Privacy Policy

1. Introduction and Scope

CoupleCal Inc. ("CoupleCal," "we," "us," or "our"), a company incorporated in the State of Delaware, United States, with its principal place of business at 548 Market Street, Suite 300, San Francisco, CA 94104, operates the CoupleCal mobile application and website at couplecal.com (collectively, the "Service").

The Service includes our mobile application (CoupleCal for Android and iOS) and our website (couplecal.com). Some features and the device or browser capabilities we use differ by platform; those are described in Section 3.4 below.

This Privacy Policy applies to all users of the Service worldwide and describes how we collect, use, disclose, retain, and safeguard your personal information. It has been prepared in compliance with:

• United States: California Consumer Privacy Act (CCPA/CPRA), Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA)
• European Union / EEA: General Data Protection Regulation (GDPR — Regulation (EU) 2016/679)
• United Kingdom: UK GDPR and Data Protection Act 2018
• Canada: Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation
• Brazil: Lei Geral de Proteção de Dados (LGPD — Law No. 13.709/2018)
• Australia: Privacy Act 1988 and Australian Privacy Principles (APPs)
• South Africa: Protection of Personal Information Act (POPIA)
• India: Digital Personal Data Protection Act 2023 (DPDPA)

For users in the EU/EEA, CoupleCal Inc. acts as the data controller of your personal data. Our Data Protection Officer can be reached at dpo@couplecal.com.

2. Legal Bases for Processing (GDPR Article 6)

We process your personal data only when we have a valid legal basis to do so:

• Contractual Necessity (Art. 6(1)(b)): Processing required to provide the Service you have requested — e.g., creating your account, managing your calendar, syncing events
• Legitimate Interest (Art. 6(1)(f)): Processing for our legitimate business interests where these are not overridden by your fundamental rights — e.g., product improvement, fraud prevention, security
• Consent (Art. 6(1)(a)): Where you have given explicit consent — e.g., marketing communications, optional analytics, location-based smart reminders
• Legal Obligation (Art. 6(1)(c)): Processing required to comply with applicable laws — e.g., tax reporting, responding to lawful government requests

You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal. To withdraw consent, visit Settings > Privacy in the app or email privacy@couplecal.com.

3. Information We Collect

3.1 Information You Provide Directly

• Account Information: Name, email address, username, password (stored securely using one-way hashing), profile photo (optional), phone number (optional)
• Authentication Data: Google account identifier (if using Google Sign-In), Apple ID identifier (if using Sign in with Apple)
• Calendar Content: Events (titles, dates, times, locations, descriptions, attendees, recurrence rules, reminders), tasks (titles, descriptions, due dates, priorities, assignments, status), and any notes or attachments you create
• Family Group Data: Family group name, member invitations, role assignments (admin or member), shared calendar entries, task assignments between family members
• User Preferences: Timezone, date format preference, time format preference (12-hour or 24-hour), theme preference (light or dark mode), notification preferences, reminder settings
• Communications: Messages you send to our support team, feedback, and survey responses
• Payment Information: If you subscribe to a paid plan, payment is processed by the respective app store (Google Play or Apple App Store) or by Stripe for web payments. We do not store your full credit card number, CVV, or bank account details. We receive only a transaction identifier, subscription status, plan type, and billing period

3.2 Information Collected Automatically

• Device Information: Device type, device manufacturer, operating system and version, app version, unique device identifiers, screen resolution
• Network Information: IP address, general geolocation (city-level, derived from IP), internet service provider
• Usage Data: Feature usage patterns, session duration, screens viewed, interaction events, crash reports, and diagnostic logs. On the mobile app, we use Firebase Analytics for aggregated usage insights and Firebase Crashlytics for crash reporting; see Section 3.4.1 and Section 12
• Push Notification Tokens (mobile): Device tokens for delivering notifications (you may opt out via device settings)
• Log Data: Server logs that record requests made to our API, including timestamps, request paths, response codes, and associated user identifiers. These logs are used for debugging, security monitoring, and performance analysis

