Privacy Policy

When is run by Aaron Pepper in Ontario, Canada ("When", "we", "us"). He is responsible for your personal information and answers privacy questions at privacy@when.day.

This policy covers the when.day website and app, and the API behind them.

• Account details: your email address, name, username, profile photo, birthday if you add one, and sign-in records such as sessions and two-step verification.
• Calendar data: calendars, events, periods, bookings, notes, marked days, check-ins, labels, event types, drawings, and your settings.
• Assistant conversations: your messages, images you attach, and the replies, when AI features are on.
• Connected calendars: calendar names and events imported from Google or Outlook.
• Billing: your plan, trial dates, and subscription status. Card details go to Polar and never reach us.
• What you tell us: support email, feedback, and answers such as why you canceled.
• Usage and device data: pages opened, actions taken, errors, loading speed, browser type, and IP address, as described under analytics below.

We use your information to run When: to store and sync your calendars, send the email you expect, answer the assistant requests you make, bill your plan, keep accounts secure, answer support, and find and fix problems.

We don't sell your personal information or share it for advertising, and we don't use your calendar data or conversations to train AI models.

Where privacy law asks for a legal basis, we rely on our agreement with you to provide When, our legitimate interest in keeping When secure and working well, and your consent where the law requires it.

We share information with these providers only to run When:

• Convex is our database and file storage. It holds your account, calendars, uploads, and conversations.
• WorkOS runs sign-in, sessions, two-step verification, and the connections to Google and Outlook Calendar.
• Cloudflare hosts when.day and our API, so every request passes through it.
• Anthropic runs the assistant, editor suggestions, and browser extension captures when AI features are on.
• Exa runs the assistant's web searches. It receives the words of each search, never your email address.
• Polar runs checkout, subscriptions, and payments.
• Resend sends our email.
• PostHog receives product analytics and error reports.
• OpenCage or Photon (run by komoot) turns the place text you type into a map location. Requests can include a rough area based on your time zone.
• Google and Microsoft supply the calendars you connect.

A few requests go straight from your browser to other services. Map styles load from Protomaps' public files on GitHub. Links on events show the linked site's icon, loaded from that site, and event cover images load from wherever they're hosted. After a Google or Microsoft sign-in, your profile photo can load from their servers. If you turn on push notifications, your browser's push service delivers them. Each of these sees your IP address.

These providers work in the United States and other countries, so your information may be stored and processed outside Canada. Where European or UK law applies, we rely on the safeguards in our providers' data processing terms, such as Standard Contractual Clauses; email privacy@when.day for details. We may also disclose information when the law requires it or to protect someone from harm. If When is sold or merged, your information would move with it under this policy.

AI features are on for new accounts. You can turn them off during setup or in Settings, under AI, which stops new AI requests. While they are on, the assistant sends Anthropic your messages, images you attach, and the calendar details it reads, which can include event titles, times, places, and notes, along with where you are in When when you send a message, such as the calendar on screen and any item you have selected. It starts with the calendar you have open and can read any calendar you can access when a request calls for it. When it looks something up on the web, Exa receives the search words and Anthropic receives the pages Exa finds. Each morning it also reads your day to write a briefing for your Inbox.

Editor suggestions and browser extension captures also go to Anthropic. Suggestions send the title or pasted text being read, along with your event type and label names and descriptions. Captures send the text or images you select.

Anthropic deletes these requests and replies within 30 days. If its safety systems flag one as breaking its usage policy, it can keep that request and reply for up to 2 years and the safety scores for up to 7 years. It keeps data longer when the law requires it. By default, it doesn't train its models on API data.

You have one ongoing conversation with the assistant, kept with your account until you delete it. The assistant also keeps its own working record of recent turns, stored with Cloudflare. Deleting your account deletes the conversation, the images you attached, and that working record.

If you connect another AI app to When, it reads and changes your calendars with the access you approve, and its own privacy policy covers what it does with that data. Remove the When connector in that app to disconnect it.

When you connect Google or Outlook Calendar, you sign in to that provider through WorkOS, which holds the access. When uses it to read your list of calendars and the events in the ones you choose, and keeps a copy of those events so they stay in sync. When doesn't write anything back to Google or Outlook.

When you invite someone to a calendar, we email them the invitation. Once they accept, they can see that calendar's items.

If you make your profile or a calendar public, anyone with the link can see your username, name, profile photo, and the events you choose to show, either in full or as busy time. Guests' email addresses on events are never shown publicly.

Someone who books time on your booking page gives us their name, email address, and an optional note. We add the request to your calendar and email both of you about it. Guests don't need an account.

Booking emails to guests come from When and identify you by your name or username. They do not share your account email address, including after you accept a booking. You receive the guest's name, email address, and any note with their request.

