If we change anything important in this text, we will tell you in the app before it applies. This is a translation: if it differs from the Spanish version, the Spanish version prevails.

Calma Privacy Policy

Last updated: 5 November 2026

1. Who is responsible for your data

ARTIFICIAL INTELLIGENCE HACKS, SOCIEDAD LIMITADA (AIHacks-ES), tax ID (CIF) B05810908, with its registered office at Calle Escalonia 15, Portal 13, Bajo C, 28231 Las Rozas de Madrid (Spain), registered with the Madrid Companies Registry (Registro Mercantil de Madrid), sheet M-900408. Telephone: +34 617 731 325.

Until 26 October 2026, while the company was being incorporated, the controller was Alejandra Taborda Londoño. The change does not alter what data is processed or why: only who is responsible for it. For anything about your data: soporte@aihacks-es.com.

2. What Calma is

Calma is an app that looks at your calendar and helps you make room to rest: it suggests wellbeing activities in your free slots, keeps track of your goals and plans your days off for the year. Some suggestions are generated by an artificial intelligence model (section 6).

Anyone can create a Calma account, for free.

3. What data we process

Your account. Email address and password (stored encrypted, never in plain text), the name you choose and the language. We use your email to confirm your sign-up and, if we invite you, to send you the invitation. Also your plan (free or Plus), where it comes from and how long it lasts. If you sign in with Google, Apple or Microsoft, the identifier that service gives you so that we can recognise you (section 5).

The waiting list, if you joined it without an account. Until 31 October 2026 access was by invitation only, and there was a waiting list on the website. Nobody can join it any more. For those who joined, we keep their email, the language, the page they signed up from, when, and whether they confirmed it with the link we sent, until it is deleted (section 8). Nothing else: neither name nor password.

Your calendar, if you connect Google Calendar or Outlook. For each event: title, date, time, duration, location, number of attendees and which calendar it comes from. Also the email (and, in Outlook, the name) of the accounts you connect and which calendars you have chosen to exclude, with their names. If you connect both, for the one that is not the main one we only store when you are busy: the time and the duration, without title, location or attendees.

The permission to renew access to your calendar. So that Calma can keep seeing your calendar without asking for your permission every hour, we store the renewal code that Google and Microsoft provide (the "refresh token"), encrypted: neither you nor anyone with access to the database can read it, only the server that uses it. It is deleted when you disconnect the account or delete yours.

Your wellbeing activities. The ones you schedule or log: name, type (exercise, meditation, break…), date, time, duration and whether it is a favourite.

Your habits. The ones you set yourself: the type (exercise, meditation, reading, disconnecting…), a name if you give it one, how many times a week, how long it lasts, its minimum version for difficult days, the time of day you prefer to do it and whether it is active. Activities that come from a habit carry its reference, to count how you are getting on.

Notifications, if you turn them on. To remind you before an activity and to ask you how it went:

• In the browser or the app installed from it: the notification address your browser provides (a link to the notification service of Apple, Google or Mozilla, with its keys), which browser it is, when you registered it and when it was last used. If the browser treats it as expired, it is deleted.
• In the mobile app: there are two kinds of notification. Some are scheduled by the app on your phone, without going through any service; for those we only store when it last scheduled them and until when they cover, so as not to notify you twice. Others are sent by our server, so that you are also notified of changes you make from the web or your calendar: they are carried to your phone by Apple's notification service (iPhone) or Google's (Android). For that we store the notification identifier your phone provides (the "token"), whether it is an iPhone or an Android phone, the Apple environment in which it is valid, the app version, when you registered it and when it was last used. It is deleted when you sign out or turn notifications off.
• In both cases: your time zone, how far in advance you want the reminder and when to ask you (at the end of each activity, in a daily summary or never); what you reply ("It went well", "Schedule another"), and which notifications have already been sent, so as not to repeat them.

What you tell us when something goes wrong. If you use "Found a bug?", we receive what you write, up to three screenshots that you attach, your email (so we can reply to you) and data to pinpoint the error: the screen you were on, the app version, the browser or device, the screen size, the language, the time zone and the time. Screenshots may show whatever is on your screen: check them before sending. If you tick "Let me know when it's fixed", we will write to your email when we have fixed it, only once. To sort the reports, what you write is also read by an AI assistant (section 7), without your name, your email or your screenshots: do not put your own data or other people's data in the text.

