Privacy policy
How Calmframe handles your personal data.
Longzhong Wu
Controller and scope
Longzhong Wu operates Calmframe and is responsible for personal data processed through its website, apps and support. For privacy questions and requests, email [email protected].
Data we handle
Local tasks remain on your device unless you connect sync. When connected, we store your sign-in provider identifier, tasks, notes, completion history and sync operations. We store verified purchase references for entitlements, and the email and message you submit to support.
Purpose and services
We use these data to provide planning, sync, account security, purchases and support. If you request AI suggestions, your request and only the task context you explicitly permit are sent to OpenAI. Google and Apple process sign-in and store purchases. Configured email and private storage providers process support delivery and requested exports. Their infrastructure may process data outside your country.
Purposes and legal grounds
We process necessary account and planning data to provide the service you request. Security, abuse prevention and support rely on legitimate interests, subject to your rights; legally required disclosures rely on legal obligations. Optional website analytics relies on consent. We do not sell personal data or use your plans for advertising profiles.
Retention and deletion
Account deletion removes synced task data, AI proposals, provider tokens and all sessions; private files are queued for deletion. Failed cleanup is retried and visible to the operator. Export files expire after 24 hours. Support queue content is removed after 30 days. Minimal hashed deletion and purchase references prevent deleted sessions or duplicate receipts from restoring access. Existing backups follow the operator’s retention schedule.
Your choices and rights
You can edit tasks, export a backup and delete your account in settings. You can withdraw analytics consent on any public page. Contact the privacy address above for access, correction, erasure, portability, objections or restrictions. Depending on your location, you may complain to your data protection authority. Deleting an account does not cancel store subscriptions.
Optional website analytics
Website analytics are disabled until you choose to allow them. If enabled, Google Analytics receives public page paths with query strings, fragments and article identifiers removed. We do not send task content, account identifiers or raw referrers. Consent is saved for 180 days and can be withdrawn at any time. Necessary language and sign-in cookies remain independent.
Security and permissions
Your plans are not published on the public website. Online services use HTTPS, restricted access and encryption for stored credentials. No system guarantees complete security. Notifications, calendar or reminders access and other system integrations require the relevant device permissions; you can manage them in system settings. Avoid including unnecessary sensitive data in tasks or support messages.
Children
Calmframe is not intended for children below the applicable age of digital consent. Contact [email protected] if you believe we have received a child’s personal data without the required permission.
Policy changes
We update this page when our data processing changes and show the revision date above. Contact [email protected] for questions, security concerns or details about service providers, international processing and backup retention.