Legal

Privacy Policy

Version 2.0 · Effective 16 August 2026 · Last updated 16 August 2026

1. Who is responsible for your data

Taleschamber Limited is the controller of the personal data described in this policy. We decide why and how it is processed, and we are accountable for it.

Registered office: Unit 2214, 22/F, Mira Place Tower A, 132 Nathan Road, Tsim Sha Tsui, Kowloon, Hong Kong.

Privacy contact: support@bricks-calendar.com. This address reaches the person responsible for privacy matters. We have not appointed a statutory data protection officer, because we are not required to.

2. What this policy covers

This policy applies to the Bricks Calendar app for Apple devices, the website at bricks-calendar.com, and the invite pages at app.bricks-calendar.com (together, the “Service”). It does not cover Apple, Google or any other company's own handling of your data under their own policies, or third-party services you choose to connect.

3. What we collect

We collect only what the Service needs in order to work. We do not require you to give us more than that.

Information you give us

• Account data — the email address associated with your sign-in, an internal user identifier, and the profile details you choose to add such as a display name and an avatar image.
• Your content — Bricks, events, todos, notes, memos, messages, and the photos or files you attach. Event titles, times, locations, memos and message text are all treated as your content.
• Support reports — the description you write when you use Report a Problem, any screenshots you choose to attach, and a small set of technical details described in section 15.
• Reports about other people — when you report a message, we receive the identifier of the reported content, who reported it and when.
• Correspondence — the content of emails you send us.

Information we receive automatically

• Device identifier for notifications — a push token issued by Apple for your installation of the app, used to deliver the notifications you enable.
• Purchase and subscription data — the transaction identifiers and entitlement status that Apple provides so that we can unlock Bricks Pro for the right account. We never receive your payment card number, and we do not process payments ourselves.
• Technical operating data — the standard connection information that any internet service receives when your app or browser makes a request, such as an IP address, timestamps and error codes, together with limited diagnostic details attached to support reports. We do not build behavioural profiles from this.

Permissions you grant on your device

• Calendars — only if you choose to sync or import from Apple Calendar.
• Photos and files — only when you attach something, or attach a screenshot to a support report.
• Notifications — only if you allow them.

You can withdraw any of these permissions in your device settings at any time. Doing so stops the related feature from working, and does not by itself delete content that has already been added to a Brick.

4. Why we use it and our legal bases

Where data protection law requires a legal basis, ours are set out below.

• To give you the Service — creating your account, storing and syncing your content across your devices, sharing it with the Members you invite, delivering messages, and unlocking paid features. Basis: performance of our contract with you.
• To send notifications you enable — for example an update in a shared Brick, or a reminder you set. Basis: performance of our contract, and your consent through the device notification permission.
• To provide support — reading and answering your support reports and emails, and reproducing the problem. Basis: performance of our contract, and our legitimate interest in a working product.
• To keep the Service safe — preventing abuse, fraud and unauthorised access, reviewing reported content, and enforcing our Terms. Basis: our legitimate interest in protecting users and the Service, and compliance with legal obligations.
• To keep the Service reliable — diagnosing errors, restoring service after a failure, and maintaining backups. Basis: our legitimate interest in operating a stable product.
• To meet legal and regulatory obligations — for example tax and accounting records relating to purchases, and responding to lawful requests. Basis: compliance with a legal obligation.
• To communicate about the Service — telling you about changes to these documents, security matters or an outage. Basis: performance of our contract and compliance with legal obligations.

Where we rely on a legitimate interest, we have considered your interests and rights, and we do not use that basis where it would override them. You can object at any time, as described in section 19.

5. What we do not do

• We do not sell personal data, and we do not share it for cross-context behavioural advertising.
• We run no advertising networks, no analytics software development kits, and no third-party crash reporting inside the app.
• We do not track you across other companies' apps or websites, so the app does not ask for tracking permission.
• We do not use your content, your messages or your support reports to train generative artificial intelligence models.
• We do not read your private conversations for advertising, marketing or product analytics.
• We do not knowingly collect data from children under 13.

