Privacy Policy

Jotcal · Last updated: July 16, 2026

Which app this covers

Jotcal ("the App") is a calendar and productivity application published for both iOS and Android. This Privacy Policy covers both apps and the backend service behind them.

Most of it applies to both. The two apps are built on different platform technology, so where they genuinely differ, the section is marked with a badge and applies only to that platform:

iOS only Android only

Jotcal is designed with privacy in mind. Your calendar events, tasks, notes, and handwriting are stored on your device and are never uploaded to our servers. We operate a minimal backend used only to manage free-trial eligibility and verify purchases. It receives a device identifier and purchase information — never your calendar content.

Two things do leave your device, and we would rather state them plainly here than bury them:

If you type or handwrite a location into an event, that text is sent to a mapping service to turn it into a real place — Apple's on iOS, Google's on Android. It is a fragment of what you wrote.
If you use the optional weather feature, your approximate location is used to fetch a forecast.

Both are described in full below. We do not sell your information. We do not use it for advertising. We do not use it to train artificial intelligence or machine learning models.

Information We Do Not Collect

Precise (GPS) location. Only approximate location is used, and only for the optional weather feature.
Contacts
Photos, videos, or files
Any advertising identifier
Usage analytics, telemetry, or behavioural tracking. We do not measure how you use the App. (The Android app sends crash reports — see Android only. Those carry stack traces and device metadata, not a record of your activity.)

We have no accounts and no sign-up. We do not know your name, and unless you email us, we do not know your email address.

What Stays on Your Device

The following are created and kept in the App's private storage on your device. None of it reaches our servers:

Calendar events shown or created in the App
Tasks and notes you create
Handwriting stroke data for handwritten notes
App settings and preferences
Calendar account credentials, where the platform uses them Android only

Removing the App removes this data from your device. It does not remove the backend records described next — see Data Retention and Deletion.

What Our Backend Holds

To run the free trial and confirm purchases, the App talks to a backend service we operate (the "JotCal API"), hosted on Cloudflare Workers with a Cloudflare D1 database. It is shared by both apps. This is the complete list of what it stores:

Record	What it holds	Why
Trial	Device identifier, the date and time your trial started, when the record was created, and which platform it came from.	Anchors your free trial server-side, so it cannot be reset by reinstalling.
Purchase	Order ID, device identifier, product ID, purchase token, purchase state, when it was verified, the platform, and which verification method confirmed it.	Records that a purchase was verified as genuine, so your Pro entitlement survives a reinstall.
Subscription	Purchase token, device identifier, product ID, expiry time, when it was verified, and the platform.	Tracks the expiry of a subscription so entitlement can be checked against it.
Trial reset	Device identifier, a short note written by us describing why the reset was granted, and when it was armed and used.	Written only when we manually grant a fresh trial — for example, for a second-hand device. Most devices never have one.

Your calendar events, tasks, notes, handwriting, and account credentials are never uploaded to this backend. It has no way to read them.

The two fields that differ by platform

Field	On iOS	On Android
Device identifier	A random identifier generated by the App on first launch and kept in the device Keychain, plus an Apple DeviceCheck token (see iOS only). It is not your Apple Account and not an advertising identifier.	The Android ID (`Settings.Secure.ANDROID_ID`), which is specific to your device and to this app. It is not the Android Advertising ID.
Purchase token	The Apple `originalTransactionId` for your purchase.	The Google Play purchase token.

Neither identifier is used for advertising, and neither is used to track you across other apps or services.

Server logs

When our backend grants a manual trial reset, or falls back to an offline check to verify a purchase, it writes a line to Cloudflare's Worker logs recording the device identifier and, for purchases, the order ID. These logs exist so we can diagnose licensing faults. They contain no calendar content and no location. They are held in Cloudflare's logging for our hosting account, retained for no longer than 7 days and then deleted automatically; we do not copy them into our own database. Separately, Cloudflare records its own edge request logs as our hosting provider, under the Cloudflare Privacy Policy. We do not store your IP address in our own database.

