CalmTalk Privacy Policy

Effective date: October 15, 2026

CalmTalk ("CalmTalk", "we", "us") is a messaging app that helps protect you from hurtful messages. Incoming messages can be softened by AI, the original messages are kept unchanged for your records, and you can export a record of a conversation as a PDF. CalmTalk is operated by Nedra Lukas, a sole proprietor based in Alberta, Canada.

This policy explains what information CalmTalk collects, why, who helps us process it, how long we keep it, and the choices and rights you have. If you have questions, email nedra.anne.lukas@gmail.com.

The short version

• We collect only what the app needs to work: your account details, your messages, and a few technical details needed to deliver notifications and subscriptions.
• Message text is sent to an AI service (OpenAI) to soften incoming messages and flag possible threats. It is never used to show you ads.
• Original messages are kept unchanged so you have a reliable record.
• We do not sell your information, we do not show ads, and we do not use advertising IDs, analytics trackers, or location. We do receive crash reports (never containing message content) so we can fix bugs.
• You can delete your account in the app at any time (You > Delete account), or ask us by email: see Deleting your account.

1. Information we collect

Information you give us

• Account information: your email address, your password (stored only in scrambled, hashed form by our authentication provider), and the display name you choose.
• Messages: the messages you send and receive in CalmTalk, including the time they were sent and who sent them. For incoming messages we also store the softened version, the filter level used, and whether a safety warning was shown.
• Who you talk to: to start a conversation with another CalmTalk user, you enter their email address. If you use the texting feature (below), you enter the other person's phone number and, optionally, a label such as "Alex".
• Settings: your filter level, notification preferences (including quiet hours and your time zone, so quiet hours happen at the right time), and similar app settings.
• Evidence exports: when you export a conversation, we create a PDF with the messages and their digital fingerprints (SHA-256 hashes) and store it privately so you can download it.
• Export log: when you export records, CalmTalk keeps a small export log (the export ID, the export's digital fingerprints (hashes), message counts and dates, with no message content or names) so the export can be verified later. This log is kept after you delete your account, for that purpose only.
• Reports and blocks: if you report a message or a conversation, we store the reason you chose (harassment, threat, spam, or other), any note you add, which message or conversation it is about, and when. If you block someone, we store the block and when it started and ended. Messages a blocked person sends are still stored as originals for your records but are hidden from you and do not notify you. The person you report or block is not told.
• Reactions: when you react to a message, CalmTalk stores which of the six reactions you chose, on which message, and when. The other person in the conversation can see it, If you delete your account, a reaction in a conversation with another CalmTalk user stays in their records. Reactions in a text-message chat, or in a chat no one else is in, are deleted with that chat.
• Shared calendar: if you use the calendar in a conversation, we store the schedule you set up (pattern, start date, usual handoff time and place), one-off events, change requests and whether they were accepted or declined, any short notes you add, and an optional name for the calendar (for example, "Mia & Leo"). The other person in the conversation can see it. Every calendar change is also written to a timestamped change log with digital fingerprints (hashes) that can't be edited, and you can choose to include it in an evidence export. Notes from the other person can be softened by the kindness filter in the same way as messages (see Section 3); the original note is always kept.
• Read receipts and typing indicator (optional, off by default): if you turn on read receipts, we store when you last read each conversation; it is shown to the other person only if they have turned read receipts on too. The typing indicator is sent live to the other person (only if you both turned it on) and is not stored.

The texting (SMS) feature

If you turn on the texting feature, CalmTalk gives you a private phone number (provided through Twilio). The other person can text that number from any phone without installing CalmTalk. When they do, we receive and store:

• their phone number and the label you gave them;
• the content of their text messages, and any pictures, videos, audio clips, or files they send by MMS;
• delivery status information, and opt-out records (for example, if they text STOP, START, or HELP), which we keep so that their choice is respected;
• when they first texted your number, or when you confirmed that they agreed to get texts from you.

Your replies are sent to them as normal text messages from your private number. If you text someone first (they have not texted your number before), your first text to them includes a short notice with your name and "Reply STOP to opt out, HELP for info."; we keep the exact text that was sent and when the notice went out. If they texted your number first, nothing is added to your replies. See Section 7 for more about people who text you but do not use CalmTalk.

If you use the shared calendar with someone who texts your number, CalmTalk texts them a plain summary of each change you propose from your private number (for example, "Reply YES to accept or NO to decline"), and we store their YES or NO reply as their answer. A YES or NO reply to a calendar text never changes their texting opt-out choice; STOP still works the same way.

