Privacy Policy

Last updated: August 6, 2026

Circadium is a personal scheduling app. It takes your goals, tasks, and commitments and produces a placed weekly calendar. This policy explains what data we collect, how we use it, and — specifically — how we handle data accessed through Google APIs.

Who we are

The data controller responsible for your personal data is [Your name or company], based in Sweden. You can reach us about any privacy matter at support@circadium.app.

Data we collect

When you use Circadium we store the information you create in the app: your tasks, goals, plans, categories, locations, weekly templates, and scheduling preferences. To sign you in we store your account details (email address and, if you register with a password, a securely hashed password). If you sign in with a third-party provider such as Google or GitHub, we receive your basic profile information from that provider.

Google Calendar data

If you choose to connect your Google account, Circadium requests read-only access to your Google Calendar using the https://www.googleapis.com/auth/calendar.readonly scope. We request the narrowest scope that supports the feature: we can read your calendar events, and we can never create, edit, or delete them.

We use this access for a single purpose:

  • To display your existing Google Calendar events inside Circadium.
  • To treat those events as busy time, so the scheduling engine plans your tasks and goals around commitments you already have.

You can disconnect your Google account at any time from Circadium's settings, which revokes our access and removes the imported event data from your account.

Calendar events can sometimes reveal sensitive details (for example, a medical appointment). Circadium treats every event purely as busy time to schedule around — we do not read into, categorize, or infer anything from the content of your events.

Limited Use disclosure

Circadium's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell your Google user data. We do not share or transfer it to third parties except as necessary to provide the scheduling feature to you. We do not use it for advertising, and no humans read your calendar data except where required for security, to comply with the law, or with your explicit consent.

Legal basis for processing

Under the GDPR, we process your data on these bases:

  • Performance of a contract — to provide the Circadium service you signed up for: storing your tasks, goals, and preferences, and generating your schedule.
  • Consent — for optional features you switch on, such as connecting your Google Calendar or using the AI assistant. You can withdraw consent at any time by disconnecting the integration or removing the key.
  • Legitimate interests — to keep the service secure and working, provided this does not override your rights.

How your data is stored and protected

Your data is stored in a hosted PostgreSQL database and is scoped to your account — every request is authenticated and access is limited to your own records. Your Anthropic API key, if you use the optional AI assistant, never reaches our servers: it is encrypted and stored only on your device. Access to Google Calendar data is protected by the same account-scoping and is never exposed to other users.

Analytics

We use PostHog, hosted in the European Union, to understand how Circadium is used and to improve it — for example which features are used and where people get stuck. Our analytics is cookieless: it stores nothing on your device (no cookies, no local storage, no persistent identifiers), which is why Circadium shows no cookie banner. When you are signed in, analytics events are linked to your account id so we can understand usage across visits.

We may also record how the app's interface is used (session replay) to diagnose problems and improve usability. Everything you type is masked in these recordings before it leaves your browser. Analytics data is used solely to improve the product — never for advertising, and never sold or shared beyond the provider that processes it for us. We process this data on the basis of our legitimate interest in improving the service.

Service providers we use

We do not sell your personal data or your Google user data. We share data only with the infrastructure providers (sub-processors) that run Circadium, strictly to operate the app and only as required by law:

  • Hosting and application delivery (Vercel).
  • Database storage (Neon).
  • Transactional email, e.g. sign-in and verification (Resend).
  • Product analytics and session replay (PostHog, hosted in the EU).
  • Sign-in providers you choose to use (Google, GitHub) and Google Calendar, when you connect them.
  • The AI assistant, which is optional and runs on your own API key: when you use it, the goals and tasks it works on are sent from your browser directly to Anthropic to generate a response.

International data transfers

Some of our service providers are located outside the European Economic Area, including in the United States. Where your data is transferred outside the EEA, we rely on appropriate safeguards — such as the EU–U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses — to ensure it receives an equivalent level of protection.

Retention and deletion

We keep your data for as long as your account exists. You can delete your account from Circadium's settings at any time; doing so permanently removes your data, including any imported Google Calendar events. Disconnecting your Google account removes the imported calendar data without deleting the rest of your account.

Your rights

If you are in the EU/EEA, the GDPR gives you the following rights over your personal data, which you can exercise in the app or by contacting us:

  • Access — get a copy of the data we hold about you (Settings → Data & export).
  • Rectification — correct inaccurate data by editing it in the app.
  • Erasure — delete your account and all associated data (Settings → Danger zone).
  • Portability — export your data in a machine- readable JSON format (Settings → Data & export).
  • Restriction and objection — ask us to limit or stop certain processing.
  • Withdraw consent — for anything based on consent, such as disconnecting your Google account.

You also have the right to lodge a complaint with your data- protection authority. In Sweden this is the Swedish Authority for Privacy Protection (IMY, imy.se).

Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above. Material changes will be communicated in the app.

Contact

Questions about this policy or your data? Contact us at support@circadium.app.