Privacy at Flexibits

Here are answers to some common questions about how Flexibits and our apps use and store your data.

Give me the short version

• Flexibits complies with the requirements of GDPR.
• Flexibits products collect as little personal information about you as possible.
• A Flexibits account stores your name, email address, and the name of devices you have registered with the account. Meeting proposals you create are stored on Flexibits servers. Data other than meeting proposals is end-to-end encrypted when synced between your devices (which means we don't have access to it).
• Calendar and contact accounts you add to Fantastical or Cardhop are kept on your device. Account passwords (including OAuth tokens), events, tasks, and contacts are stored only on your device and are not sent to servers. See below for exceptions when using Fantastical for Apple Watch or Fantastical Openings.
• When using Fantastical for Apple Watch, some of your events and tasks are encrypted and sent to Flexibits in order to sync with your watch (this data is end-to-end encrypted and we are unable to access it).
• When using Fantastical Openings, the names of your calendars and when your events begin and end are sent to Flexibits. This data can be deleted at any time.

Want to know more? Keep reading!

What personal information we collect

• When you create a Flexibits account we store your name, email address, and IP address.
• When you sign in to Fantastical on a device we store your device's name so that you can identify it when managing your account.
• When you sign up for a Flexibits Premium subscription your billing address and payment information is stored by Stripe, our payment processor.
• Your personal information is never sold or shared with anyone else.

Where are my events, tasks, and contacts stored?

In general, your events, reminders, and contacts are stored on your device and are not sent anywhere else (see exceptions below). Your account’s password is stored securely on your device using the Keychain.

• Event and task data synced to your Apple Watch is stored on Flexibits servers. This data is end-to-end encrypted and we are unable to access it.
• If you create a meeting proposal in Fantastical, the proposal is stored on Flexibits servers so that the invitees can respond to the proposal.
• Additional data is sent when using Fantastical Openings (see below).

Why do Fantastical and Cardhop ask for the username and password of my accounts?

Fantastical and Cardhop use your username and password to sync and display your events, reminders, and contacts. Your username and password are stored securely in the Keychain. The Keychain is part of macOS and iOS and is responsible for securely storing usernames and passwords. Your account username is securely synced between devices, but Flexibits does not have access to this information and your password is never sent off of your device. Your account information is never used for any reason other than to sync your data.

What data is sent to Flexibits when using Fantastical Openings?

• The names of your accounts and calendars.
• The names of your calendar sets and which calendars are in each calendar set.
• If your calendars support conferencing services, such as Google Meet, Zoom, Webex, or Microsoft Teams.
• Meeting templates that you've created.
• The name, email address, and notes from people who request meetings from you.
• Your Fantastical Openings data can be deleted at any time at hub.flexibits.com.
• Titles, locations, notes, invitees, and other identifying event data are not sent to Flexibits.

When does an app use my location?

Fantastical uses your location for the following:

• To show you weather based on your location.
• To switch your calendar set when you have a calendar set that activates automatically based on location.
• To show you notifications for geofenced reminders.
• To show you time to leave notifications based on your current location.
• To show you relevant search results when searching for a location.

When your location is sent off your device:

• Your location is sent to Apple Maps to show relevant search results when searching for a location.
• Your location is sent to AccuWeather to show weather for the current location (this can be disabled in the settings).

Cardhop never uses your location.

Do you use end-to-end encryption when syncing data between devices?

Fantastical uses end-to-end encryption to sync your calendar sets, templates, interesting calendars, Apple Watch data, and account usernames. End-to-end encryption ensures that nobody but you can access this data.

Your Flexibits Account Key is used to encrypt your data when it is stored on a Flexibits server. Your Flexibits Account Key is stored on iCloud to make it easy to sign in to other devices that use the same iCloud account.

When does an app send data to Flexibits?

Fantastical for Mac:

• When creating or responding to a meeting proposal using Fantastical Scheduling.
• When events have changed on your calendar while using Fantastical Openings. See above for what data is sent while using Fantastical Openings.
• When updating calendar sets, templates, interesting calendars, and calendar accounts (this data is end-to-end encrypted).
• Periodically to check for updates to Fantastical. This includes anonymous information about your computer, such as your version of macOS, your version of Fantastical, if light or dark mode is enabled, and how many accounts you have set up in Fantastical. No personally identifying information is sent.
• When making changes to your calendar or dismissing alerts. No event data is ever sent to Flexibits, our servers only receive a notification that changes were made on your account. This notification is then relayed to Fantastical on your other devices.
• When using Google push updates. No event data is ever sent to Flexibits, our servers only receive a notification that changes were made on your account. This notification is then relayed to Fantastical.
• When using Todoist push updates. Information about updated tasks is sent to Flexibits, but our servers never store any task data after the changes have been sent to Fantastical on your devices.
• When setting up Fantastical for the first time. Fantastical sends anonymous analytics to Flexibits during the setup process.
• If Fantastical crashes you will be asked to send a crash report. Please send them, it helps us identify and fix problems!