On iOSiOS only

Everything in this section applies only to Jotcal for iOS.

Calendar access — EventKit

Jotcal for iOS reads and writes your calendar through Apple's EventKit framework, which asks for your permission first. It uses the calendars already set up in iOS. There is no Jotcal account, no sign-in, and no calendar credentials — we never see a password or a token, and your calendar data does not pass through our servers. You can revoke calendar access at any time in iOS Settings → Privacy & Security → Calendars.

Tasks — Apple Reminders

On iOS, your tasks are your Apple Reminders. Jotcal reads and updates them through Apple's EventKit framework, which asks for your permission first, and uses the reminder lists already set up in iOS. As with your calendar, this data stays on your device and never passes through our servers. You can revoke access at any time in iOS Settings → Privacy & Security → Reminders.

Location search — text you wrote goes to Apple

This one qualifies the "never uploaded" promise above, so read it closely.

When you type or handwrite a location into an event — in the event editor, or in a note the App parses — the App sends that location text to Apple's map search (MKLocalSearch) to turn it into a real place. In the event editor this happens as you type, once you have entered two characters, so partial text is sent before you finish. To return nearby results, the request also carries a coarse location hint covering roughly a 60 km area around you.

So a fragment of your event — the location line, not the title, notes, or attendees — plus an approximate area does leave your device, and goes to Apple. It is not sent to us, and it is not stored on our servers. Apple handles these requests under the Apple Privacy Policy. If you would rather not send it, leave the location field empty.

Weather — Apple WeatherKit, called from your device

If you enable the optional weather feature, your device contacts Apple WeatherKit directly to fetch the forecast — the request does not pass through our backend. Apple receives the coordinates being forecast, and acts as the provider of that service under the Apple Privacy Policy; the request carries no device identifier of ours and no account information. Your device also asks Apple to convert those coordinates into a time zone so the forecast lines up with your day. Weather data is provided by Apple Weather; see Apple's Weather data sources. The App requests approximate location only, and you may deny it and set a location manually instead.

Handwriting and event text — processed on your device

Handwriting is captured with PencilKit and recognised with Apple's on-device Vision framework. The strokes and the recognised text stay on your device.

On supported devices, the App uses Apple's on-device Foundation Models — a language model that runs entirely on your iPhone or iPad — to read event text and pull out the date, time, and title. Your event text is processed by that model on your device and is not sent anywhere: no network request, no third-party AI service, and nothing that trains a model on your data. (The location line is the exception, and only once it is looked up — see Location search above.)

DeviceCheck — a marker that outlives the App

To stop the free trial being restarted by deleting and reinstalling, Jotcal uses Apple's DeviceCheck service. DeviceCheck lets an app store two bits of information against your physical device, held on Apple's servers rather than in the App. Jotcal uses them to record that this device has already started or used its free trial.

You should know two things about this. These bits survive deleting the App — that is the entire point of them, and it is why a reinstall does not grant a second trial. And they persist until we reset them. They are two bits and nothing more: they carry no calendar data, no personal information, and no history of your activity, they cannot identify you, and they are readable only by Jotcal. See Apple's DeviceCheck documentation. If you would like your device's trial marker cleared, contact us via the Data Deletion page.

Purchases — StoreKit and the App Store Server API

Purchases are handled by Apple's StoreKit. Apple processes the payment; we never see your payment details. To confirm a purchase is genuine, the App sends its transaction identifier to our backend, which checks it against the App Store Server API and stores the result as described under What Our Backend Holds. See the Apple Privacy Policy.

Crash reporting — no third party

Jotcal for iOS contains no third-party SDKs of any kind — no Firebase, no Crashlytics, no analytics library. Crash and performance diagnostics are handled by Apple's on-device MetricKit and written to your device's own log and a local file. We do not receive crash reports from the iOS app.

On AndroidAndroid only

Everything in this section applies only to Jotcal for Android.