Your mood. When you choose how you feel in the Calendar, the app uses it at that moment to choose what to suggest to you; and after a practice you can note whether you feel better, the same or worse, to see it in your Journey. We treat it as health data. If you do not turn anything on, it does not leave your device: what you choose in the Calendar is not stored, what you note after practices is stored only on your device (section 11), and none of it reaches our servers or the AI.

If you turn on "Save my mood" in Settings, we store on our servers the mood you choose from the list (for example "Calm" or "Better"), the day and where you answered: in the Calendar or after a practice, and which kind. Nothing else: no notes or free text. That way you can see in your Journey how your wellbeing changes, on all your devices. When you turn it on, what you had already noted on that device is uploaded too. Separately, and only if you also tick that box, the AI takes it into account to suggest activities to you (section 6). Both only with your explicit consent, which you can withdraw whenever you want (section 9).

What your health app records, only if you turn it on (mobile app). If you turn on "Verify with Health" in Settings, Calma reads on your phone, from Apple Health (iPhone) or from Health Connect (Android), the start and end time of your workouts and your mindfulness sessions from the last few days, to check whether they match the activities you scheduled and to offer to add the ones you did outside Calma. It does not read your heart rate, calories, distances, or which app each session comes from. That reading stays on your phone: all that reaches our servers is which scheduled activity was verified, whether it was with Apple Health or with Health Connect, and when. If you choose to add a session, its type (workout or meditation), start time and duration also reach our servers, and it is saved as a Calma activity, with a generic title ("Workout" or "Meditation"), which is not uploaded to Google Calendar or Outlook. Like the rest of your calendar, those sessions are seen by the "Ask Calma" AI, with their type, time and duration (section 6). The sessions you do not add never leave your phone, which only remembers that you have already decided on them. We treat it as health data: only with your explicit consent, which you can withdraw whenever you want (section 9).

Your preferences. Working hours, weekly goals, windows in which you do not want suggestions, preferred time slots by type of activity, buffer around meetings, your lifestyle (no children, with children, student, professional), country, region and public holidays of your city, preferences for planning holidays, visual theme, first day of the week and time format.

Your lifestyle (for example, "with children") is optional: it only serves to adjust the suggestions, and you may choose not to provide it.

What you do with the suggestions. What you accept, what you edit and what you reject, so that we do not suggest again what you do not want. A rejection counts for less and less (half each week) and after 60 days it stops counting.

Your days-off plans. What you ask the planner for (holiday days, region, fixed dates) and the plan it suggests to you.

Shared holiday plans. If you plan your days off with another person, we store the plan (the year, what you both prefer and the result), who is taking part and the email with which you invited the other person. That person has to have their own Calma account: we do not write to that email, and the person who invites does not know whether the other has an account until they reply. Each of you sees the plan and the first name of the other, never their calendar or their wellbeing data; what each of you enters for the calculation (your days, your region, your public holidays) is used by the server and does not reach the other person's browser.

Your location, only if you use it. In Settings → Location you can ask Calma to use your phone's location, and in "Ask Calma" it is used so that nearby places appear first. It is requested by your phone or your browser with its own permission: in the mobile app, the approximate location, never the precise one or in the background. We do not store your position: it only lives for a short while in the app's memory. In Settings, we send it to Google to find out your country and your region, and we store only that, as if you had chosen it by hand.

What you ask Calma and the places you search for. The text of what you ask in "Ask Calma" ("find me a slot to get some blood tests done") is not stored: it is used at that moment to find slots for you and, if the app does not understand it on its own, it is read by the AI (section 6). It may contain health data if you write it; we do not store it or use it for anything else. If you say where ("go for a run in the Retiro"), we send that name to Google to find the place, with your country and, if you have allowed it, your approximate position; this is not stored on our servers or in the logs either. The place you choose goes into the event (and into your calendar, if you upload it), and the places you have already used are remembered only on your device.

If you are interested in Calma Plus. When the app shows Calma Plus and you open its screen, we store where you came from and how many times you have seen it; if you sign up for us to notify you, when; and, if you answer the price survey, the four prices you write. All of it is voluntary.

If you subscribe to Calma Plus. In our database we store your plan (free or Plus), whether it is monthly or yearly, where you subscribed (on the website, on the App Store or on Google Play), its status (active, cancelled at the end of the period, payment pending…), until when it is paid and whether it renews, and the identifier of the subscription or purchase. If you pay on the website, also the customer identifier Stripe gives you. We never store your card details: they do not go through Calma.