6. Who we share it with

We share personal data only with the providers we need in order to run the Service, and only for the purposes below. Each acts on our instructions under a written contract, and none of them is permitted to use your data for their own purposes.

• Supabase — authentication, database, file storage and server functions for the app. This is where your account and your content are stored.
• Apple — App Store distribution, in-app purchases and subscription status, Family Sharing eligibility, push notification delivery, and the on-device calendar framework used for Apple Calendar sync.
• Google — only if you choose Google as your sign-in provider, and only for authenticating you.
• Hostinger — hosting for this website and the invite pages. This does not hold your calendars, messages or attachments.

We may also disclose data where the law requires it, to respond to a valid legal request, to establish or defend legal claims, or to protect the rights, property or safety of a person, including where there is a credible risk of serious harm. If we are ever involved in a merger, reorganisation or sale of assets, data may transfer as part of that transaction, and we will require the recipient to honour this policy or give you notice and a choice.

If we add or change a provider that processes your content, we will update this section. Where the change is significant, we will also give notice as described in section 24.

7. Where your data is stored and international transfers

• Your account and content are stored in our production database and file storage hosted in Singapore.
• This website is hosted separately and holds no personal content.
• Some processing necessarily happens elsewhere, including in the United States and the European Union, because Apple, Google and our providers operate global infrastructure for authentication, notification delivery, purchase verification and support.

Where personal data leaves the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the United Kingdom Addendum where applicable, or another lawful transfer mechanism, together with additional technical and organisational measures such as encryption in transit and access control. You may ask us for information about the safeguards that apply to a specific transfer.

8. How long we keep it

We keep personal data only as long as we need it, and we delete or anonymise it after that. The periods below are what our systems actually enforce.

• Account and profile data — kept while your account exists. Deleted when you delete your account.
• Your content — kept while it exists in the Service. When you delete an event, todo, note, message, attachment, Brick or Todo category, it disappears immediately for everyone and is permanently erased within 30 days by an automated daily job.
• Deleted accounts — sign-in record, profile, subscription record and notification registration are removed at the time of deletion. Content in spaces you still owned is deleted for every Member and permanently erased on the same 30-day cycle. Messages you left in someone else's space remain in that conversation with your identity removed, so the other Members' history is not broken.
• Support reports — a report that has not yet been resolved is deleted 30 days after it was submitted. A resolved report is deleted 90 days after it was closed. Both are enforced by an automated daily job.
• Reports about other people and enforcement records — kept for as long as needed to review the report and to enforce our Terms, including keeping a record of repeat behaviour, and then deleted.
• Purchase and subscription records — kept while your account exists, and afterwards only to the extent required for tax, accounting and legal-claim purposes, which in Hong Kong is generally seven years for accounting records.
• Email correspondence — kept for up to 24 months after the matter is closed, then deleted.
• Operational backups — backups exist so we can restore the Service after a failure, and are rotated on a short cycle. Deleted data can persist in a backup until it is overwritten, and is not restored into the live Service.
• Server logs — retained for a short period for security and reliability, and then deleted or aggregated so that individuals are no longer identifiable.

9. How we protect it

• Encryption in transit. All traffic between the app, this website and our servers uses current transport encryption.
• Encryption at rest. Our database and file storage are hosted on infrastructure that encrypts stored data.
• Access control at the row level. Every table enforces rules so that a signed-in account can only reach the Bricks and shared spaces it is a Member of. Access is checked on the server, not only in the app.
• Least privilege for people. Administrative access to production systems is restricted to those who need it, protected by multi-factor authentication, and separate from our development environment.
• Separation of environments. Development and testing use a separate backend and never write to production data.
• Payment isolation. Purchases are handled by Apple. We hold no card numbers.
• Ongoing review. We review dependencies and configuration, and we fix reported vulnerabilities as a priority.

No service can be completely secure. Please use a secure sign-in method, keep your device locked, and remember that content you place in a shared Brick is visible to its Members.