Calendar accounts you connect

Jotcal for Android connects directly to your calendar provider. Depending on the provider, the App receives:

Google Calendar: Your email address (for account identification), calendar names, and calendar event data (titles, dates, times, descriptions, locations, attendees). Access is granted through Google OAuth, limited to the scopes calendar.events and calendar.readonly.
Microsoft Outlook: Your email address, calendar names, and calendar event data. Access is granted through the Microsoft Authentication Library (MSAL) with the scopes Calendars.ReadWrite and offline_access.
iCloud Calendar: Your Apple Account email and an app-specific password you provide. Calendar data is accessed via the CalDAV protocol.
CalDAV (generic): A server URL, username, and password you provide. Calendar data is accessed via the CalDAV protocol.

These credentials are stored encrypted in the App's private storage on your device and are never sent to our servers. Calendar data is transmitted directly between your device and your provider over HTTPS; it does not pass through us. You can disconnect an account at any time in the App's Settings, which removes its credentials and synced data from your device.

Weather — fetched through our backend

If you enable the optional weather feature, the App can request your device's approximate (coarse) location using the ACCESS_COARSE_LOCATION permission, which you may grant or deny; you can set a location manually instead. The App does not request precise (GPS) location.

Unlike iOS, the Android app sends those approximate coordinates to our backend, which fetches the forecast from Apple WeatherKit on your behalf. The backend immediately rounds the coordinates to about two decimal places (roughly a 1 km area) and uses only the rounded value — both to call WeatherKit and as a short-lived cache key, so forecasts can be reused across everyone in the same area. Your full-precision coordinates are never written to our logs or database, and neither the rounded nor the full-precision coordinates are stored against your device identifier or any other identity. The weather request does not include your device identifier. Cached forecasts expire within a few hours. Apple receives only the rounded coordinates — no identifier, no account information.

Location search — text you wrote goes to Google

This one qualifies the "never uploaded" promise above, so read it closely.

Jotcal for Android turns place names into coordinates using Android's built-in geocoder. On devices with Google Play Services — almost all of them — Android performs that lookup over the network, sending the text to Google. Three things trigger it:

Typing a location into an event — the lookup runs as you type, to offer suggestions.
Saving an event whose location you typed or handwrote rather than picking from the suggestions. This runs automatically, in the background.
Setting your weather location by typing a city name into Settings, or by using the "use my location" button, which converts your coordinates into a place name.

So a fragment of your event — the location line, not the title, notes, or attendees — does leave your device, and goes to Google. It is not sent to us, and it is not stored on our servers. Google handles it under the Google Privacy Policy. The coordinates found are saved with the event on your device, and are included when the event syncs to a calendar account you connected. If you would rather not send event location text, leave the location field empty. On devices without Google Play Services, no lookup happens and the text stays on your device.

Handwriting — Google ML Kit, on-device

Handwriting is recognised on-device with Google ML Kit Digital Ink Recognition. Your handwriting strokes are not sent to Google's servers — recognition happens entirely on your device. The recognition model itself is downloaded from Google the first time it is needed, which tells Google that a device requested the model; the download carries none of your content. See the ML Kit Terms.

Crash reporting — Firebase Crashlytics

When the Android app crashes or hits a fatal error, it sends an anonymous crash report to Firebase Crashlytics (Google) so we can diagnose and fix the problem. These reports contain the crash stack trace and basic technical metadata — device model, operating system version, and app version. They do not contain your calendar events, tasks, notes, handwriting, or account credentials. See Firebase Privacy and Security and the Google Privacy Policy.

Purchases — Google Play Billing

In-app purchases are processed by Google Play; we never see your payment details. To confirm a purchase is genuine, the App sends the Google Play purchase token to our backend, which verifies it with the Google Play Developer API. If that API is unavailable to us, the backend instead verifies Google's own cryptographic signature on the purchase offline, and records which of the two checks was used. See the Google Privacy Policy.

