Privacy Policy

Last updated: 4 July 2026

ReciproCal is designed so that your calendar data never has to leave your device. This policy explains what that means in practice — including the one optional feature (iCloud rule sync) that does involve Apple’s servers, and only with your explicit consent.

Responsible party

The controller responsible for data processing under the GDPR is:

What we don’t do

We collect nothing. ReciproCal has no user accounts and no server of its own. We — the developer — do not collect, see, transmit, store, or have any access to your events, calendars, or personal information, under any circumstances.

Calendar access

ReciproCal uses Apple’s EventKit framework to read the calendars you have already configured in your system settings and to write synced events according to the rules you create. This access:

• requires your explicit permission through the standard system prompt;
• stays on your device — no event data is ever sent over the network by ReciproCal;
• can be revoked at any time in System Settings.

No third-party accounts

ReciproCal never asks for the credentials of iCloud, Microsoft 365, Google, or any other provider. It only works with the calendars your operating system already syncs.

Optional: syncing rules via iCloud

ReciproCal can optionally keep your rules — not your calendar events — the same across your iPhone, iPad and Mac. This feature is off by default and only activates if you explicitly turn it on in Settings.

When enabled, only the rule definitions themselves are synced: which calendars a rule connects, its time-window and keyword criteria, and its masking settings. Your actual calendar events, their titles, notes, locations and attendees are never part of this and are never uploaded anywhere.

Syncing uses Apple’s CloudKit, storing data exclusively in the private iCloud database of your own Apple ID — the same private space apps like Notes or Reminders use for their own iCloud sync. We have no server, no account system, and no access to this data; it is encrypted and managed entirely by Apple under your existing iCloud account. The legal basis for this processing is your consent (Art. 6(1)(a) GDPR), which you give by turning the feature on and can withdraw at any time.

You can turn this off, or fully reset the synced data (deleting it from iCloud without affecting your local rules), at any time from ReciproCal’s Settings screen.

Analytics and tracking

ReciproCal contains no third-party analytics or advertising SDKs and does not track you across apps or websites. On the App Store, ReciproCal is labelled “Data Not Collected.”

Purchases

Subscriptions and one-time purchases are handled entirely by Apple through the App Store. We never see your payment details.

Website hosting (Cloudflare Pages)

This website is served through Cloudflare Pages (Cloudflare, Inc., USA). When you visit, Cloudflare processes technically necessary connection data (e.g. IP address, timestamp, page requested) to deliver and secure the site. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning website).

Website analytics (Cloudflare Web Analytics)

To understand which pages are visited and how people find this site, we use Cloudflare Web Analytics — a privacy-first analytics service built specifically to avoid personal data collection. It does not use cookies, local storage, or any other client-side tracking technology, does not fingerprint your device, and does not track you across other websites. Because no personal data is processed and no tracking technology is stored on your device, no cookie consent banner is required.

It reports only aggregate, anonymous metrics: which pages were viewed, which website referred you here, and a coarse, country-level location derived from your IP address at request time — the IP address itself is never stored. The App Store badges on this site link through short local redirect pages (/dl/mac.html, /dl/ios.html, /dl/store.html) purely so we can see in aggregate how many visits led to an App Store link, without any per-person tracking. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in understanding and improving the site). More information is available in Cloudflare's Web Analytics documentation and Cloudflare's privacy policy.

Contact form

The contact form is processed through Formspree (Formspree, Inc., USA). When you submit the form, the data you enter (name, email, message) is transmitted to Formspree and forwarded to us by email so we can answer your request. The legal basis is Art. 6(1)(b) and (f) GDPR. You may also email us directly instead.

Your rights (GDPR)

You have the right to access, rectify, erase, restrict processing of, port, and object to the processing of your data. To exercise these rights, contact the address above. You also have the right to lodge a complaint with a data-protection supervisory authority.

Changes to this policy

We may update this privacy policy to reflect changes in the law or in features. The current version is always available on this page.