Information collected automatically

• Push notification details: if you allow notifications, we store a push notification token for your device, your device platform (for example, Android), and your device's name, so we can send alerts to the right phone.
• Subscription status: if you subscribe, we receive confirmation of your purchase and whether your subscription is active. Payment is handled by Google Play; we never see your card or bank details.
• Basic technical logs: our hosting providers keep standard server logs (such as the time of a request and an IP address) for security and troubleshooting.
• Crash reports: if the released app crashes, Google Firebase Crashlytics sends us a crash report: technical details of the crash (such as the error and where in the code it happened), your device model, operating system version, app version, and a random installation identifier created by Firebase. Crash reports never include your messages, your contacts, or your email, and we do not attach your CalmTalk user ID.

Information that stays on your device

Your app-lock PIN and your fingerprint or face unlock are handled on your device. Biometric data is managed by your phone's operating system and is never sent to us. We store a scrambled (hashed) form of your PIN only on your device.

What we do not collect

We do not collect your location, your phone's contact list, your photo gallery, your browsing history, or advertising IDs. CalmTalk has no ads and no third-party analytics, advertising, or tracking tools. The only diagnostic tool we use is Crashlytics crash reporting, described above.

2. How we use information

We use your information only to:

• create and secure your account and let you sign in;
• deliver your messages and text messages;
• soften incoming messages with AI and show safety warnings for possible threats;
• keep an unchanged record of original messages and calendar changes, and create evidence exports when you ask;
• run the shared calendar you and the other person use;
• send you notifications according to your settings;
• provide and check your subscription;
• keep CalmTalk safe and working, prevent abuse, review reports you make, apply blocks you choose, and fix problems (including crashes, using crash reports);
• respond to your requests and meet our legal obligations.

We do not use your messages to advertise to you, and we do not sell or rent your personal information.

3. AI processing of message content

To soften an incoming message, CalmTalk sends the message text to OpenAI through our secure server. OpenAI returns a softened version and an indication of whether the message appears to contain a threat. Messages that look like threats are not softened; instead, you see a warning so you do not miss something important.

CalmTalk never changes what you send: your messages are delivered exactly as you write them. However, a message you send to another CalmTalk user is an incoming message for them, so it may be sent to OpenAI to be softened on their screen. Text messages from people who text your private number, and notes attached to shared calendar entries, are processed the same way.

• The original message is always kept and you can view it at any time.
• AI output can be wrong. Softened text is a convenience, not a replacement for reading the original when it matters, and the threat warning may miss things.
• OpenAI processes this text on our behalf as a service provider. OpenAI states that content sent through its API is not used to train its models, and that it may be kept for up to 30 days for abuse monitoring and then deleted, unless OpenAI is legally required to keep it longer.

4. Service providers we use

We use trusted companies to run CalmTalk. They process information only on our behalf and under their own privacy and security commitments:

These providers may store or process information in Canada, the United States, or other countries. Where information is processed outside your country, it may be accessible to authorities there under local law. We choose providers that protect information with industry-standard safeguards.

5. When information is disclosed

We do not sell personal information and we do not share it for advertising. We disclose information only:

• with the people you message: messages you send are delivered to the person you are talking to, and your replies to a text contact go to their phone;
• with our service providers listed above, so they can run CalmTalk for us;
• when the law requires it, for example in response to a valid court order or other legal process, or when we believe in good faith that disclosure is needed to prevent imminent harm to someone's safety;
• if the business changes hands, in which case this policy would continue to protect your information and we would tell you first.

Evidence exports you download are yours to share as you choose (for example, with a lawyer or a court).

6. How long we keep information

• While your account is open, we keep your account, messages, and records so the app works and your records stay complete. Original messages cannot be edited or deleted inside the app; this is what makes them reliable as a record.
• When you delete your account, we delete your sign-in (email and password), settings, push tokens, the softened copies of messages you received, text-contact details and their messages and media, reports you made, your blocked list, read status, record PDFs you exported (but not the export log described in Section 1), and any conversations no one else is in. Your private number is turned off, and texts sent to it are not delivered to anyone. We hold it for 90 days, then release it to the phone carrier, which may later assign it to someone else. We never give it to another CalmTalk user. In-app deletion happens right away; email requests are completed within 30 days. Copies in encrypted backups are removed as those backups expire, typically within a further 30 days.
• Messages already delivered to other CalmTalk users stay in their records. An original message is part of the recipient's record too (for example, for their own evidence exports), so messages you already sent to another CalmTalk user are kept in their conversation. After deletion they keep the name that was shown in that conversation, with "(account deleted)" added, and they no longer show your email. The name is kept only so those records still make sense. The same applies to a shared calendar with another CalmTalk user: the calendar and its change log stay in their records. A calendar with someone who texts your number is deleted with that conversation.
• Crash reports are kept by Firebase Crashlytics for up to 90 days.
• We may keep limited information longer only where we must by law (for example, purchase records needed for tax purposes), or to resolve a dispute or prevent abuse.
• Service providers such as Twilio and Google keep their own operational records (for example, carrier message logs and payment records) under their own retention rules.