3.3 Information from Third-Party Services

• Google Calendar: Calendar events, titles, times, locations, and attendee data (only when you enable two-way sync). See Section 12.1 for Google API Services compliance
• Voice Processing (EURI API): When you use the Voice Assistant, audio is sent to the EURI API for real-time transcription and intent extraction. Audio data is processed in a single request and is not stored on our servers or retained beyond the processing request. No background recording occurs
• Image & PDF Processing (EURI Vision API): When you use the Image-to-Calendar feature, images or PDF documents are sent to the EURI Vision API for event extraction. Image data is processed in a single request and is not stored on our servers after processing. Images are not used to train AI models
• AI-Powered Insights (EURI API): Calendar event data may be processed through the EURI API to generate scheduling insights and suggestions. Only event metadata (titles, times, categories) is shared — no personal files or media
• Smart Home Platforms: If you link your CoupleCal account with Amazon Alexa or Google Home (see Section 3.6), we receive your platform-specific user identifier and process voice commands relayed by those platforms. We do not receive or store raw audio from these platforms — only the transcribed text command and associated intent data

3.4 Device and Browser Capabilities by Platform

CoupleCal uses different device and browser capabilities depending on whether you use our mobile app or our website. Each capability is used only when you use the related feature and can be managed via your device or browser settings.

3.4.1 Mobile App (Android & iOS)

The CoupleCal mobile app may request the following permissions. You can grant or revoke them at any time in your device Settings.

The mobile app uses Firebase Analytics and Firebase Crashlytics to understand usage and fix crashes. Analytics data is aggregated and used to improve the product; you can control analytics preferences in your device and app settings where available. Firebase Crashlytics automatically collects crash reports including device state, stack traces, and the app version at the time of the crash to help us identify and fix issues.

Important (mobile): We access the camera only when you choose to scan a schedule; the microphone only when you press and hold the voice record button; and location only if you enable location-based reminders. No background recording, image capture, or location tracking occurs without your active, in-app use of the related feature.

3.4.2 Website (couplecal.com)

When you use CoupleCal in a browser, we use the following capabilities. The browser will prompt you when a feature first needs access (e.g., microphone).

Important (website): The website does not access your device camera or microphone except when you use the Voice Assistant (microphone only). Image and PDF processing is limited to files you explicitly select or upload. No background audio or video capture occurs.

3.5 Sensitive Data

We do not intentionally collect or process sensitive personal data (also known as "special category data" under GDPR Art. 9) such as racial or ethnic origin, political opinions, religious beliefs, health data, sexual orientation, or biometric data. If calendar events you create incidentally contain such information, it is encrypted and processed only to provide the Service.

3.6 Smart Home and Voice Assistant Integrations

CoupleCal offers optional integrations with third-party smart home platforms. These integrations allow you to manage your calendar using voice commands through compatible devices.

• Amazon Alexa: When you enable the CoupleCal Alexa skill and link your account, Alexa sends transcribed voice commands to our servers via a secure webhook. We receive and process the text of your command (e.g., "What's on my schedule today?"), your Alexa user identifier (for account linking), and the intent classification. We do not receive or store raw audio recordings from Alexa. You can unlink your account at any time through the Alexa app or CoupleCal settings.
• Google Home / Google Assistant: When you enable the CoupleCal Google Home action and link your account, Google sends transcribed voice commands to our servers. We receive the text of your command, your Google Home user identifier (for account linking), and the intent classification. We do not receive or store raw audio recordings from Google Home. You can unlink your account at any time through the Google Home app or CoupleCal settings.

Smart home integrations are entirely optional. Linking or unlinking these services does not affect your core CoupleCal account or data. The voice commands processed through these platforms follow the same data handling practices described in Section 3.3.

