1. Who are we?
1.1 We are [OPERATOR LEGAL NAME], the operator of "MyKalendo". For privacy queries, you can contact us at [CONTACT EMAIL OR CONTACT PAGE].
2. What's the purpose of this policy?
2.1 It tells you what to expect when we collect personal information from users of our website/services. Please read it before using our services.
2.2 Generally, the policy covers only information provided to us. It does not cover information you give to third parties, such as the sign-in providers listed in section 4.3 or other websites, which have their own privacy policies.
3. Might the policy change?
3.1 Yes. We will give you notice of the new version by posting it on our service and, where appropriate, by other means such as a message when you log in.
4. What do we collect?
4.1 Information that you upload to our service or otherwise give us, such as:
- your email address;
- your password, which is stored only in hashed form and never in plain text;
- the month your planner starts;
- your planner content: habit names and their order, repeat rules and colours, daily marks (OK / NOT OK), comments and numbers on days, day and week counters (start date and start value), and monthly tasks and notes.
4.2 Information we create when you use our service, such as:
- security information about your account (security stamps, the number of failed login attempts and any temporary lockout time);
- the sign-in providers you have connected to your account (the provider's name and your user id with that provider);
- encryption keys we use to protect the login cookie.
- when you agreed to our terms and this policy, whether you chose to receive tips and offers, when you last changed that choice and which of your channels they go to.
4.3 Information we receive from sign-in providers. If you choose "Continue with" Google, Microsoft, Facebook, GitHub, Discord, LinkedIn or Apple, that provider sends us your user id with that provider, your email address and whether that email address is verified. The provider may also send your name or other profile details in the sign-in response, but we do not store them.
4.4 [CONFIRM: Automated browsing information. Our service does not use analytics. If our hosting provider, web server or reverse proxy keeps technical logs, such as IP address, browser details and the date and time of requests, describe them here and in section 6.]
5. What's our reason/legal basis for collecting the information?
5.1 Because it's necessary to take steps at your request to enter into a contract with you, or to perform that contract. This covers your account information, sign-in information and planner content, which we need in order to provide our service to you.
5.2 Because it's in our "legitimate interests" to keep our service secure, to prevent fraud and misuse (for example by counting failed login attempts and locking accounts temporarily), to improve our service, to show anonymous totals on our home page, and to comply with the law.
5.3 Because you've specifically agreed on our service. We send occasional tips and offers (marketing messages) only if you tick the box when you sign up or switch it on in your Account settings. They go to the one channel you pick there: email, Telegram, browser push, ntfy, or a Discord, Slack, Microsoft Teams or Mattermost channel (messages in a shared channel can be seen by others in it). You can withdraw your consent at any time with the unsubscribe link in every message or the switch in your Account settings. This does not affect your reminders. We keep a record of when you agreed to our terms and this policy, and of when you gave or withdrew consent to tips and offers, for as long as you have an account.
5.4 Because it's necessary to comply with legal or regulatory obligations.
6. How long do we keep personal information?
6.1 We keep your information for as long as you have an account with us, subject to earlier or later deletion as set out below or in our terms and conditions.
6.2 If you use "Delete my account" on the Account page, your account and all your planner content are permanently deleted from our live database straight away. Copies in our backups are deleted within [BACKUP RETENTION PERIOD].
6.3 We may delete inactive accounts as set out in our terms and conditions.
6.4 [CONFIRM: retention period for any technical logs, if they exist.]
7. Who do we share it with?
7.1 To other people who supply us with services, e.g., website hosting ([HOSTING PROVIDER AND COUNTRY]).
7.2 To the sign-in provider you choose, only when you choose to sign in with it. This is necessary for the sign-in to work, and the provider's own privacy policy applies.
7.3 We do not share your personal information with other users of our service. Our home page may show anonymous totals (for example the number of accounts, accounts joined this week, days marked, counters and habits). These never identify you or show your individual planner content.
7.4 To regulators, the police and other law enforcement or official authorities to help deal with fraud and abuse, or where the law requires it.
7.5 To insurers and professional advisers in connection with our insurance cover or to deal with legal claims.
7.6 To (actual or potential) buyers so far as reasonably necessary in the case of a proposed or completed sale or merger of our business.
