Privacy

Who this covers

This policy covers didcal.com, the Didcal web app, the Didcal Mac app and the Didcal iPhone app. Didcal is built and run by one person. “We” below means that person.

What Didcal collects

Didcal only collects data from sources you connect. Here is each one, and what is stored from it.

Your account. Your name, email address and sign-in details, handled by Clerk, our authentication provider. If you link a Mac or an iPhone, we store the device’s name and when it was last used, so you can see and revoke it.

Google Calendar. The calendars in each Google account you connect, and their events: titles, times, descriptions, locations, attendees and their responses, video links, and recurrence. Sync is two-way. Didcal reads your events and writes the events you create, edit, move, answer or delete in Didcal back to Google. Didcal also creates one calendar of its own in your Google account, called Actual, and writes your work blocks to it. Didcal asks Google only for calendar access. It never reads your email.

WHOOP. If you connect WHOOP: your sleeps and naps, workouts, recovery, strain, and daily cycle scores. From these Didcal keeps start and end times, sleep stages (light, deep, REM, awake), time in bed, sleep efficiency, performance and consistency, heart rate (average, lowest, maximum and resting), heart rate variability (HRV), respiratory rate, workout type, calories and distance. It also keeps your WHOOP user id and the name or email on the account, to show which account is connected.

Oura. If you connect Oura: your sleeps and naps, daily sleep, readiness and activity scores, workouts, steps, heart rate and HRV. From these Didcal keeps the same kinds of fields as for WHOOP, plus workout intensity. It also keeps your Oura user id and email, to show which account is connected.

Claude Code activity, from the Mac app only. The Didcal Mac app reads Claude Code’s session files on your Mac and uploads summaries of them. A summary has: the times of your work blocks, split into time at the keyboard and time waiting on agents; session titles; repository and branch names; how many prompts you sent and how often you switched sessions; for each agent run, how many agents it started, how long they ran and how many tokens they used; and the run’s final reply, trimmed to a few lines. The web app and the iPhone app never read Claude Code files. They show what your Mac uploaded.

Things you enter. Routines, habits and the days you tick them, focus blocks, todos, reminders, and your settings, such as when your day starts.

Billing. If you buy a plan, Clerk Billing and Stripe handle payment. Didcal sees your plan, its status and your team seats. Didcal never sees or stores your card number.

What stays on your Mac

Claude Code keeps a transcript of each session in ~/.claude/projects. The Didcal Mac app reads those files on your Mac to work out when you were at the keyboard, when you were waiting on agents, and what each run did. Transcripts are read on the Mac and never leave it. No Didcal server stores your transcripts.

Your prompt text is not uploaded unless you turn on “Send prompt text” in the Mac app’s settings. If you turn it on, the text of each prompt is uploaded with its run so your other devices can show it. You can turn it off at any time.

Calendars on your device

The Mac and iPhone apps can show calendars that are already on the device, such as iCloud calendars, through the calendar permission Apple asks you for. Those calendars and their events stay on that device. They are never uploaded to Didcal. You can turn the permission off in System Settings on the Mac or in Settings on the iPhone.

Where it is stored

Your data is stored in a Postgres database run by Supabase, in the United States. Every row is tied to your account, and the database only returns your rows to you. The access and refresh tokens that let Didcal reach Google, WHOOP and Oura are encrypted in Supabase Vault. They stay on the server and are never sent to an app.

Each linked Mac or iPhone holds a device key in its Keychain. On the server the key is stored only as a hash.

How it is used

Didcal uses your data for one thing: to show you your own calendar and your own day, on the devices you sign in to, and to write the events you ask it to write.

Didcal does not sell your data. It does not use it for advertising. It does not share it with data brokers. Your data is not used to train AI or machine learning models. Nobody reads it except when you ask for help with a support request and say we may.

Health data from WHOOP and Oura is shown only to you. It is not shared with anyone except the service providers listed below, which store and process it on our behalf to run Didcal.

Service providers

Didcal uses these companies to run the service: Supabase (database and encrypted token storage), Clerk (sign-in and billing), Stripe (payments), and the cloud providers that host the Didcal server and its background sync jobs, in the United States. Google, WHOOP and Oura receive the requests Didcal makes to their APIs on your behalf. didcal.com loads fonts from Google Fonts.

Google user data

Didcal’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is never used for advertising, never sold, never used to train AI models, and never read by a person except with your permission to resolve a support request.

How long it is kept

Your data is kept while your account is active.

When you disconnect WHOOP or Oura, Didcal revokes its access at the provider, deletes the stored tokens, and deletes the health records it stored from that provider.

When you disconnect a Google account, Didcal revokes its access, deletes the stored tokens, and deletes that account’s calendars and events from Didcal. Events Didcal already wrote to Google, including the Actual calendar, stay in your Google account until you delete them there.

When you revoke a Mac, its device key stops working and it can no longer upload.

When you delete your account, everything Didcal stores about you is deleted within 30 days, including from database backups. To delete your account, email kenneth@didcal.com from the address on your account.

How to revoke access

In Didcal. Open Connections and choose Disconnect next to Google, WHOOP or Oura. To remove a Mac or an iPhone, open Settings › Devices and revoke it. This works from any client.

At the provider. You can also remove Didcal from the provider’s side at any time. For WHOOP, use the connected apps settings in your WHOOP account. For Oura, use the connected apps or data sharing settings in your Oura account at cloud.ouraring.com. For Google, go to myaccount.google.com/permissions and remove Didcal. Once access is removed, Didcal can no longer read new data from that provider.

Your choices and rights

You can see your data in Didcal, and you can ask for a copy of it, a correction, or its deletion by writing to kenneth@didcal.com. We answer within 30 days.

Security

All traffic uses HTTPS. Provider tokens are encrypted at rest in Supabase Vault, and OAuth client secrets live only on the server, never in an app. Device keys are stored as hashes and can be revoked. Database access is limited by row-level security, so one account cannot read another’s data. No system is perfectly secure. If a breach affects your data, we will tell you.

This website

The pages at didcal.com set no cookies and run no analytics. They load fonts from Google Fonts. The web app uses cookies from Clerk to keep you signed in.

Children

Didcal is not for anyone under 16. We do not knowingly collect data from children. If you think a child has an account, write to us and we will delete it.

Changes to this policy

When this policy changes, the date at the top changes, and a post on the blog says what changed. If a change affects how your data is used, we will tell you by email before it applies.

Contact

kenneth@didcal.com. One person reads it, and answers.