Privacy notice
Last updated 20 October 2026. Calcali is run by Calcali. Questions: safety@calcali.app.
The short version
- We collect as little as we can, and only to run Calcali.
- No adverts, no selling or sharing your data for marketing, no tracking cookies.
- Under-18s are shown by username only. Under-13s need a parent, carer or school to approve their account before they can post.
- You can download everything we hold about you, or delete your account, from Settings at any time.
What we collect and why
| What | Why | Legal basis (UK/EU GDPR) |
|---|---|---|
| Username, password (scrambled so we can’t read it), birth year, role (student or teacher) | To make your account work and keep children’s accounts safe | Contract; legal obligation (age checks) |
| Email or phone number (if you use them) | Logging in, codes, password resets, important account messages | Contract |
| Parent or carer’s email (under-13s) | To ask for permission | Consent; legal obligation |
| What you post: questions, answers, whiteboards, pictures, votes, follows | That’s Calcali | Contract |
| Optional: country, school name, school year, curriculum, short bio, name (adults only) | Leaderboards, finding classmates, showing the right topics | Consent (you can remove them) |
| Practice results | Showing your progress, and your teacher if you join their class | Contract |
| Security information: login times, device type, a short part of your IP address | Keeping accounts safe (new-device emails, stopping attacks) | Legitimate interests |
| Crash reports (error message and page, never who you are) and page counts (no cookies, no IP) | Fixing bugs | Legitimate interests |
Pictures
We remove hidden information (like where a photo was taken) from pictures when you upload them. Pictures are checked against known child-abuse images, as the law expects.
Who else sees your data
Your posts, username, picture, points and (if you chose to share them) country and school are public. Children’s schools are visible only to themselves. We use a few service providers to run Calcali, each bound by a data processing agreement: our hosting provider, Cloudflare (network security, storage), an email provider, and (if you use phone login) a text-message provider. If you log in with Google or Apple, they tell us your account ID and email. We never sell personal data.
We share information with police or child-protection organisations only when the law requires it or a child may be in danger.
How long we keep things
- Your account: until you delete it. After 3 years of not logging in we email you, then delete the account 30 days later.
- Deleted accounts: removed straight away; backups roll over within 30 days. Your public answers stay so threads still make sense, but are no longer linked to you.
- Security logs: 90 days. Crash reports: the latest 5,000. Unanswered parental consent requests: 14 days.
Your rights
You can see, download, correct and delete your data (Settings › Download my data / Delete my account), object to how we use it, or ask us to limit it. Email safety@calcali.app and we’ll answer within a month. You can also complain to your data protection regulator (in the UK, the ICO at ico.org.uk; in South Africa, the Information Regulator).
Children
See our notice for children and parents. We follow the UK Age Appropriate Design Code, COPPA (US) and POPIA (South Africa).
Cookies
We use one cookie, to keep you logged in. Nothing for advertising or tracking. The app remembers a few settings (like dark mode) on your device.
Where your data is
Our servers are in the EU or UK. If data moves elsewhere (for example to an email provider), it’s protected by standard contractual clauses.
Changes
If we change this notice in a way that matters, we’ll tell you in the app before it takes effect.