We send the email you need to use When: sign-in and security codes, account changes, exports, reminders you set, invitations, booking updates, and trial and billing notices, including a reminder 30 days before your plan renews. Password reset email comes from WorkOS.

The daily digest is off until you turn it on. Settings also has switches for product news, tips, offers, and research invitations. They start on, but we haven't sent any of these yet, and we'll ask you to confirm before we send the first one. Each will include a one-click unsubscribe link.

Push notifications are off until you allow them in your browser.

When uses a few cookies and browser storage to run the app. None are for ads.

• Sign-in cookies (when_session_0 to when_session_4) hold encrypted sessions for up to 30 days, and when_account_default remembers which signed-in account is selected. Scripts on the page can't read them.
• Local storage keeps your device preferences, the accounts signed in on this browser, unsent drafts, and your analytics choice.
• An offline copy of your calendars lets When open without a connection and holds edits that haven't synced yet.
• A service worker caches the app's files so it loads quickly and offline.

Signing out removes the sign-in cookies and account details from that browser but keeps the offline copy, so unsent edits aren't lost. On a shared computer, clear when.day's site data in your browser after signing out. Deleting your account clears the offline copy on the browser you delete it from.

When this setting is on, this browser sends PostHog the pages you open, named actions such as creating an event, errors, and loading speed, linked to your account. It starts on unless this browser sends Do Not Track or you've turned it off. The setting doesn't change server reporting.

Our servers send PostHog account and product activity; error, sync, and security diagnostics; and AI usage such as token counts, cost, and response times. This continues when browser analytics are off, and reports may be linked to your account.

We don't record your screen, replay your sessions, or capture what you type. Product analytics carry action names and settings, not your calendar entries, feedback, or conversations. Error reports include messages and stack traces, which can contain details from the operation that failed.

• Your account and calendar data stay until you delete them or your account.
• Events, periods, and calendars you archive stay in Archive for 60 days, then are deleted for good.
• Notes, marked days, and check-ins you delete are kept until you delete your account.
• Your assistant conversation and its working record stay until you delete your account.
• Sent, canceled, and failed notification records are deleted after 90 days. Welcome and waitlist records stay until you delete your account, so we never send them twice.
• Records of synced changes are deleted 90 days after the sync completes.
• Prepared export files are available for seven days, then deleted by the next hourly cleanup.
• Images you upload but don't use: your 34 most recent.
• Copies of the email we send, including sign-in codes, are kept by our email system with no set limit yet.
• Undo history lives only in your browser's memory and is gone when you reload.
• PostHog keeps analytics under its retention settings until you delete your account.
• Polar keeps payment records for as long as tax law requires.

Export your data from Settings, under Data & privacy, at any time, including after your trial or plan ends. WHEN data (.json), with All calendars selected, includes your profile, settings, calendars, events, periods, notes, check-ins, marked days, labels, event types, drawings, assistant conversations (without attached images), connected calendar details, and feedback. A calendar file (.ics) or spreadsheet (.csv) includes your scheduled events, bookings, and unavailable time. Download the prepared file in Settings within seven days. We also email a link to your account address; downloading requires signing in to that account. Neither includes uploaded images, payment records, or items other people added to your shared calendars; email privacy@when.day for a copy of anything else we hold about you.

To delete your account, choose Delete account in Settings, under My account, and enter the code we email you. You're signed out and the account is scheduled for deletion. To change your mind, sign in within 30 days and choose Restore account. After 30 days, we delete your account and calendar data and ask PostHog to delete your analytics. Connected calendars can keep importing during those 30 days.

Copies may remain in our daily database and file backups for up to seven days after deletion from the live system.

A few records outlast that: your sign-in record at WorkOS, your customer record at Polar, invitations other people sent to your email address, entries with your email in our internal admin log, and copies of email we sent you. Items you added to calendars other people own leave a deletion record, without their content, for 60 days so their devices can remove them. Email privacy@when.day and we'll delete what we can, apart from payment records Polar must keep.

You can ask to see, correct, export, or delete your personal information, and withdraw consent you've given, such as for AI features or optional email. Depending on where you live, you can also object to or restrict how we use it. Settings covers most of this; for anything else, email privacy@when.day. We answer within 30 days.

If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or the data protection authority where you live.

When is for people 18 and older, and we don't knowingly collect information from anyone younger. If you think a child has an account, email privacy@when.day and we'll delete it.

If a change affects how we use your information, we'll email you before it takes effect. The date at the top shows the last change.

Privacy questions and requests go to privacy@when.day, and everything else to hey@when.day. Security explains how we protect your data and how to report a vulnerability.