10. If something goes wrong

If a personal data breach occurs, we will investigate immediately, take steps to contain it, and record what happened. Where the breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where the law requires it, within 72 hours of becoming aware. Where there is a likely high risk to you, we will also tell you directly, and explain what happened, what data was involved and what you can do.

11. Sign-in providers

You can sign in with Apple or Google. The provider authenticates you and tells us the minimum needed to create your account, which is an identifier and an email address, subject to the choices you make in their systems. If you use Apple's private email relay, we receive the relay address and never see your real one. Their own privacy policies govern their services. We do not receive your password.

12. Apple Calendar sync

• Sync and import are optional and run on your device through Apple's calendar framework, using the permission you grant.
• We read and write only the calendars you choose to connect. Events you sync into a Brick are then stored in our backend so that the people you invited can see them.
• We do not use calendar access for advertising, and we do not scan your calendars for any purpose other than providing sync.
• You can withdraw calendar access in your device settings at any time. Content already synced into a Brick stays there until you delete it.

13. Push notifications

If you allow notifications, we store a push token for your installation so that Apple can deliver a notification to your device. Notification content is limited to what is needed to be useful, for example who acted and in which Brick. Turning notifications off in your device settings stops delivery, and we remove the registration when your account is deleted.

14. Collaboration and shared content

Bricks Calendar is built for sharing, so it is important to understand what that means for privacy.

• When you invite someone into a Brick or a shared Todo category, the content in that space becomes visible to its Members according to the permission you gave them.
• Other Members can see your display name and avatar within that space, and the content you contribute to it.
• Content you place in a shared space may remain available to the other Members after you leave or delete your account, so that their plans are not broken. Your identity is removed from messages once your account is gone.
• If you add another person's personal data to an event, a message or an attachment, you are responsible for having a proper basis to do so.
• Removing a Member ends their future access to that space.

15. Report a Problem and our use of AI

• What is sent. The description you write, any screenshots you attach, and technical details such as the app version, the build number, a device model code, which screen you were on and an error fingerprint.
• What is deliberately excluded. The technical details do not include your event titles, memos, locations or message text.
• Screenshots. Screenshots are optional and are only included if you attach them. A screenshot may show your own content, so please review it before sending.
• How AI is used. Authorised artificial intelligence tools help us classify a report, group duplicates and diagnose the cause. This makes fixes faster. A human decides what to do about your report.
• What AI is not used for. Reports are not used to train generative models, not used for advertising or tracking, and not used to make a decision about you that has a legal or similarly significant effect.
• Retention. As set out in section 8: 30 days for a report that has not been resolved, and 90 days after closure for one that has.

16. Reporting and blocking other people

You can report a message and block the person who sent it. When you report, we receive which content was reported, who reported it and when, and we use that only to review the report, take action under our Terms and meet legal obligations. Blocking is applied on your account and hides that person's messages from you. We may keep a record of enforcement action, including a record of repeat behaviour, for as long as needed for that purpose. We do not tell the reported person who reported them, unless the law requires it.

17. Cookies and similar technologies

• This website sets no advertising, analytics or profiling technologies, so it shows no tracking prompt and there is nothing for you to opt out of.
• The app stores data on your device so that it works offline and keeps you signed in. That is local storage on your device, not cross-site tracking.
• We honour browser signals such as Global Privacy Control. Since we neither sell nor share personal data, there is nothing for such a signal to switch off.

18. Your rights and how to use them

Wherever you live, you can ask us to:

• Access — confirm what personal data we hold about you and give you a copy.
• Correct — fix data that is inaccurate or incomplete. You can edit most profile details yourself in the app.
• Delete — erase your account and content. You can do this yourself in the app under Settings, then Account, then Delete account. See Delete Account.
• Export — receive your data in a portable, machine-readable form.
• Restrict or object — limit or object to a particular use, including any use based on a legitimate interest.
• Withdraw consent — for anything based on consent, such as notification and calendar permissions, without affecting what was lawful before you withdrew it.