4. How We Use Your Information

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data to third parties. Under the CCPA, we confirm that we have not sold personal information to third parties in the preceding 12 months and do not share personal information for cross-context behavioral advertising. We may share data with:

• Family Group Members: Calendar events, tasks, and availability shared within your family group are visible to other members you have invited. Task assignment data (including task status, due dates, and completion history) is shared with the assigning and assigned family members
• Service Providers (Data Processors): We use carefully vetted third-party vendors bound by Data Processing Agreements (DPAs) compliant with GDPR Article 28 and Standard Contractual Clauses (SCCs) for international transfers:
  • Amazon Web Services (AWS): Cloud hosting, database (RDS PostgreSQL), file storage (S3 for profile photos and media), and infrastructure
  • EURI API: Voice command transcription, image-to-calendar event extraction, PDF processing, and calendar insights. Data is processed per-request and not retained for model training
  • Google (OAuth & Calendar): Authentication via Google Sign-In and optional two-way calendar sync
  • Apple: Authentication via Sign in with Apple (iOS)
  • Firebase (Google): Analytics, crash reporting, and authentication services
  • Stripe: Payment processing for web subscriptions (if applicable)
  • Amazon Alexa / Google Home: Smart home voice integrations (only when you enable and link your account)
• Legal Requirements: When required by applicable law, regulation, legal process, or enforceable governmental request. We will notify you before disclosure unless legally prohibited
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your data may be transferred. You will be notified via email and/or prominent in-app notification of any change in ownership at least 30 days before the transfer
• With Your Consent: For any other purpose with your explicit, informed consent

6. International Data Transfers

CoupleCal is based in the United States. If you access the Service from outside the US, your personal data will be transferred to and processed in the United States. For transfers from the EU/EEA, UK, and Switzerland, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914)
• UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs for UK transfers
• Supplementary measures including encryption in transit and at rest, pseudonymization, and access controls as recommended by the EDPB

You may request a copy of the safeguards in place by contacting dpo@couplecal.com.

7. Data Security

We implement technical and organizational measures designed to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

• Encryption: TLS 1.3 for data in transit; AES-256 for data at rest
• Password Security: User passwords are stored using industry-standard one-way hashing algorithms (bcrypt) and are never stored in plain text
• Access Controls: Role-based access with multi-factor authentication for all internal systems
• Infrastructure: Hosted on AWS with SOC 2 Type II certified data centers
• Token Security: Authentication tokens are signed using industry-standard algorithms (HS256) and have defined expiration periods
• Monitoring: 24/7 intrusion detection, automated vulnerability scanning, and real-time security alerts
• Incident Response: Documented breach response plan with notification to supervisory authorities within 72 hours (per GDPR Art. 33) and to affected individuals without undue delay where a breach poses high risk
• Audits: Annual third-party penetration testing and security audits

While we take all reasonable steps to protect your data, no method of electronic transmission or storage is completely secure. We encourage you to use strong passwords and keep your account credentials confidential.

8. Data Retention

• Account Data: Retained for as long as your account is active. Upon account deletion, personal data is purged within 30 days, except where longer retention is required by law (e.g., tax records — 7 years)
• Calendar Events and Tasks: Retained while your account is active. After deletion, removed within 30 days from production and within 90 days from encrypted backups
• Voice Audio: Sent to the EURI API for processing per-request. Audio is not stored on our servers — it is processed and discarded immediately
• Uploaded Images and PDFs: Sent to the EURI Vision API for event extraction per-request. Not stored on our servers after processing completes
• Profile Photos: Stored on AWS S3 and retained while your account is active. Deleted within 30 days of account deletion
• Smart Home Integration Data: Platform user identifiers and linking status are retained while the integration is active. Immediately deleted upon unlinking
• Usage Analytics: Aggregated and anonymized data may be retained indefinitely. Identifiable usage logs are retained for up to 12 months
• Support Correspondence: Retained for up to 3 years to maintain service quality and for legal compliance
• Payment Records: Transaction identifiers and subscription history retained as required by applicable tax and financial reporting laws (up to 7 years)

9. Your Rights

Depending on your jurisdiction, you have the following rights with respect to your personal data. We honor all applicable rights regardless of your location to the greatest extent possible:

9.1 Rights Under GDPR (EU/EEA/UK Residents)

• Right of Access (Art. 15): Request a copy of the personal data we hold about you
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data
• Right to Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Right to Restriction (Art. 18): Request restriction of processing under certain circumstances
• Right to Data Portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format (JSON or CSV)
• Right to Object (Art. 21): Object to processing based on legitimate interests, including direct marketing
• Right Not to Be Subject to Automated Decision-Making (Art. 22): We do not make solely automated decisions that produce legal or similarly significant effects on you
• Right to Lodge a Complaint: With your local supervisory authority (e.g., your national Data Protection Authority)

9.2 Rights Under CCPA/CPRA (California Residents)

• Right to Know: What personal information we collect, the sources, purposes, and categories of third parties with whom we share it
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out: Of the sale or sharing of personal information (we do not sell your data)
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights
• Right to Limit Use of Sensitive Personal Information: Where applicable

9.3 Rights Under Other Jurisdictions

• Canada (PIPEDA): Right to access, correct, and withdraw consent. Complaints may be filed with the Office of the Privacy Commissioner of Canada
• Brazil (LGPD): Rights to confirmation, access, correction, anonymization, portability, deletion, information about sharing, and revocation of consent. Complaints may be filed with the ANPD
• Australia (APPs): Right to access and correct personal information. Complaints may be filed with the Office of the Australian Information Commissioner (OAIC)
• South Africa (POPIA): Right to access, correct, delete, and object to processing. Complaints may be filed with the Information Regulator
• India (DPDPA): Right to access, correction, erasure, grievance redressal, and nomination. Complaints may be filed with the Data Protection Board of India

9.4 How to Exercise Your Rights

Submit requests via email to privacy@couplecal.com, through Settings > Privacy > Data Rights in the app, or by writing to our postal address. We verify your identity before fulfilling requests and respond within 30 days (GDPR) or 45 days (CCPA). You may designate an authorized agent to submit requests on your behalf.

9.5 Account Deletion

You may delete your CoupleCal account at any time through the app (Settings > Account > Delete Account) or by emailing privacy@couplecal.com. Upon account deletion:

• Your profile data, calendar events, tasks, and family memberships will be permanently deleted within 30 days
• Your profile photo will be removed from our storage within 30 days
• Any linked third-party integrations (Google Calendar, Alexa, Google Home) will be automatically unlinked
• Data that has been shared with family group members (e.g., events you created in shared calendars) may persist in other members' accounts
• Encrypted backups containing your data will be purged within 90 days
• Data required for legal compliance (e.g., financial records) may be retained for the legally mandated period
• Aggregated, anonymized analytics data that cannot be re-identified will not be deleted

10. Cookies and Tracking Technologies

Our website uses cookies and similar technologies. We categorize cookies as follows:

• Strictly Necessary: Required for the website to function (authentication, security). Cannot be disabled
• Functional: Remember your preferences (language, theme, date format). Require consent in the EU/EEA
• Analytics: Help us understand how visitors use our website. Require consent
• Marketing: Used to deliver relevant advertisements. Require consent

You can manage cookie preferences through the cookie banner displayed on your first visit. You can also disable cookies through your browser settings, though some website functionality may be affected.

11. App Tracking and Advertising

11.1 iOS App Tracking Transparency (ATT)

On iOS 14.5 and later, we comply with Apple's App Tracking Transparency framework. CoupleCal does not track you across other companies' apps or websites for advertising purposes, and we do not use the IDFA (Identifier for Advertisers). We do not display third-party advertisements within the app.