Fantastical for iOS:

• When creating or responding to a meeting proposal using Fantastical Scheduling.
• When events have changed on your calendar while using Fantastical Openings. See above for what data is sent while using Fantastical Openings.
• When updating calendar sets, templates, interesting calendars, and calendar accounts. This data is end-to-end encrypted and we are unable to access it.
• When using Fantastical for Apple Watch, event and task data synced to your Apple Watch is stored on Flexibits servers. This data is end-to-end encrypted and we are unable to access it.
• When making changes to your calendar or dismissing alerts. No event data is ever sent to Flexibits, our servers only receive a notification that changes were made on your account. This notification is then relayed to Fantastical on your other devices.
• When using Google and Exchange push updates. No event data is ever sent to Flexibits, our servers only receive a notification that changes were made on your account. This notification is then relayed to Fantastical.
• When using Todoist push updates. Information about updated tasks is sent to Flexibits, but our servers never store any task data after the changes have been sent to Fantastical on your devices.
• Periodically to send anonymous version information about your device. Specifically, Fantastical reports the version of Fantastical, the version of iOS, the type of device (e.g. iPhone 7, iPad Pro), language (e.g. English, French), if Flexibits Premium is active, and if there's an Apple Watch paired with Fantastical installed.
• When setting up Fantastical for the first time. Fantastical sends anonymous analytics to Flexibits during the setup process.
• If Fantastical crashes you will be asked to send a crash report. Please send them, it helps us identify and fix problems!

Cardhop for Mac:

• Periodically to check for updates to Cardhop. This includes anonymous information about your computer, such as your version of macOS, your version of Cardhop, if light or dark mode is enabled, and approximately how many accounts and contacts you have. No personally identifying information is sent.
• If Cardhop crashes you will be asked to send a crash report. Please send them, it helps us identify and fix problems!
• Cardhop connects to gravatar.com to look up contact images when adding or editing contacts. No personal or identifying information is sent to Gravatar.

Cardhop for iOS:

• If Cardhop crashes you will be asked to send a crash report. Please send them, it helps us identify and fix problems!
• Cardhop connects to gravatar.com to look up contact images when adding or editing contacts. No personal or identifying information is sent to Gravatar.

flexibits.com:

• Matomo is used to collect usage information on our website. All data collected is anonymous and IP addresses are anonymized. If Do Not Track is enabled in your web browser then no information is collected. Usage information is for internal use only and is not shared with anyone else.
• If you contact support and need assistance we may ask for troubleshooting information that may contain personal data. Personal data and files sent as part of the support process are kept for no longer than six months.
• We ask to store a cookie on your device if you come to flexibits.com from a partner website. This cookie is used to provide affiliate revenue to our partners if you try or subscribe to Flexibits Premium. We do not store any personally identifiable information in this cookie.

What other entities does Flexibits use to process or store personal data?

• Stripe: If you purchase a Flexibits Premium subscription then Stripe processes the payment and will collect and store information related to the payment.
• Campaign Monitor: If you've signed up for our mailing list then your name and email address are stored with Campaign Monitor.
• AccuWeather: AccuWeather provides weather data and forecasts. AccuWeather receives your location to show you weather for your current location (this can be disabled in the settings).
• SchedJoules: SchedJoules provides interesting calendars in Fantastical, if you choose to add interesting calendars to Fantastical.
• Microsoft App Center: App Center collects crash reports when one of our apps crash. This allows us to troubleshoot problems and fix crashes. You will be asked if you want to submit a crash report before any data is sent.
• Rollbar: Rollbar collects problem reports if you encounter an issue on our website. This allows us to troubleshoot problems and fix bugs.

How do I delete my Flexibits account?

You can delete your account at hub.flexibits.com under the Account section. Deleting your account will also delete all personal data associated with your account.

Where are Flexibits servers located?

Flexibits servers are hosted on Google Cloud Platform in the US.

What happens if there is a data breach?

In the event of a breach we will notify all affected users in a timely manner.

Who is the EU GDPR Representative (Art 27 EU GDPR)?

Felix Gebhard (Certified Data Protection Officer - Tuev Sued)
FX Data UG (haftungsbeschränkt)
Verhoevenstrasse 4
81739 München
Contact: [email protected], +49.89.785 763 94

If you are an organization based in the EU you can opt in to our DPA and standard contractual clauses.

I have a question that isn't answered here.

Please contact us and we'll get back to you.