Email support@bricks-calendar.com. We reply within 30 days, and will tell you if we need longer because a request is complex. We may need to verify your identity, which we do by confirming control of the email address on the account, and we ask only for what is necessary to do that. Exercising these rights is free, and we will never treat you differently for using them. If a request would reveal another person's data, for example a whole shared conversation, we will provide what we can and explain what we withheld.

19. If you are in the EEA, the UK or Switzerland

You have the rights in section 18 as set out in the General Data Protection Regulation and equivalent United Kingdom and Swiss law, including the right to data portability and the right not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect. We do not make such decisions, as stated in section 23.

You also have the right to lodge a complaint with your local supervisory authority. We would appreciate the chance to resolve the matter first. We have not appointed a representative in the Union or the United Kingdom; please write to the address in section 25 or email us, and we will respond directly.

20. If you are in California

Under the California Consumer Privacy Act as amended, and in the twelve months before the date of this policy, we collect the following categories of personal information: identifiers, commercial information relating to a subscription, internet or network activity limited to technical operating data, and the content you choose to store, including photos and message content. We collect them from you and from Apple and your sign-in provider, for the purposes in section 4, and we disclose them only to the service providers in section 6.

• We do not sell personal information and we do not share it for cross-context behavioural advertising, including for anyone under 16.
• We do not use or disclose sensitive personal information for purposes beyond those permitted for providing the Service.
• We offer no financial incentive in exchange for personal information.
• You have the right to know, to delete, to correct, and to be free from retaliation for exercising these rights. Because we do not sell or share, there is no opt-out to submit.
• An authorised agent may act for you if they provide written proof of authorisation and we can verify your identity.

Use the contact details in section 25 to make a request. We aim to respond within 45 days and will tell you if we need the permitted extension.

21. If you are in Hong Kong

We handle personal data in accordance with the Personal Data (Privacy) Ordinance and its Data Protection Principles. You may make a data access request or a data correction request by emailing support@bricks-calendar.com. We will respond within 40 days. We may charge a fee for complying with a data access request only where the Ordinance permits, and any fee will not be excessive; we will tell you the amount before proceeding. We do not use your personal data in direct marketing, and we do not provide it to anyone else for that purpose. You may also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong.

22. Children

The Service is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child under 13 has given us personal data, email support@bricks-calendar.com and we will delete the account and its data promptly. Where you live may set a higher age for consenting to data processing, in which case a parent or guardian must agree on the child's behalf, as set out in our Terms. Parents and guardians should be aware that the Service allows messaging and file sharing between invited Members.

23. Automated decisions and profiling

We do not make decisions about you based solely on automated processing that produce legal effects or otherwise significantly affect you. We do not build advertising or behavioural profiles. Automated jobs do run inside the Service, for example deleting expired data, delivering notifications and grouping support reports, and a human remains responsible for any decision that affects your account.

24. Changes to this policy

We update this policy when the Service or the law changes. Each version carries a version number and an effective date at the top of this page.

• For a change that materially affects how we use your data, we will give at least 30 days' notice before it takes effect, through the app or by email, unless a shorter period is required for legal or security reasons.
• Where the law requires your consent for a change, we will ask for it rather than assume it.
• For a copy of an earlier version, email support@bricks-calendar.com and we will send it.

25. How to contact us or complain

Taleschamber Limited
Unit 2214, 22/F, Mira Place Tower A
132 Nathan Road, Tsim Sha Tsui, Kowloon
Hong Kong
support@bricks-calendar.com

If you are unhappy with how we handled your data or your request, tell us and we will look at it again. You may also complain to your local data protection authority, or in Hong Kong to the Office of the Privacy Commissioner for Personal Data.

Related: Terms & Subscription Terms · Delete Account · Support

Version history — 2.0 (16 August 2026): restructured, added legal bases, concrete retention periods, security and breach commitments, storage location and transfer safeguards, regional rights sections for the EEA and UK, California and Hong Kong, and statements on AI and automated decisions. 1.0 (14 August 2026): first published version.