Privacy Policy

Last updated: 10 April 2026

1. Who we are

Caldzy ("we", "our", "us") is an iOS application that syncs external calendar feeds to Apple iCloud Calendar. Our registered contact email is [email protected].

2. Information we collect

2a. Account information

When you create an account we collect your email address and a hashed password via Supabase Auth.

2b. iCloud credentials

To write events to your iCloud Calendar, we require your Apple ID email and an app-specific password you generate at appleid.apple.com. These credentials are encrypted at rest using Supabase Vault (AES-256) and are used only to authenticate CalDAV requests on your behalf. They are never shared with third parties.

2c. Calendar feed URLs

We store the ICS/webcal URLs you add so we can poll them on your schedule. The calendar event data fetched from these URLs is processed server-side and written to your iCloud Calendar; we do not retain a long-term copy of event content.

2d. Usage data

We collect minimal operational data: sync timestamps, error messages, and event counts. We do not use advertising SDKs or analytics platforms.

3. How we use your information

• To provide and maintain the calendar sync service.
• To send you notifications about sync errors or event changes (push notifications you may opt out of in iOS Settings).
• To diagnose and fix technical problems.

4. Data sharing

We do not sell, rent, or share your personal data with third parties for marketing purposes. We use Supabase (supabase.com) as our backend database and Deno Edge Functions host. Supabase processes data under their own privacy policy. No other third-party processors have access to your data.

5. Data retention

We retain your account data as long as your account is active. You may delete your account at any time from Settings → Account → Delete Account, which permanently removes all stored data including iCloud credentials within 30 days.

6. Security

iCloud credentials are encrypted using AES-256 via Supabase Vault. All data in transit uses TLS 1.2 or higher. We follow the principle of least privilege for all internal service accounts.

7. Children's privacy

Caldzy is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us personal data, contact us at [email protected] and we will delete it promptly.

8. Your rights

Depending on your jurisdiction, you may have rights to access, correct, or delete your personal data. To exercise these rights, email [email protected].

9. Changes to this policy

We will post any material changes on this page with an updated date. Continued use of the app after changes constitutes acceptance of the updated policy.

10. Contact

Questions? Email us at [email protected].