11.2 Google Play Data Safety

In accordance with Google Play's Data Safety requirements, we disclose the following:

• Data collected: Name, email, phone (optional), photos (profile and image-to-calendar), voice/audio (voice commands), calendar events, tasks, app interactions, crash logs, device identifiers
• Data shared: Data is shared with service providers (AWS, EURI API, Google, Firebase) only as necessary to provide the Service. We do not share data with third parties for advertising
• Security: Data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Data deletion: Users can request account and data deletion through the app or by contacting us (see Section 9.5)

12. Third-Party Services and Links

Our Service integrates with or contains links to third-party services. These third parties operate under their own privacy policies and terms. We encourage you to review them:

• EURI API: Powers voice transcription, image-to-calendar extraction, and calendar insights via our proprietary AI processing service
• Google Calendar: Optional two-way sync of calendar events. See Google Privacy Policy
• Google Sign-In & Apple Sign-In: Authentication providers. Your authentication data is governed by the respective provider's privacy policies
• Amazon Web Services: Cloud infrastructure hosting and data storage. See AWS Privacy Notice
• Firebase (Google): We use Firebase for authentication (optional), Firebase Analytics for aggregated usage insights, and Firebase Crashlytics for crash reporting. See Firebase Privacy and Security
• Amazon Alexa: Smart home voice integration. See Alexa Privacy
• Google Home / Google Assistant: Smart home voice integration. See Google Assistant Privacy
• Stripe: Payment processing (web). See Stripe Privacy Policy

We are not responsible for the privacy practices of third-party services. We only share the minimum data necessary for integrations to function, governed by Data Processing Agreements where applicable.

12.1 Google API Services User Data Policy Compliance

CoupleCal's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only request access to the Google Calendar scopes necessary for the features you use (reading and writing calendar events for two-way sync)
• We use Google Calendar data exclusively to provide and improve the calendar synchronization feature within CoupleCal
• We do not use Google Calendar data for serving advertisements
• We do not allow humans to read your Google Calendar data unless: (a) we first obtain your explicit consent, (b) it is necessary for security purposes (e.g., investigating abuse), (c) it is necessary to comply with applicable law, or (d) our use is limited to internal operations and the data has been aggregated and anonymized
• We do not transfer Google Calendar data to third parties except as necessary to provide or improve the Service, as required by law, or in connection with a merger/acquisition (with user notification)
• Google OAuth tokens are stored securely and can be revoked at any time by disconnecting Google Calendar in the app settings

13. Children's Privacy

CoupleCal is designed for use by adults aged 18 and older. We do not knowingly collect personal information from children under 13 (US — COPPA), under 16 (EU/EEA — GDPR), or under the applicable age of digital consent in your jurisdiction. Family members under the applicable age may appear in calendar events managed by adult account holders but should not create their own accounts.

If we become aware that we have collected personal data from a child without appropriate consent, we will take steps to delete that information as promptly as possible. If you believe a child has provided us with personal data, please contact us immediately at privacy@couplecal.com.

14. Do Not Track Signals

Some browsers transmit a "Do Not Track" (DNT) signal. There is no uniform standard for how websites should respond to DNT signals. Currently, our website does not respond to DNT signals, but we do honor the Global Privacy Control (GPC) signal as an opt-out of "sale" or "sharing" under applicable state privacy laws.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or industry standards. For material changes, we will provide at least 30 days' advance notice via email to the address associated with your account and/or via a prominent in-app notification. Minor, non-material changes (clarifications, formatting) may be made without advance notice. The "Last updated" date at the top of this page indicates when the most recent revision was published.

Your continued use of the Service after the effective date of a revised policy constitutes your acceptance of the changes. If you do not agree with a material change, you may close your account before the effective date.

16. Contact Us

If you have questions, concerns, or complaints regarding this Privacy Policy or our data practices, please contact us through any of the following channels:

• Data Protection Officer: dpo@couplecal.com
• Privacy Team: privacy@couplecal.com
• General Support: support@couplecal.com
• Phone: +1 (415) 555-0142 (Monday through Friday, 9:00 AM to 6:00 PM PST)
• Postal Address: CoupleCal Inc., Attn: Privacy Team, 548 Market Street, Suite 300, San Francisco, CA 94104, United States

If you are located in the EU/EEA and believe your data protection rights have not been adequately addressed, you have the right to lodge a complaint with your local supervisory authority. A list of EU Data Protection Authorities can be found at edpb.europa.eu.