Privacy Policy

1. Where Your Data Is Stored and Processed

Before you start, you explicitly choose Canada or the United States. Canadian household journals are stored in AWS Montreal (ca-central-1) and AI processing is restricted to an approved Canadian Google Vertex AI region. United States household journals are stored in AWS Northern Virginia (us-east-1) and AI processing is restricted to an approved United States Google Vertex AI region. Calmemo does not silently select or change your household country from an IP address, and it does not automatically copy a household between countries.

This regional commitment applies to Calmemo's journal storage and AI processing. Messages first travel through the messaging platform you choose — Telegram or WhatsApp — and payments, if enabled, are handled by Stripe. Those independent providers may process information outside your selected country under their own terms and infrastructure. Data residency is one privacy safeguard, not by itself a guarantee of compliance with every law. We do not use your journal data for advertising or to train AI models.

2. Data Minimization

We believe in collecting the absolute minimum required to be useful. We do not collect:

• Exact dates of birth (we only store month and year)
• Full names (first names or nicknames only)
• Home addresses

3. Identity and Contact Data

Calmemo does not ask you to create a separate email-and-password account. If you use Telegram, Telegram supplies a chat identifier. If you use WhatsApp, Meta supplies your phone number with your messages. Calmemo transforms each platform identity into a pseudonymous internal identifier. For WhatsApp, we also keep the phone number encrypted as a separate delivery endpoint so we can reply and send notifications you consent to receive. The number is kept out of journal events and application logs, and access to decrypt it is restricted to the delivery component.

4. Telegram and WhatsApp

Messages you intentionally send to Chester travel through the messaging platform you choose and are delivered to Calmemo for processing. Telegram bot conversations are cloud chats, not end-to-end encrypted Secret Chats. WhatsApp and Meta process WhatsApp messages, phone numbers, and delivery metadata under their own terms and privacy policies. Calmemo is an independent service, not part of Telegram, WhatsApp, or Meta.

On WhatsApp, you consent during setup to direct replies and generic notifications. You can send STOP to stop proactive WhatsApp messages without deleting your journal, and START to turn them back on. Messages you send still receive service replies. Proactive caregiver and scheduled household updates are reduced to a generic notice before they enter WhatsApp, even when the customer-service window is open. Outside that window, Calmemo uses only an approved generic template. Shared family or health details are not put in either notice.

5. Public Website Analytics

Calmemo uses Cloudflare Web Analytics on the public website to understand aggregate page visits, referrers, and website performance. Cloudflare processes that website-use information under its own terms and infrastructure. Its current Web Analytics documentation says the service does not use cookies or local storage and does not fingerprint individual visitors for analytics. Calmemo does not send journal messages, child information, messaging identifiers, or WhatsApp phone numbers to this service, and the website does not use Meta Pixel or session replay. The analytics beacon is not part of the secure WhatsApp journal-report pages.

When you choose a country or messaging channel, the website also sends a limited first-party event to Calmemo's matching regional metrics endpoint. The event contains only a fixed action name, the selected channel when applicable, and backend-supplied environment and country labels. If you arrive through a Calmemo advertisement or an organic social-media link, it may also include a fixed broad source label such as paid Meta, Instagram, Facebook, or YouTube. A Calmemo short-link path may identify the post or video in aggregate Cloudflare pageview reporting, but Calmemo does not attach that content path, an ad's campaign name, a Meta identifier, or a visitor identifier to your messaging account or product milestones. The fixed broad label may be saved with your deletable product-milestone metadata so we can understand whether a source led to a useful Calmemo setup. These events do not contain your messaging account, phone number, child information, or journal content. Your country selection is also stored in your browser so the website can continue showing the correct regional service and price.

6. Shared Household Journals and Secure WhatsApp Summaries

A household journal is shared with caregivers who are separately invited, verified, and accepted into that child's caregiver circle. Entries remain part of the child's shared history even if the caregiver who recorded them later leaves. A current caregiver may request a summary of that shared history.

For WhatsApp, complete shared-household summaries are not delivered into another caregiver's chat. Calmemo creates a seven-day secure website link for the requesting caregiver. The link alone is not enough to view the journal: Calmemo sends a one-time code to that caregiver's WhatsApp number, binds access to the requesting browser, creates a short session, and rechecks current household membership whenever data is read. Calmemo does not ask you to forward the link, and a person who only receives a copied link cannot authenticate with it.

7. How We Use AI

We use Google Vertex AI to turn your messages into structured, parent-reported logs and summaries. Calmemo does not use your journal for advertising or model training. Google processes content as our service provider under its Vertex AI data-governance terms.

8. Public Beta Boundary

The public beta is for adult caregivers in Canada and the United States. It is not intended for children to operate directly, healthcare providers, clinics, employers, emergencies, diagnosis, or treatment decisions.

9. Retention and Deletion

Journal events are retained for up to one year unless you delete them sooner. When you confirm /deletedata, Calmemo permanently erases your profile, messaging delivery endpoint, children, caregiver memberships, health events, appointments, medications, pending notifications, secure-report records, and related live records — this cannot be undone. Two narrow exceptions, neither of which contains child or health information: (1) if you have or had a paid subscription, we retain limited billing records (such as Stripe customer and invoice identifiers and payment amounts) for up to 6 years to meet tax and audit obligations, after which they are automatically deleted; and (2) we may retain a minimal account-eligibility record — a one-way hashed (HMAC) version of your messaging account identifier together with your free-trial and payment status — to prevent duplicate free trials and to meet billing and tax obligations. This eligibility record stores no child, health, profile, message content, or phone number, cannot be reversed back to your messaging identifier, and is automatically deleted on the same 6-year schedule. Encrypted disaster-recovery copies may retain deleted records for up to 35 days before automatic expiry and are used only for service recovery. Payment and subscription information, if collected, is handled separately from your child's health-journal content.

10. Contact

Questions, country corrections before onboarding, relocation requests, or privacy requests can be sent to hello@calmemo.com. A move between country data planes requires review; we do not move health-journal data automatically.