Google API Services User Data Policy

The App's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The App uses Google user data only to provide calendar functionality visible to you within the App. It does not transfer Google user data to third parties except as necessary to provide the service, with your consent, or for legal or security reasons. It does not use Google user data for advertising, retargeting, or any unauthorised purpose. Human access to Google user data is not required for the App's operation.

Data Sharing

We do not sell, rent, or trade your personal information. We do not share it for advertising, and we do not share it for cross-context behavioural advertising.

Your calendar data is transmitted only to the calendar provider you connected, and only on Android. On iOS it never leaves your device at all, beyond the location lookup described above.

The limited trial- and purchase-related data described above is handled by service providers acting on our behalf, solely to run the App's licensing: Cloudflare hosts our backend; Apple verifies iOS purchases and provides DeviceCheck; Google verifies Android purchases and receives Android crash reports. Location and location text are shared as described in the platform sections. We share information for no other purpose. We may disclose information if required by law.

Data Retention and Deletion

Data on your device stays there for as long as you keep the App. You can remove it yourself at any time:

Delete the App — removes all of Jotcal's on-device data, on both platforms.
Clear app data — Android Settings > Apps > Jotcal > Storage > Clear Data. Android only
Disconnect an account — removes that provider's credentials and synced data. Android only

Deleting the App does not delete the trial and purchase records held against your device identifier on our backend. We keep those to maintain your Pro entitlement and to stop the free trial being reset by reinstalling. We keep them for as long as we run the App's licensing. On iOS, the DeviceCheck bits described above likewise survive deleting the App.

To request deletion of the records associated with your device, see our Data Deletion page, or email us at the address below. Deleting a record tied to an active purchase may affect your access to Pro features.

Your Rights

Depending on where you live, you may have the following rights over your personal information:

Access: The data the App holds is on your device and visible to you in the App. For the trial and purchase records on our backend, you can ask us for a copy.
Deletion: You can delete on-device data yourself, and request deletion of your backend records — see Data Retention and Deletion.
Correction: You can ask us to correct a backend record that is wrong.
Portability: Calendar data can be exported through your calendar provider's own export tools, or through the Calendar app on iOS.
Withdraw consent: Turn off the weather feature at any time in the App's Settings. On Android, disconnect any calendar account in the App's Settings. On iOS, revoke calendar or location access in iOS Settings → Privacy & Security — there is no account to disconnect.

To exercise any of these, email us at the address below. We will not discriminate against you for exercising them.

For European Economic Area (EEA) and UK Residents

Our legal basis for processing is your consent (connecting a calendar account, or enabling location-based weather — each of which you may withdraw at any time) and the performance of our contract with you (running the App, including free-trial eligibility and purchase verification). Preventing trial abuse rests on our legitimate interest in offering a free trial at all. The limited trial- and purchase-related data we process is handled on our behalf by Cloudflare, Apple, and Google, and may be processed in data centres outside the EEA and UK. You have the right to lodge a complaint with your local supervisory authority.

For California Residents

Under the California Consumer Privacy Act (CCPA/CPRA): we do not sell your personal information, and we do not share it for cross-context behavioural advertising. You have the right to know what personal information is collected, to have it deleted, to correct it, and to be free from discrimination for exercising those rights. The categories we collect are set out above — in summary, a device identifier and purchase records.

Children's Privacy

The App is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided information through the App, please contact us so we can take appropriate action.

Security

We take reasonable measures to protect your information:

Your calendar events, tasks, notes, and handwriting are never uploaded to our servers, so there is no copy of them for us to lose.
Calendar account credentials, where the platform uses them, are stored encrypted in the App's private storage on your device. Android only
All network communication uses HTTPS (TLS). Cleartext traffic is prohibited.
Our backend stores only the limited licensing records listed above.

No method of electronic storage or transmission is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Last updated" date at the top. We encourage you to review this policy periodically. Continued use of the App after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or the App's data practices, please contact us at:

Email: support@jotcal.app