• On the website, when you pay you give Stripe your email, your name, your billing address (needed to know which VAT applies) and your card or payment method details; Stripe also receives technical data from your browser and your IP address, to prevent fraud. With the purchase and billing data, Quaderno issues your invoice and emails it to you.
• In the app, you buy with your Apple or Google account, and they are the ones who charge you: Calma does not see your name, your email or your payment method in the store. Through RevenueCat we know what you have bought, when, in which store and country, at what price and until when it lasts, linked to your Calma account's internal number.

If you take part in the closed test. The surveys at the start and at the end of the test (in Google Forms) ask about your stress and your wellbeing, which are health data, about your experience with Calma and about what you would pay for Plus. Only with your explicit consent, which you give in the survey itself. We identify you with a tester code, not with your name or your email, and the answers are not cross-referenced with your Calma account. They are seen only by the Calma team (three people).

Deleted events. When you delete an event, it is kept for 7 days in a trash so that you can recover it, and then it is deleted.

Technical data.

• For each sign-in, the IP address and the browser, for security (stored by the account system, Supabase).
• How many AI suggestions you have requested today and the latest response (so as not to call the model twice for the same thing and to respect the daily limit).
• How many requests to "Ask Calma" and how many place searches you make each day, to respect their limits: only the number, without the text. The same for the other features with a daily limit (the planner, the week plan, shared plans and downloading your data).
• When an account is created, to detect bulk sign-ups and temporary email addresses: the approximate network you sign up from (not the full IP address), the email domain (what comes after the @) and how you sign up (email, Google, Apple or Microsoft). It is not stored with your email or your account.
• A log of AI decisions (section 6).
• App errors: the error message, where it occurred (the route, without parameters), the browser and the app version. Before it is stored, email addresses, session tokens and long keys are removed from it.
• Performance technical traces (which operation took how long), without the content of your data.
• Visits to the public website (the home page, the holiday and time-off pages, the legal and support pages): which page, which website you came from, the country, the device type and the browser. No cookies and nothing stored on your device, without identifying you, and never inside the app.

What we do not process. There is no advertising, no commercial profiling, and no third-party or analytics cookies.

4. For what purpose and on what legal basis

Saving your mood, and letting the AI use it, is optional and off by default, each with its own box. If you do not turn it on, or you turn it off, Calma works the same: your mood only filters the suggestions on your device, as it does now.

Verifying with your health app is optional and is off by default. If you do not turn it on, or you turn it off, Calma works the same: your scheduled activities keep counting towards your goals as they do now.

5. Google, Outlook and Apple

Google Calendar

If you connect Google, Calma requests these permissions, and only for this:

• See your calendars and events (calendar.readonly): to know when you are busy and to find slots.
• Create, change and delete events (calendar.events): to upload to your Google what you schedule in Calma, and to delete from Google the events that you delete from Calma, whether or not they are Calma's: before deleting, we warn you that it will also be deleted there. If in Settings you choose "Ask me", we ask you for confirmation before uploading anything to Google.
• Create its own calendar (calendar.app.created): a "Calma" calendar where the activities go, separate from yours.

Limited use. Calma's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: your calendar data is only used to provide you with the Calma features you see in the app; it is not sold, it is not used for advertising, it is not used to train general AI models, and no person reads it unless you ask for it (for example, to resolve an issue), it is necessary for security or it is required by law.

You can disconnect Google in Settings. Imported events stop being shown in Calma. You can also withdraw the permission from your Google account.

Outlook (Microsoft 365 or personal Microsoft account)

You can sign in to Calma with your Microsoft account and, in the same step, connect your Outlook calendar; or connect it later from Settings. Calma requests these Microsoft permissions, and only for this:

• Know who you are (openid, email, profile, User.Read): your name and your email, for the Calma account and to show you which account is connected.
• Read and write in your calendars (Calendars.ReadWrite): to know when you are busy and to upload to Outlook what you schedule in Calma.
• Renew access without asking you (offline_access).

We do not request access to your email, your contacts or your files. We process Outlook data under the same rules as Google data: only for the Calma features you see in the app; it is not sold, it is not used for advertising or to train AI models, and no person reads it unless you ask for it, it is necessary for security or it is required by law.

You can disconnect Outlook in Settings, and withdraw the permission from your Microsoft account (Privacy → Apps and services).

Sign in with Google

You can sign in to Calma with your Google account ("Sign in with Google"). Google only gives us your name, your email and an identifier to recognise you next time. In the mobile app, sign-in uses the phone's own sign-in, without opening the browser. Signing in with Google does not give access to your calendar: if you also connect it, Calma requests the permissions above and stores the permission to renew access encrypted (section 3).

You can stop using Sign in with Google with Calma from your Google account (Security → Your connections to third-party apps & services).

