Privacy policy

Last updated: 2 October 2026

1. Who is responsible

This policy covers the ProfCalendar app for Android, the ProfCalendar web app at app.profcalendar.app and the website profcalendar.app.

2. The short version

• Your calendar data is stored in a database in Frankfurt, Germany (EU).
• We process your data to run the calendar — not to build profiles, and we do not sell it.
• The app currently contains no advertising, no analytics and no crash reporting.
• You can export your calendars and delete your account yourself, at any time, in the app or the web app.
• This website sets no cookies and uses no tracking.

3. What data the app processes

If you import your device calendar, the imported events become calendar content as described above. The app keeps an offline copy of your calendars on your phone; this copy is excluded from Android cloud backup and device transfer.

What you have to provide. To create an account you must give an email address and a password, and to use shared calendars a display name; without them we cannot provide the app. Everything else (avatar, calendar content, comments, importing your device calendar, sharing a message for message-to-event, allowing notifications) is optional and only happens when you use the feature. The server logs arise automatically when you use the service.

4. Why we process it and on what legal basis

• Providing the app — account, synchronisation, sharing, notifications, message-to-event: performance of the contract with you (Art. 6(1)(b) GDPR).
• Security and abuse prevention — server logs, rate limits: our legitimate interest in a secure service (Art. 6(1)(f) GDPR).

5. What other members see

In a shared calendar, the other members see your display name, your avatar, and the events and comments you add there. Your email address is never shown to other users. When you export a shared calendar, the export contains the other members' events in that calendar as well — and the same applies to their exports.

6. Who receives data

Message-to-event: nothing is read automatically. Only when you share a message to ProfCalendar is its text sent through our server to the AI provider to extract a date, time and title. We do not store the message content on our servers. Under the AI provider's API terms, the text is not used to train models.

The result is only a proposal that you review and confirm. There is no automated decision-making within the meaning of Art. 22 GDPR, and nothing that has legal or similarly significant effects on you.

Some of these providers are based in the United States or may process data there. Where that is the case, the transfer is covered by the EU–US Data Privacy Framework or by standard contractual clauses.

7. How long we keep data

• Your data is kept as long as your account exists.
• Deleting your account removes it immediately and irreversibly — see Delete account for exactly what is deleted.
• Database backups are overwritten after at most 30 days.

8. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest. Two of these you can exercise directly in the app:

• Portability / access: Settings → "Export data (.ics)" produces one standard calendar file per calendar. For access to other data, such as your profile or push token, write to us.
• Erasure: Settings → "Delete account", or without the app via this page.

For everything else, write to privacy@profcalendar.app. You also have the right to lodge a complaint with a data protection supervisory authority, for example the one responsible for your place of residence or, for us, the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

9. This website

profcalendar.app is a static website. It sets no cookies, embeds no third-party content and uses no analytics. As with any website, the hosting provider (Cloudflare) processes your IP address and request data to deliver the pages and protect the service (Art. 6(1)(f) GDPR). Invite links (profcalendar.app/join/…) contain an invite code; the page displays it in your browser and does not store it.

The web app at app.profcalendar.app works with the same account and the same data as the Android app; it sends your calendar data directly between your browser and our database in Frankfurt and embeds no third-party content. It sets no cookies and uses no analytics. To keep you signed in, it stores your session token in your browser's local storage for app.profcalendar.app; it also stores a few preferences there (the last calendar view, which calendars you have hidden, your language choice). Signing out removes the session; the preferences stay in your browser until you clear its site data. The web app keeps no offline copy of your calendars. Cloudflare hosts the web app's files as described above.

Contact form. If you use the contact form at profcalendar.app/contact/, we process the name, email address and message you enter, plus technical request data such as your IP address, to answer you (Art. 6(1)(b) and (f) GDPR). The message is forwarded to our inbox by email through Cloudflare Email Routing and is not stored on the website. We delete it once your request is dealt with, unless a legal retention duty applies.

10. Children

ProfCalendar is not directed at children under 16. If you believe a child has created an account without parental consent, contact us and we will delete it.

11. Changes

When the app changes — for example when advertising, crash reporting or subscriptions are introduced — this policy is updated before the change ships. The date at the top shows the current version.