8. International transfers
8.1 [CONFIRM ONCE HOSTING IS KNOWN.] Your personal information is stored on servers located in [HOSTING COUNTRY]. If it is transferred to companies outside the UK, we rely on adequacy regulations (such as the UK-US Data Bridge, if applicable) or on contracts with standard contractual clauses sanctioned by the Information Commissioner, designed to provide adequate safeguards for your personal information.
8.2 Sign-in providers you choose to use may process your information outside the UK under their own privacy policies.
9. What are your rights?
9.1 If the legal requirements are met: to ask us for access to your personal information, to rectify it if there are mistakes, to delete it or restrict its use in certain circumstances, to "data portability" or to withdraw any consent you've given.
9.2 You may also have the right to object to use of your personal information in certain circumstances.
9.3 You can see and change your planner content at any time in the planner. On the Account page you can connect or remove sign-in providers, set or change your password, and permanently delete your account and all your planner content.
9.4 For any other request, including a copy of your information, please contact us at [CONTACT EMAIL OR CONTACT PAGE]. [CONFIRM: how data export / subject access requests will be handled.]
10. Complaints
10.1 If you have a concern about how we use your personal information, you can contact us at [CONTACT EMAIL OR CONTACT PAGE]. We will acknowledge your complaint within 30 days and investigate it promptly, responding without undue delay.
10.2 If you are unhappy with our response, you have the right to raise your complaint with the Information Commissioner's Office (www.ico.org.uk). We would, however, welcome the opportunity to resolve your concern directly before you do this.
11. Cookies
11.1 We use cookies and similar technologies on our website. Cookies are small text files placed on your device. Some are temporary "session" cookies that remain in the cookie file of your browser only until your browser is closed, whereas persistent cookies stay for longer (depending on the lifetime of the specific cookie). You can configure your browser to reject cookies, but this may limit our site's functionality. In particular, you will not be able to log in without the login cookie.
11.2 We ourselves place only the following cookies and storage. The cookies are needed for the service to work or to keep it secure. The local storage item only remembers a display choice you made. None of them is used for analytics, advertising or tracking.
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
| MyKalendo.Auth | Keeps you logged in and identifies you to the site. Not readable by scripts on the page (HttpOnly). | Strictly necessary, first party cookie | 30 days, renewed while you keep using the site |
| .AspNetCore.Antiforgery.[ID] | Security cookie that helps stop forged form submissions. | Strictly necessary, first party cookie | Session (until you close your browser) |
| .AspNetCore.Mvc.CookieTempDataProvider | Carries a one-off message from one page to the next, for example "Google is connected". | Strictly necessary, first party cookie | Session, removed once the message is shown |
| Identity.External | Holds the result of a "Continue with ..." sign-in until it is completed. | Strictly necessary, first party cookie | Short-lived, only during sign-in [CONFIRM LIFETIME] |
| .AspNetCore.Correlation.[ID] and .AspNetCore.OpenIdConnect.Nonce.[ID] | Protect a "Continue with ..." sign-in from tampering. | Strictly necessary, first party cookie | Short-lived, only during sign-in [CONFIRM LIFETIME] |
| planner-theme (browser local storage, not a cookie) | Remembers your light or dark display choice on that device. Never sent to our server. | Functional, stored only in your browser | Until you clear your browser's site data |
[CONFIRM: the exact cookie names above as they appear in the browser.]
11.3 We do not use analytics, advertising or tracking cookies, and our pages do not load third party scripts. If you choose to sign in with a sign-in provider, you will be taken to that provider's website, which may place its own cookies under its own cookie policy.
11.4 [CONFIRM WITH LAWYER: whether a cookie consent banner is needed. The cookies above are strictly necessary, and the planner-theme item only stores a choice you made yourself. If we add any other cookies in future, we will ask for your consent first where the law requires it.]
Information about us
[OPERATOR LEGAL NAME] [IF A COMPANY: Registered in England and Wales, number [COMPANY NUMBER].] Address: [ADDRESS] Contact: [CONTACT EMAIL OR CONTACT PAGE]