Sign in with Apple

You can sign in to Calma with your Apple ID ("Sign in with Apple"). Apple only gives us your name and your email, plus an identifier to recognise you next time. It does not give us access to anything else in your Apple account.

If you choose to hide your email, Apple gives us an address of its own (@privaterelay.appleid.com) that forwards to yours. Calma only uses it for your account emails, and sends them from no-reply@aihacks-es.com, which is registered with Apple for that forwarding. If you already had a Calma account with your email and you hide it, Apple gives us a different address and a new account is created: to use the one you had, sign in with your email or share your real email with Calma.

You can stop using Sign in with Apple with Calma from your iPhone (Settings → your name → Sign-In & Security → Sign in with Apple → Calma) or at account.apple.com.

6. Artificial intelligence

Calma uses Gemini, from Google, to suggest activities to you in the free slots in your calendar. The app indicates which suggestions come from the AI.

What is sent to the model: the times and durations of your events for the day (without titles, locations or attendees), your working hours, your do-not-disturb windows, how far along you are with your goals, your lifestyle, the language, the time format and a summary of what you usually accept or reject (for example, "exercise, around 07:30"). Not sent: your name, your email or anything read from your health app; your mood, only if you allow it (below). The health sessions you choose to add to Calma count as completed activities, so they are included in "how far along you are with your goals" (only the number of exercise sessions and the minutes of meditation in the week) and, if they are from today, as a busy slot (time and duration, without a title).

Your mood, only if you allow it. If in "Save my mood" you also tick that the AI may use it, the request for suggestions includes how you feel now and how your recent practices felt (better, the same or worse, by type of practice): no free text and not your whole history. When you choose how you feel in the Calendar, the app asks for new suggestions, within the daily limit. "Ask Calma" does not receive it. The log of AI decisions only records whether your mood was taken into account, not what it was.

"Ask Calma". If the app does not understand on its own what you ask it, we send it to the model so that it says what to look for: what it is, how long it lasts, in what time slot and on which days. Along with your request go your events for the next two weeks with their title (60 characters at most), their time and their duration, your working hours and your days off: without the titles it would not understand requests such as "after the gym". Those events include the sessions you chose to add from your health app, with their type ("Workout" or "Meditation"), time and duration; if you gave your health consent before 20 October 2026 and have not reviewed it again, they go without a title. Not included: locations, attendees, your name or your email. Neither your request nor the response is stored; in the decision log only the type of activity, the time slot and the duration remain. The slots are chosen by the app with its rules, not by the model. At most, 5 a day.

The decision log. To be able to explain what the AI suggested to you and with which version, we keep for 180 days, identified only by your account's internal number: the model, the version of the instructions, a summary of the suggestions (which activity, at what time, how long it lasts, with what confidence) and what you did with each one. We do not store what was sent to the model or its text response.

No automated decisions with effects. What Calma proposes are only suggestions: nothing is scheduled without your accepting it, and they do not produce legal effects or significantly affect you (art. 22 of the GDPR).

If the AI is not available, or you have reached the daily limit, the suggestions come from fixed rules within the app, and this is indicated.

7. Who it is shared with

We do not sell your data or pass it on to anyone for their own purposes. It is processed on our behalf by these processors, under contract:

And third parties that are not processors:

• Google Calendar and Microsoft Outlook, when you connect them: they are your accounts, and Calma reads and writes in them on your behalf.
• Browser notification services (Apple, Google and Mozilla, depending on your browser), if you turn on notifications in the browser: they carry the notification to your device. The content is end-to-end encrypted: the service sees which device it is going to, not what it says.
• Google Workspace (Gmail), in addition to the account emails, receives a notice of each "Found a bug?" report in the Calma team's mailbox: only that there is a new one, without what you say or your screenshots, which are stored in our database (Supabase).
• Anthropic (Claude), an AI assistant, reads the text of "Found a bug?" reports to group and sort them. It receives only what you wrote and technical data (the screen, the app version and the language), without your name, your email, your account or your screenshots, and with any emails, phone numbers and links appearing in the text struck out. It cannot know who wrote it. Anthropic processes it in the United States.
• Apple (Apple Distribution International Ltd., Ireland, on the App Store) and Google (Google Commerce Ltd., Ireland, on Google Play), if you buy Plus inside the app, once the app offers it: they sell you the subscription in their own name, charge you, collect the VAT and handle renewal, cancellation and refunds. They process your purchase data as controllers, under their own privacy policies. Calma only receives, through RevenueCat, what is described in section 3.
• The Spanish Tax Agency (Agencia Tributaria), which receives the invoicing records of the website invoices (VeriFactu), because the law requires it.