7. People who text you but do not use CalmTalk

When someone texts your CalmTalk private number, we process their phone number and messages on your behalf, so that you can read them through the softening filter and keep a record. We use this information only to provide CalmTalk to you. If the CalmTalk user texts someone first, that first text includes the user's name and tells the person how to stop texts (reply STOP) or get help (reply HELP). The other person can stop receiving texts from your CalmTalk number at any time by replying STOP, and we keep a record of opt-outs and opt-ins so that we respect them. If you are that person and have questions about information we hold about you, email nedra.anne.lukas@gmail.com.

If you use CalmTalk's texting feature, you are responsible for using it lawfully, including any rules about recording or keeping communications where you live.

8. Security

We protect information using encryption in transit (HTTPS/TLS) for all communication between the app and our servers, database access rules so each person can see only their own conversations, private (non-public) file storage, and secure server-side handling of keys. CalmTalk also offers an app lock and a quick-exit button for your personal safety. No system is perfectly secure; if we learn of a breach that creates a real risk of significant harm, we will notify you and the relevant authorities as the law requires.

9. Your rights and choices

Depending on where you live, including under Canada's PIPEDA, Alberta's Personal Information Protection Act (PIPA), the EU/UK GDPR, and California's CCPA/CPRA, you may have the right to:

• access the personal information we hold about you and ask how it is used;
• correct information that is inaccurate;
• delete your account and information;
• get a copy of your information in a portable format (evidence exports are one way to do this);
• withdraw consent or object to certain processing (for example, by turning off notifications or changing your filter settings);
• not be discriminated against for using these rights.

We do not sell personal information or "share" it for cross-context behavioural advertising, as those terms are defined under California law.

To make a request, email nedra.anne.lukas@gmail.com from the email address on your CalmTalk account. We may need to confirm your identity before acting on a request. We will respond within 30 days, or sooner if the law requires.

If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca), or your local data protection authority.

For people in the EU/UK: we process your information to provide the service you signed up for (contract), for our legitimate interests in keeping CalmTalk safe and working, with your consent where we ask for it (for example, notifications), and to meet legal obligations.

10. Deleting your account

You can delete your CalmTalk account in either of these ways:

• In the app: open You (Profile), tap Delete account, type DELETE and confirm. Your account is deleted right away.
• By email: email nedra.anne.lukas@gmail.com from the email address you use to sign in, with the subject line "Delete my CalmTalk account". We will confirm your request and complete it within 30 days.

What is deleted and what is kept is described in Section 6. In short: your account and personal data are deleted, but messages you already sent to other CalmTalk users stay in their records, under the name that was shown there, with "(account deleted)" added.

Before you delete, download any evidence exports you may need. Once your account is deleted, your records cannot be recovered. If you have a subscription, cancel it in the Google Play Store app (Profile, Payments and subscriptions, Subscriptions) so you are not charged again; deleting your account does not cancel a Google Play subscription automatically.

You can also find these instructions at our account deletion page: https://calmtalk.expo.app/delete-account

11. Children

CalmTalk is intended only for adults aged 18 and older. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

12. Not an emergency service

CalmTalk is not an emergency or crisis service. CalmTalk's automated filter scans incoming messages to soften hurtful language and flag possible threats, but no CalmTalk staff read your conversations unless you report a message or the law requires it. If you are in danger, call 911 or your local emergency number.

Our website (calmtalk.app): early access list, cookies and Meta Pixel

Early access list. If you join the early access list on calmtalk.app, we store your email, whether you use Android, what you asked for (testing or launch updates), and when you agreed to this policy. We use it only to contact you about CalmTalk early access and launch. Email support@calmtalk.app to be removed.

Meta Pixel (only if you say yes). Our website can use the Meta Pixel, a cookie and small script from Meta Platforms (Facebook/Instagram), to measure whether our ads work. It is off by default and only loads if you tap Accept on the cookie banner. If you accept, Meta may receive the page you visited, the fact that you joined the early access list (as "tester" or "launch updates"), your browser and device details, your IP address and Meta's own cookie identifiers. We do not send Meta your email or any other details you type into the form. Meta handles this information under its own privacy policy (facebook.com/privacy/policy). The CalmTalk app itself does not use the Meta Pixel.

How to opt out. Tap Decline on the banner, or use Cookie settings at the bottom of calmtalk.app to change your choice at any time. Your choice is saved in your browser only. You can also clear your browser's cookies and site data, or adjust your ad preferences in your Meta account settings.

13. Changes to this policy

We may update this policy as CalmTalk changes (for example, when we add new tools such as expense tracking). We will update the effective date above and, for significant changes, let you know in the app or by email before the change takes effect.

14. Contact us

CalmTalk, operated by Nedra Lukas Alberta, Canada Email: nedra.anne.lukas@gmail.com