The Calmentum mobile application and its supporting services are provided by Calmentum EOOD ("Calmentum", "we", "us"), the controller of the personal data described in this policy.
If you are in the EEA or UK, we are the controller of the personal data described below.
Calmentum is a personal planning and recovery app. To work at all it needs to store the tasks you create and the progress you record. Beyond that:
| Data | Notes |
|---|---|
| Email address | Used to identify your account, sign you in, and contact you about the service |
| Username | Shown to other users where you take part in social features |
| Password | Stored only as a salted hash. We never store your password in readable form |
| Authentication identifier | If you sign in via Google Firebase Authentication |
| Profile photo | Optional. Stored with Cloudflare R2 in the EU |
| Goals | The goal categories you pick during onboarding |
Tasks and habits; planner schedules and scheduled instances; task completions; focus-timer sessions; journey (guided programme) enrolment and step completions; reset-day plans and your edits to them; archived tasks; custom recurrence rules and reminder rules; which sections you keep in your tab bar; and today's Spark — which daily message you were shown and whether you opened it. Only the current day's Spark is kept.
When you finish a Move session (breathing, walking and running, yoga or light training), we store that you finished it — the session's name, the day and the time — like any other completed task, so it can count towards your progress and "the days you moved this week". A session in progress is kept only on your phone. Spoken cues use your phone's own text-to-speech, and the cues you hear while the phone is locked are notifications your phone schedules for itself; neither sends anything to us.
Measuring distance — only if you turn it on. For a walk or run you can turn on "Measure distance". Your phone then reads its location (GPS) during that session only — including while the screen is locked, when your phone shows a notification saying so — and adds up how far you went. The locations themselves stay on your phone and are discarded as they are added up; they are never sent to us. When the session ends we store only the total distance with the finished session, so it can show the distance you covered this week. It needs your phone's location permission "while using the app", which you can withdraw in your phone's settings at any time.
Calmentum's recovery features record:
Depending on how it is interpreted, this may constitute health data under Article 9 GDPR. We therefore process it only on the basis of your explicit consent, given when you accept data processing at sign-up and each time you submit a check-in. The journal asks for its own consent before your first entry and records when you gave it. You can withdraw consent at any time by deleting your check-ins, by deleting all journal entries (Journal → Delete all entries, which also withdraws the journal consent), or by deleting your account. Journal entries are encrypted before they are stored. This data is never published to the feed, shown to other members of your circles, used to choose Spark messages, or used for advertising. It is used for one thing beyond showing it back to you: the recovery card on Home. Low energy check-ins, and — only while Personalized tips is on — several rough moods in a row in your journal, can make Home offer a lighter day or a reset. The words you write in your journal are never used for this or anything else.
Feed posts, including any completion-evidence photo and comment you choose to attach; comments and reactions; support circles you create or join, and shared intentions within them; accountability buddy invitations; abuse reports you submit.
Sharing a task completion to the feed is always an explicit, per-completion choice. Nothing is posted automatically.
App version, operating-system platform, and preferred locale; push-notification token, if you enable notifications; notification dispatch logs, so a reminder is not sent twice.
If a crash occurs and you have crash reporting enabled (Settings → Privacy → Crash diagnostics), we send the technical details of the crash — the error, the app version, and the device model and operating-system version — to Sentry, our crash-reporting processor. Crash reports carry no name, no email address, and no IP address, and you can turn them off at any time.
If, and only if, you enable analytics, we record a small set of named product events (for example app_opened, daily_plan_viewed, first_task_completed) with a timestamp and minimal properties, plus any A/B experiment group you were assigned to. These are stored against your account so we can honour a later deletion request. Events are buffered on your device and sent when a connection is available; unsent events are discarded after 7 days.
We do not collect precise location, contacts, or biometric data, and we use no attribution or tracking SDKs. Move uses GPS only when you turn on "Measure distance" for a walk or run, and then the locations never leave your phone — only the total distance does (section 3.2). It reads nothing from your body or from health apps: no heart rate, steps, weight, or other measurements. Our own servers never receive your device's advertising identifier; the ads SDK described in 3.8 reads it on your device and sends it to Google, not to us.
The free version of Calmentum may show ads. They are provided by Google AdMob (Google Ireland Limited) through a software kit inside the app.
When an ad is shown, Google collects from your device: its advertising identifier (on iPhone only if you allow tracking), your IP address and the approximate location derived from it, device and app information, and how you interact with the ad (whether it was seen or tapped). Google uses this to show and measure ads, to prevent fraud, and — only if you agree — to personalise them.