Apple Health and Health Connect (mobile app) do not receive anything from Calma: they are on your phone, and Calma only reads from them what is described in section 3, with the permission you give it in the system. What Calma reads from them is not used for advertising, is not sold, is not stored in iCloud or in any other cloud and is not used to train AI models.

Public holidays. To show public holidays in the Calendar, your browser requests them from Nager.Date (date.nager.at), a free public holidays service. The request only contains your country code and the year, but, like any internet connection, Nager.Date also receives your IP address and the browser's technical data. We do not send it your account, your calendar or any other data. Calma stores the response in your browser for 30 days, so the query is repeated at most once a month per country and year. If Nager.Date does not respond, the Calendar works the same, without the public holidays. Nager.Date is an independent service: how it processes that data is set out in its own terms.

Transfers outside the EU. Supabase, Google, Apple, Cloudflare, Umami, Anthropic, Stripe and RevenueCat are US companies and may process some data outside the European Economic Area. They do so with the safeguards of the European Commission's standard contractual clauses and, where applicable, of the EU-US Data Privacy Framework.

8. How long

9. Your rights

You can request access, rectification, erasure, objection, restriction and portability by writing to soporte@aihacks-es.com.

• Deleting your account is something you can do yourself from Settings → Delete Account: your account and everything associated with it are deleted immediately, and Calma also withdraws the permission you gave it in Google. You remove the Microsoft one yourself from your Microsoft account (Privacy → Apps and services); Calma can no longer use it, because it deletes the renewal code along with your account. Your data may remain in the database backups for at most 30 more days (section 8). What Calma uploaded to your Google Calendar or your Outlook stays in that account, which is yours; you can delete it there (in Google, the entire "Calma" calendar, if you wish).
• If you have Calma Plus and delete your account: if you subscribed on the website, Calma first cancels your Stripe subscription, so that you are not charged again; your invoices are kept for the period the law requires and your Stripe customer record for 120 days (section 8). If you subscribed in the app, cancel it first from your Apple or Google Play account: Calma cannot do it for you.
• Rectification: almost everything can be changed from Settings. Your name and billing address, in "Manage subscription" (Stripe portal).
• Leaving the waiting list: write to us at soporte@aihacks-es.com from that email and we will delete it. If you did not confirm it, it is deleted automatically after 7 days.
• Withdrawing health consent (mobile app): turn off "Verify with Health" in Settings. All your verifications are deleted immediately and Calma stops reading your health app. The sessions you added stay as activities: delete them from the Calendar if you do not want them. To also remove the system permission: on iPhone, Settings → Health → Data Access & Devices → Calma; on Android, in the Health Connect app → App permissions → Calma.
• Withdrawing mood consent: turn off "Save my mood" in Settings. All your moods are deleted from our servers immediately and the AI stops receiving them. If you only want the AI not to use it, untick that box: your history stays. What you note after turning it off stays only on your device.
• Downloading your data (access and portability): from Settings → Download my data, in a file with everything Calma stores about you.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es).

10. Minors

Calma is for people aged 16 and over: when you register, you confirm that you are. If we learn that an account belongs to a minor, we will delete it.

11. What is stored on your device

Calma does not use cookies. It stores in your browser's local storage what is essential for it to work: your session, the temporary Google Calendar permission (deleted when you sign out), your preferences for language, theme, first day and time format, which sections you have collapsed and which notices you have already seen. If you install the app, it also stores a copy of the screens and of your latest data so that it can be opened offline; this is deleted when you sign out. In the mobile app, if you turn on notifications, the system stores the notifications scheduled for today and tomorrow (the activity title and the time); they are deleted when you turn them off. If you turn on "Verify with Health", it also stores which sessions from your health app you have already added or ignored (only their type and start time, for 14 days), so as not to offer them to you again. All of this is technical and necessary, so it does not require consent. In addition, if you note how you feel after a practice, it is stored on your device (the mood, the type of practice and the day) to show it to you in your Journey; it only leaves your device if you turn on "Save my mood" (section 3).

The mobile app updates itself: it downloads new versions of the web app from Calma's server (calma.aihacks-es.com), without going through third parties.

12. Security

Connections are encrypted (HTTPS). Each person can only read their own data: this is enforced by the database (row-level security policies), not just by the app. The services' keys do not leave the server.

13. Changes

If we change this policy in a significant way, we will tell you in the app before it applies.