Privacy at Flexibits

Here are answers to some common questions about how Flexibits and our apps use and store your data.

Give me the short version

Want to know more? Keep reading!

What personal information we collect

Where are my events, tasks, and contacts stored?

In general, your events, reminders, and contacts are stored on your device and are not sent anywhere else (see exceptions below). Your account’s password is stored securely on your device using the Keychain.

Why do Fantastical and Cardhop ask for the username and password of my accounts?

Fantastical and Cardhop use your username and password to sync and display your events, reminders, and contacts. Your username and password are stored securely in the Keychain. The Keychain is part of macOS and iOS and is responsible for securely storing usernames and passwords. Your account username is securely synced between devices, but Flexibits does not have access to this information and your password is never sent off of your device. Your account information is never used for any reason other than to sync your data.

What data is sent to Flexibits when using Fantastical Openings?

When does an app use my location?

Fantastical uses your location for the following:

When your location is sent off your device:

Cardhop never uses your location.

Do you use end-to-end encryption when syncing data between devices?

Fantastical uses end-to-end encryption to sync your calendar sets, templates, interesting calendars, Apple Watch data, and account usernames. End-to-end encryption ensures that nobody but you can access this data.

Your Flexibits Account Key is used to encrypt your data when it is stored on a Flexibits server. Your Flexibits Account Key is stored on iCloud to make it easy to sign in to other devices that use the same iCloud account.

When does an app send data to Flexibits?

Fantastical for Mac:

Fantastical for iOS:

Cardhop for Mac:

Cardhop for iOS:

What other entities does Flexibits use to process or store personal data?

How do I delete my Flexibits account?

You can delete your account at under the Account section. Deleting your account will also delete all personal data associated with your account.

Where are Flexibits servers located?

Flexibits servers are hosted on Google Cloud Platform in the US.

What happens if there is a data breach?

In the event of a breach we will notify all affected users in a timely manner.

Who is the EU GDPR Representative (Art 27 EU GDPR)?

Felix Gebhard (Certified Data Protection Officer - Tuev Sued)
FX Data UG (haftungsbeschränkt)
Verhoevenstrasse 4
81739 München
Contact: [email protected], +49.89.785 763 94

If you are an organization based in the EU you can opt in to our DPA and standard contractual clauses.

I have a question that isn't answered here.

Please contact us and we'll get back to you.


  • Added an explicit mention about breach notifications.


  • Added analytics collection during Fantastical onboarding.


  • Clarified that meeting proposals are part of Fantastical Scheduling.


  • Added link to DPA.


  • Added information about Fantastical Openings.


  • Added information about an affiliate cookie.


  • Renamed Fantastical Premium to Flexibits Premium.


  • Clarified OAuth token information.


  • Clarified information about Todoist push updates on Mac so the text matches iOS.


  • Typographic correction.


  • Clarified about when data is sent for Apple Watch sync and that it is end-to-end encrypted.


  • Updated delete account instructions.


  • Added App Center and Rollbar to data processors.


  • Typographic correction.


  • Added GDPR.
  • Added information about when a device shares a location.
  • Added AccuWeather and SchedJoules to data processors.
  • Added delete account instructions.
  • Added information about where Flexibits servers are located.