personal data.

We may update this policy from time to time. The date at the top of this page shows when it was last revised. If we make significant changes, we will notify you by email before they take effect.

If you have any questions, please contact us at [email protected].