Privacy-first planning: what stays on the device
Guest data stays on the device until a claim succeeds. Signed-in users can wipe memory and recordings — and we do not sell your data.
A useful calendar is also a sensitive one. Guest data stays on this device until a claim succeeds. After you sign in, privacy controls let you wipe memory and recordings. Wipe removes those records; it is not a status flag you have to trust.
Memory facts are a paid capability. Pro and Premium can save facts up to the plan cap. Free has a cap of zero, so the first write is rejected. We do not sell your data, and we do not offer family sharing or household seats — each account is individual.
A few planning habits that keep the product honest:
- Stay a guest while you are only trying the calendar. Promote to an account when you want the same data on the server.
- Turn on calendar sync only if you want Google, Apple, or Outlook as a source of truth. Connecting Apple and running a manual sync require Pro or Premium. Listing and disconnecting accounts stay available to any signed-in user.
- Use booking links when someone else should pick a slot. The public page does not require a sign-in. Creating and editing links requires Pro or Premium.
- Review memory before a wipe. Export is the copy you keep; wipe is the delete.
Privacy here is a set of controls you can use, not a slogan. If a feature is not in the app, we do not write it into the plan.