Privacy Policy
Effective 17 August 2026.
calmcontacts stores your contacts and follow-up notes on our servers so the iPhone app can sync them across your devices, and can pass them to an AI assistant when you ask it something. This policy explains what we collect, how we use it, and the control you have — consistent with the Australian Privacy Act 1988 (Cth). By using the service you agree to the handling of information described here.
What we store
- Your email address — used to sign you in (a one-time code is emailed to you; there is no password).
- Your contacts and journal — the people you track (name, company, title, email, phone, location), the dated notes you write about them, and the next step you have set for each. These are stored in our database so they are available across your devices.
- Session data — an authentication token (held in an HttpOnly cookie for the web app) that keeps you logged in.
- Log data — standard technical logs such as IP address, request time, and error diagnostics. Verification codes and credentials are never written to logs.
How your data moves
- The iPhone app keeps its own offline copy and reconciles with our server over HTTPS.
- When you use the assistant, the parts of your contact data needed to answer you — the records it looks up, and the notes on them — are sent to Anthropic's Claude API for that request. See Third parties below.
- The nightly "what's due" email summary is generated by a model running on our own server. Your contacts are not sent anywhere for it.
- Each user's data is isolated at the database level; one account cannot read or write another's records.
- All traffic is encrypted in transit (HTTPS/TLS).
Third parties
We keep third parties to the minimum needed to run the service:
- Linode (Akamai), our cloud host, where the service and your data are stored. Data may be hosted in the United States and other countries.
- SendGrid, to deliver your login codes and occasional notification emails.
- Anthropic, only when you use the assistant, and only for the contact records that request touches. If you never open the assistant, none of your contact data is sent to Anthropic. Anthropic processes it to answer that request under its API terms and does not train its models on it.
These providers process data on our behalf and, to the extent permitted by law, are obligated not to use it for any other purpose.
Your control
- Export your contacts anytime as CSV.
- Avoid the assistant if you would rather nothing left our servers — everything else in the product works without it, including sync, import, export and the nightly digest.
- Wipe all your contacts, journal entries and follow-ups.
- Delete your account entirely.
Retention and deletion
Deleted content is removed from your active data immediately and may persist in encrypted backups for up to 30 days for disaster recovery, after which it ages out. Deleting your account removes your records from the active system on the same basis.
Security
We protect your data with HTTPS/TLS in transit and per-user access isolation enforced in the database, so a request carrying another account's record identifier is rejected rather than served. No system is perfectly secure, and we cannot guarantee absolute security.
Children's privacy
The service is not directed to anyone under 13, and we do not knowingly collect their personal information.
Access
You may request access to the personal information we hold about you at any time, by using our contact details below. We will promptly acknowledge your request for access and let you know when we will provide you with the requested information. If we refuse access, we will provide you with a written notice which sets out (unless the law allows us not to specify a reason) the reasons for the refusal and how you can complain about our refusal. We may recover our reasonable costs for giving access to your personal information.
Correction
We seek to ensure that the personal information we hold is accurate, up-to-date, complete and, in the case of use and disclosure, relevant.
Where we believe that the information we hold is inaccurate, out-of-date, incomplete, irrelevant or misleading, we will take reasonable steps to correct that information and (if you ask and it is reasonable and practicable for us to do so) to notify that correction to third parties that may have received the incorrect information from us. If you believe that information we hold about you should be corrected, you may also request that we do so, by using our contact details below.
If we do not agree with the corrections you have requested, we are not obliged to alter your personal information. Instead, we will give you a written notice which sets out (unless the law allows us not to specify a reason) the reasons for our refusal and how you can complain about our refusal. You can also ask us to associate a statement with the relevant information that puts your view that it is inaccurate, out-of-date, incomplete, irrelevant or misleading. We will not charge you for making a correction request, for correcting your information or for associating a statement with your information.
Enquiries and complaints
If you have any enquiries, concerns or complaints about this privacy policy, our handling of your personal information or our compliance with the Australian Privacy Act 1988 (Cth) or any related codes, please contact us at admin@calmcontacts.com.
We usually respond in writing within 30 days, unless we need further information to respond to your enquiry, concern or complaint.
If you would like to make an enquiry or complaint about how we handle your personal information, you can also contact the Office of the Australian Information Commissioner on 1300 363 992 or via email at enquiries@oaic.gov.au.
Changes
We regularly review this policy and may make changes to it from time to time, without notice to you. An up-to-date copy is always posted on this page.
This policy is effective as of 1 August 2026 and was last amended on 14 August 2026.
Contact
Questions? Email admin@calmcontacts.com.