Privacy Policy

Last updated: October 11, 2026

Calpy is an app that lets university students share their class schedules and see whether their friends are free or busy right now. This policy explains what data is processed when you use Calpy, why, who it is shared with, and your rights.

In short: we don't show ads, we don't sell your data, and the app contains no analytics or advertising tools that track you. Only people whose friend request you accepted can see your schedule. You can delete your account from inside the app at any time.

1. Data we collect

Account

• Your school email address: used to sign in. There is no password; you sign in with a one-time code sent to your email.
• Your university: determined from your email domain.

Profile

• Your name and avatar choices (hair, skin tone, clothing and so on; an illustration, not a photo).

Schedule and events

• The name, place/room (optional), day, time, type, repetition and color of the classes and personal events you add.
• Classes you mark as "not attending" on a specific date.

Friends

• Friend requests you send and receive, your friends, and accounts you block.

Schedule photo

• If you choose to read your schedule from a photo, the screenshot you pick is sent to an AI service (Anthropic, see below) to extract your schedule. This photo is not stored on Calpy's servers. Only the number and time of readings are recorded, for the daily reading limit.

Device

• Notification addresses: your device's notification tokens and language, for friend notifications and the Live Activity cards on your lock screen.
• Copy on your phone: so you can view your calendar without an internet connection, a copy of your own profile and schedule is kept only on your phone. Your friends' schedules are not stored on the phone. This copy is deleted when you sign out or delete your account.

We don't use your location, contacts, camera or microphone. Your photos are accessed only when you choose a screenshot, and only that image.

2. Why we use your data

• To create your account and let you sign in.
• To show your schedule, and to show your friends whether you are free or busy right now.
• To find friends and manage friend requests.
• To send friend notifications and Live Activity cards on your lock screen based on your classes.
• To prevent abuse (for example, the daily schedule reading limit).

We don't use your data for advertising, profiling or sale.

3. Who can see what

• Your friends (people whose request you accepted): see your schedule and current status. The names and places (if entered) of your personal events are also visible; you can leave the place empty if you prefer.
• Other Calpy users: when they search for you by name, or see you in suggestions because you have mutual friends, they see only your name, avatar and university. They cannot see your schedule.
• People you block cannot find you in search or send you requests.

4. Service providers (who data is shared with)

We use the following service providers to run Calpy. Each processes data only to provide its service.

• Supabase: database, sign-in and server infrastructure. Your data is stored in the European Union (Frankfurt, Germany).
• Resend: to email you the sign-in code (your email address).
• Anthropic (Claude): to read your schedule from a photo (only the image you choose to read). Anthropic processes data sent through its API under its commercial terms and does not use it to train its models.
• Expo and Apple: to deliver notifications to your device (notification token and notification content).
• Cloudflare: infrastructure for this website and the support email.

Some of these providers are located in the United States, so some data may be transferred outside your country. Transfers happen only for the services above and only as far as necessary.

5. Retention and deletion

• Your data is kept while your account exists.
• Some data is deleted automatically: classes from ended terms, past one-time events and "not attending" marks, sign-in attempts that were never completed (within about an hour), and notification addresses unused for 90 days.
• You can delete your account inside the app: Profile tab → Delete My Account. Your profile, schedule, friendships, blocks and notification addresses are permanently deleted. They may remain in server backups for a short time; backups are deleted automatically at regular intervals.

6. Your rights (GDPR and KVKK)

Under the EU General Data Protection Regulation (GDPR) and Turkey's Personal Data Protection Law No. 6698 (KVKK), you have the right to know whether your data is processed, to access your data and request a copy, to have it corrected, deleted or its processing restricted, and to object to its processing. You can change your name, avatar and schedule yourself in the app, and delete your account yourself. For any other request, write to us: support@calpy.app. You may also lodge a complaint with the data protection authority in your country.

7. Children

Calpy is intended for university students and is not directed at children under 13.

8. Security

Connections are encrypted (HTTPS). The database enforces rules so that each user can access only their own data and their friends' schedules. No system is perfect; if you notice a security issue, please let us know.

9. Changes to this policy

We may update this policy. For significant changes we will let you know through the app or this page. The current date is always shown at the top of the page.

10. Contact

For questions and requests: support@calpy.app