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and running your account | Contract — Art. 6(1)(b) |
| Storing your tasks, plans and progress | Contract — Art. 6(1)(b) |
| Sending reminders you configured | Contract — Art. 6(1)(b) |
| Wellbeing check-ins, recovery signals and journal entries | Explicit consent — Art. 6(1)(a) + Art. 9(2)(a) |
| Personalised task suggestions, and Spark messages built from your own progress | Consent — Art. 6(1)(a), toggleable in Settings |
| Product analytics and experiments | Consent — Art. 6(1)(a), off by default |
| Ads in the free version, and personalising them | Consent — Art. 6(1)(a), through Google's consent form, where the law requires it |
| Limited, non-personalised ads where you declined | Legitimate interests — Art. 6(1)(f): funding the free version |
| Social and community features | Contract — Art. 6(1)(b), only where you opt in |
| Moderating abuse reports | Legitimate interests — Art. 6(1)(f): user safety |
| Security, fraud prevention, service integrity | Legitimate interests — Art. 6(1)(f) |
| Meeting legal obligations | Legal obligation — Art. 6(1)(c) |
Where we rely on consent you may withdraw it at any time; this does not affect processing carried out before withdrawal. Where we rely on legitimate interests you may object — see section 8.
We share personal data only with processors acting on our instructions, and — for ads in the free version — with Google as an independent controller (section 3.8):
| Recipient | Purpose | Location |
|---|---|---|
| Google Cloud (Firebase Authentication, Cloud Firestore, Cloud Messaging) | Sign-in, primary data storage, push notifications to Android phones | europe-west1 (Belgium) |
| Apple Inc. (Apple Push Notification service) | Delivering notifications to iPhones, including the text of a reminder | Apple's global network |
| Google Cloud Run | Running the Calmentum API | europe-west1 (Belgium) |
| Cloudflare, Inc. (R2 object storage and CDN) | Storing and delivering the photos you upload | Stored in the EU; delivered through Cloudflare's global network |
| Functional Software, Inc. (Sentry) | Crash diagnostics, only while you have crash reporting enabled | EU data residency |
| Google Ireland Limited (AdMob) | Ads in the free version — an independent controller, not our processor | EU; Google may also process ad data in the US |
We may also disclose data where legally required, or to establish or defend legal claims.
We do not sell personal data. Where you allow personalised ads, Google's use of your device data for them may count as "sharing" for cross-context behavioural advertising under some US state laws; see section 12.
Other Calmentum users see only what the feature you used makes visible: your username and profile photo, your level (a single number that grows as you complete tasks — never the tasks themselves), anything you deliberately post to the feed, who you follow and who follows you, and your participation in circles you joined. You can hide your community activity in Settings → Privacy; while it is hidden, you are left out of other people's follower lists, nobody else can see yours, and your level is not shown to anyone else.
Your data is stored in the European Union. Photos you upload are cached by Cloudflare's content delivery network so they load quickly wherever they are viewed. Where a processor handles personal data outside the EEA or UK, we rely on the European Commission's Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum. Google may process ad data in the United States, relying on the EU–US Data Privacy Framework.
| Data | Retention |
|---|---|
| Account and content | Until you delete your account |
| Wellbeing check-ins, recovery signals and journal entries | Until you delete them or your account |
| Today's Spark | Replaced every day; removed 30 days after you last opened the app |
| Analytics events | 90 days |
| Notification dispatch logs | 30 days |
| Buffered analytics on your device | 7 days maximum |
| Backups | Up to 30 days after deletion |
| Abuse reports | 12 months, to support repeat-conduct review |
| Ad data collected by Google | Set by Google as an independent controller — see Google's privacy policy |
When you delete your account, your personal data is deleted immediately when you confirm; residual copies in backups are removed within 30 days, except where we must keep records to meet a legal obligation.
If you are in the EEA or UK you have the right to access, rectify, erase, restrict processing of, object to processing of, and port your personal data, and to withdraw consent at any time.
You can exercise the main ones directly in the app:
For anything else, contact privacy@calmentum.com. We respond within one month.
You may also complain to your local supervisory authority. Our lead authority is the Bulgarian Commission for Personal Data Protection (CPDP, www.cpdp.bg).
If you are a California resident, see section 12.
Passwords are stored as salted hashes. Traffic between the app and our API is encrypted in transit. Journal entries are additionally encrypted before they are written to the database, with a key held separately from it. Session tokens are held in the operating system's secure keystore on your device. Access to production data is limited to personnel who need it.
No system is perfectly secure. If a breach affects your rights and freedoms we will notify the relevant supervisory authority within 72 hours, and you without undue delay where required.
Calmentum is not directed at children. You must be at least 16 years old to create an account. If we learn that we hold data from a child below that age without a valid basis, we delete it.
Calmentum adapts your daily plan automatically — for example ordering tasks, suggesting an easy win, proposing a reset day, or flagging a possible burnout risk. These are suggestions only. They produce no legal or similarly significant effect, you can ignore or override every one of them, and they are not automated decision-making within the meaning of Article 22 GDPR.
We do not sell personal information as defined by the CCPA/CPRA. If you allow personalised ads in the free version, Google's use of your device data for them may count as "sharing" for cross-context behavioural advertising; you can opt out at any time in Settings → Privacy → Ad choices. You have the right to know, delete, correct, and to be free from discrimination for exercising those rights. Use the in-app export and deletion tools, or contact privacy@calmentum.com.
We may update this policy. The version identifier at the top changes when we do. For material changes we will notify you in the app and, where required, ask you to accept the new version before continuing.
Write to us at privacy@calmentum.com.