Your time
stays yours.

To make @cal work, we store the minimum data required:

• Account basics: your @handle, the email you signed up with, and the phone number you verified.
• Mutuals graph: who you've added as a mutual and who's added you. Used to scope discovery and free-now broadcasts.
• Free/busy intervals: opaque time blocks pulled from your connected calendar — start time, end time, and a busy/free flag. Nothing more.
• Events you create in @cal: the time, attendees, and confirmation status. Titles, locations, and notes are encrypted on your device with a key only you and the attendees hold.

By construction, we never see:

• Event titles, locations, descriptions, or attachments from any of your connected calendars.
• The names or emails of people you have on your other calendars (unless they're @cal mutuals).
• Your contacts list, photos, location history, or browsing activity.

The intersection of free time is the only computed signal that ever leaves your device for someone else to see.

• To find mutual time when you tap someone's @handle.
• To deliver invites via push or email, so the recipient can confirm in one tap.
• To send reminders for events you've already confirmed.
• To detect and prevent abuse — limit strangers to one request per week, suppress block attempts, and rate-limit obvious spam.

We don't use your data to train recommendation models, profile you for advertising, or build a public social graph of your relationships.

The only third parties we share data with are infrastructure providers that operate @cal — hosting, email/push delivery, error monitoring. Each is bound by a Data Processing Agreement that limits them to processing for @cal alone.

We don't sell your data. We don't share it with advertisers. We don't share it with your employer. If we ever change this, we'll require explicit opt-in and tell you well in advance.

Wherever you live, you can:

• Export a complete copy of your data in machine-readable JSON.
• Correct account information directly in Settings or by writing to hi@nirmaypanchal.com.
• Delete your account and all server-side data at any time.
• Object to any specific processing — ask us at the email above and we'll respond within 30 days.

GDPR and CCPA users have additional rights including portability and the right to lodge a complaint with a supervisory authority.

@cal isn't directed at children under 13 (under 16 in the EU). If we learn an account belongs to a child, we delete it.

If we make material changes, we'll email everyone with an account at least 30 days before the change takes effect. Minor edits (typos, clarifications) are reflected in the Last updated date at the top.

Privacy questions, data requests, or anything else — write to hi@nirmaypanchal.com. A real person reads every message and aims to reply within 3 business days.