Privacy
Review storage, external requests and public data before enabling sharing or AI features.
Calends is self-hosted: the ledger is stored in your Cloudflare account or on your machine, without relying on a centralized ledger service.
Where data lives
Section titled “Where data lives”| Deployment | Location |
|---|---|
| Cloudflare | A D1 database in your account. |
| Docker | A SQLite file in the data volume (/data by default). |
Passwords are stored only as PBKDF2 hashes; sessions and MCP tokens only as SHA-256 hashes. The DeepSeek API key is never returned to the browser or included in full backups. Channel configuration is available to the signed-in app and included in full backups; it is not sent to the public page.
Requests that leave your server
Section titled “Requests that leave your server”The main external requests made by ledger features are:
| Purpose | Service | What’s sent |
|---|---|---|
| Current exchange rates | open.er-api.com | Nothing; it just fetches the USD rate table |
| Historical exchange rates | jsDelivr / currency-api.pages.dev, Frankfurter | Nothing; it just fetches one day’s rate table |
| Reminders | The notification channels you configured (Telegram, Lark, webhooks…) | The reminder content |
| Email reminders | Cloudflare Email Sending | The reminder content and recipient address |
| Built-in assistant | DeepSeek, or the Base URL you set | Your text and images, the conversation, and results of the tools it calls |
| Looking up app icons | The App Store search API | The app name being searched |
| Icons in share images | The site hosting the subscription’s icon | Nothing; fetched once through your server |
Also, when a subscription has no icon of its own, the browser loads the website’s icon from Google’s favicon service, and reminder emails reference icon URLs of that kind.
Public page
Section titled “Public page”The public page is off by default. When it’s on, the server sends only allow-listed fields: paid-for subscriptions, the people list, contacts, accounts, notes, payment method names and balances, notification channels and so on never appear, and domain subscriptions are masked. See Public page.
Backup files
Section titled “Backup files”A full backup contains your notification channels’ URLs and tokens, the calendar feed token and shared plan members’ contacts. Keep it safe. See Backup and restore.
Calendar feed link
Section titled “Calendar feed link”The ICS link contains a private token; anyone with it can see your billing schedule. If it leaks, click Reset link under Subscribe in system calendar. See Calendar.
AI assistants
Section titled “AI assistants”- An AI assistant connected over MCP sees everything the tools it calls return. Give assistants that only need to read a read-only token, and turn off AI access (MCP) in Settings when you’re not using it.
- The built-in assistant forwards what you send to DeepSeek. See Built-in assistant.