Privacy

Short version: what you write stays in your browser unless you sign in

No account, and nothing you type is collected. Your tasks, day notes, day colours, countdowns and settings are saved in this browser's local storage, on this device, and nothing you type is transmitted anywhere.

Clearing your browser's site data, or using Delete everything in the footer, removes it permanently. If you are not signed in there is no copy elsewhere to restore from, so use Backup first if you might want it later.

Crash reports

If a page hits a JavaScript error, a short report is sent so it can be found and fixed. This happens whether or not you are signed in, and it is the only thing this site sends without you asking.

A report contains the error message, the line of code that failed, the page address without its query string, and your browser and operating system version. It is tied to a random number generated fresh each time a page loads, which groups the errors from one visit and is discarded when you close the tab.

It never contains your tasks, notes, countdowns, email address or sign-in token, and it is never used to identify you or to build a profile. Reports are deleted automatically after 30 days.

Signing in is optional. Its only purpose is to sync your board across your devices.

Sign-in is handled by Supabase, using whichever provider you choose - Google, Microsoft, GitHub, or a one-time link sent to your email. We receive your email address and a user ID from that provider. We never see or store your password.

Once signed in, your tasks, day notes, day colours, countdowns and settings are stored in a database hosted in the EU (Frankfurt) so they can reach your other devices. That data is yours: it is readable only by your own account, enforced by the database itself, and it is not sold, shared or used for advertising.

You can sign out at any time. You can also delete your account yourself, without asking anyone: click your initials in the top right, open Danger zone, and confirm. That removes your account and every task, day note, countdown and setting attached to it, immediately and on every device. It cannot be undone and there is no copy kept, so use Backup first if you might want one. If anything goes wrong, email hello@inmycalendar.com.

Crash reports are the one exception, and they are un-linked rather than deleted: the account they came from is erased from them, leaving a record that carries no name, no address and nothing you typed. Those disappear on their own within 30 days.

Backups you make yourself

Backup and Export tasks write a file to your own device. What happens to it after that is up to you; it is not uploaded anywhere.

Public holiday data

Holiday dates for 247 countries are files served from this site. Choosing a country loads one small file; it does not tell anyone where you are, and no location data is collected.

Nothing is loaded from anywhere else

Every file this site needs comes from this site. No fonts from Google, no libraries from a CDN, no trackers, no embedded widgets. Opening any page here contacts no third party at all, so no third party learns your IP address or that you visited.

This page previously said that two typefaces loaded from Google Fonts and that Google therefore received your IP address. That was true and it was disclosed, but disclosing a transfer is not the same as having a reason to make it. The two typefaces are now served from this domain, and the Supabase library that sign-in needs is served from here too rather than from a public CDN. Pages also load faster as a result.

Page counts

Pages are counted, so it is possible to tell which parts of the site are used and whether a change helped. This page used to say "no analytics", and that wording was changed when counting was added rather than left standing while it quietly stopped being true.

Nothing counted can identify you. There is no cookie, no stored identifier, no session and no fingerprint. Four things are recorded and no others: the page address without its query or fragment, the host of the site you followed a link from if it was not this one, your screen width rounded to one of four buckets, and whether a task was added. The text of a task is never sent, only that one was created.

Because there is no identifier, two visits by you cannot be told apart from visits by two different people. That is a deliberate limitation, not an oversight: it means the counts cannot say how many people came or whether anyone came back, and it also means nothing here can follow you anywhere.

If your browser sends Do Not Track or Global Privacy Control, nothing is counted at all.

Counts are deleted automatically after 180 days. They exist to show whether a change to the site helped, which is a question about weeks and months, not years.

Cookies and tracking

No tracking or advertising cookies are used. Neither the page counts nor the crash reports are tracking: both carry no stored identifier and cannot follow you between visits. Local storage is not a cookie and is not sent with network requests. If you sign in, a session token is stored in your browser so you stay signed in; it does nothing else.

If this changes

Advertising is planned for a later version. It would change what is collected, and this page will be updated before it goes live. Advertising will also require a consent banner for visitors in the EU and UK.