Privacy policy

Throughout this policy, the host is the person with a PhoneCalendar account who publishes availability, and the guest is the person who receives a booking link and picks a time. Hosts and guests are treated differently because they give us different data for different reasons.

Phone & Calendar is our iPhone and iPad app. It adds encrypted messaging and calling on top of booking. It is run by the same team under this policy, and collects the following:

• Phone number — your account identifier. We send a one-time sign-in code to it over WhatsApp. It is visible to people you message or book with.
• Name, booking handle and timezone — shown on your booking links and to people you chat with.
• Contacts — on your device only.If you allow access, the app reads your address book on the phone so you can pick who to send a booking link to. Your address book is never uploaded to our servers. The “contacts” list inside the app is built only from people you have actually booked or called.
• Messages, photos, videos, voice notes, shared locations and contact cards — end-to-end encrypted on your device with the Signal protocol before they are sent. Our servers store only encrypted data until it is delivered (undelivered messages are deleted after 30 days) and cannot read it. Encrypted media files are deleted after 30 days.
• Voice and video calls— call audio and video travel directly between the two devices, encrypted with WebRTC (DTLS-SRTP); our servers only pass the signalling needed to connect the call. To find a direct route, each device contacts a public STUN server (operated by Google), which sees the device’s IP address but no call content. We keep call metadata (who called whom, when, and for how long) to run the service.
• Calendar — if you allow it, the app writes confirmed bookings to your device calendar. We never read your other calendar events.
• Camera, microphone, photo library and location — used only when you take an action (start a call, record a voice note, attach a photo, share your location). Nothing is collected in the background.
• Device and push tokens — to deliver message and call notifications, and the public encryption keys your device publishes so others can message you.
• Abuse reports — if you report someone, we store who reported whom, the reason and any details you add, and we block that user for you.

The app contains no advertising, no third-party analytics or tracking SDKs, and we do not track you across other companies’ apps or websites.

Deleting your account: in the app, open the You tab and tap Delete account. Your account, availability, booking links, bookings, encryption keys and undelivered messages are deleted from our servers immediately, and the app wipes your keys and chat history from the device.

• Account email address — used to identify your account, sign you in, and send service messages such as security notices. If you sign in with a passkey we also store the public key and credential identifier for that passkey; we never receive your biometric data.
• Profile details you choose — display name, booking handle, timezone and an avatar colour. Your display name and handle appear on your booking pages, so treat them as public.
• Your own WhatsApp number — optional. Provide it only if you want a copy of each scheduled event created in your own WhatsApp chat.
• Schedule configuration — weekly hours, call length, buffers, notice periods, date overrides and event templates.
• Session and security data — a session token, plus the IP address and user agent attached to that session, so you can recognise and revoke sign-ins.

A guest never creates an account. When a guest books, we collect only what is needed to create the event:

• Name — used in the event title and description so both parties know who the call is with.
• Phone number in international format — this is the WhatsApp destination for the scheduled event. Without it there is no way to deliver the booking.
• Email address — optional, and collected only where a host has asked for it.
• Booking times — the start and end of the slot chosen, the timezone it was chosen in, the booking status, and any later cancellation or reschedule.
• A private management link — a random token that lets the guest cancel or reschedule without an account. Anyone holding that link can manage that booking, so it should not be shared.

Where a host creates an invite for a specific guest in advance, the host supplies that guest’s name and number to us at invite time rather than the guest entering it themselves. The host is responsible for having a proper basis to share those details.

This is the most important disclosure in this policy, so it has its own section. To create the calendar event, we transmit the guest’s phone number to WhatsApp, together with the event title, description, location, start and end times, and whether the event is a video call, a voice call or neither. The number is used as the address of the WhatsApp chat the event is created in. If the host has enabled a host copy, the same event details are also sent to the host’s own WhatsApp number.

Once that data reaches WhatsApp it is handled under WhatsApp’s and Meta’s own privacy terms, not ours, and we cannot delete it from their systems on your behalf. If a guest does not want their number sent to WhatsApp, they should not complete the booking and should instead arrange the call with the host directly.

We also keep a short-lived delivery queue containing the outbound payload for each booking, so that a failed send can be retried and so that a cancellation can update the event we previously created. Anything the host writes into an event template — including free text in a description — is sent to WhatsApp as part of the event, so hosts should keep sensitive detail out of templates.

• To work out which slots are genuinely free and show them to a guest.
• To create, update and cancel the WhatsApp scheduled event for a booking.
• To let a host see and manage their upcoming bookings.
• To let a guest cancel or reschedule using their management link.
• To keep the service secure and working — rate limiting, abuse prevention, debugging failed deliveries, and keeping backups.

We do not sell personal data, we do not use guest phone numbers for marketing, and we do not send guests promotional messages. A guest hears from us only in connection with the booking they made.

• The host sees the name, number, chosen time and any note or email address attached to a booking made with them.
• WhatsApp / Meta receives the data described in the section above, for the purpose of creating the event.
• Infrastructure providers — hosting, database and email delivery vendors process data on our instructions in order to run the service.
• Legal requests — we disclose data where we are legally required to, and will tell you unless we are prohibited from doing so.

• Booking records — including guest name, number and times — are kept for 24 monthsafter the booking’s end time, so hosts have a usable history and so disputes can be resolved. After that they are deleted.
• Delivery queue entries holding the outbound WhatsApp payload are deleted 30 days after the event is delivered or permanently fails.
• Unused and expired invites are deleted 90 days after they expire or are disabled.
• Sessions are deleted at expiry. Temporary slot holds expire within minutes.
• Host account data is kept while the account is open. If you delete your account, your schedules, invites and bookings are deleted with it within 30 days, except where we must keep a record to meet a legal obligation.
• Backups roll off on their own schedule, within 35 days of the live deletion.

Deleting a booking here does not delete the event WhatsApp already created; cancelling a booking through PhoneCalendar will attempt to update or cancel that event.

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict how we use it, and to complain to your data protection authority. Guests can exercise these rights too, even though they have no account — write to us at the address below with the phone number used and we will locate the bookings tied to it.

Where a host has uploaded a guest’s details, the host controls that record; we will pass along a request that is properly the host’s to answer.

Data is encrypted in transit. Booking management links and invite links are long random tokens rather than guessable identifiers, and access to production data is limited to people who need it to operate the service. No system is perfectly secure, so please tell us promptly if you believe an account or a link has been compromised.

PhoneCalendar is not directed at children under 16, and we do not knowingly create host accounts for them. If you believe a child’s data has been provided to us, contact us and we will delete it.

If we make a material change we will update the date at the top of this page and, for hosts, notify the account email before the change takes effect.

Questions, requests or complaints about privacy go to [email protected] or the support form. We aim to reply within 30 days. See also our terms of service.

PhoneCalendar is an independent product. It is not affiliated with, endorsed by or sponsored by WhatsApp LLC or Meta Platforms, Inc.