Effective date: September 17, 2026
Website privacy notice updated: October 29, 2026
Serenity Software (“we”, “us”, “our”) offers a variety of applications and services. This policy describes how we collect, use, and protect your information across all of our applications and the serenity.software website (collectively, the “Services”). Your use of the Services is also governed by our Terms of Service.
Information We Collect
Account Information
When you create an account for any of our applications, we collect your email address and a securely hashed password. We do not store plaintext passwords.
Connected Accounts
Some of our applications integrate with third-party services (e.g. Google, Microsoft) using OAuth. When you connect a service, we store encrypted OAuth tokens so the application can access the data you’ve authorized. We never see or store your third-party passwords.
Synchronized Data
When you connect a service or import content, an application may synchronize data such as calendar events, contacts, tasks, messages, documents, or other content you choose to share. This data is encrypted and stored on our servers solely to provide the service you’ve requested.
Device Information
Where applicable, when using on-device AI features, basic device capability information (chip model, memory) may be sent to our server to recommend an appropriate AI model. The AI model itself runs entirely on your device. Your content is never sent to external AI services.
Usage Data
The production website uses Fathom Analytics for aggregate website usage, booking-link clicks, and newsletter signup events. This analytics service is separate from the optional advertising preferences below. Local development previews do not load Fathom. Our website does not add booking answers or contact information to these analytics events.
Consultation Bookings
When you book a consultation, Cal.com collects your booking details and sends them to our private client system. We keep your contact details, appointment time, and any campaign labels from the link you followed so we can respond and understand which marketing leads to paid work. The website keeps the first and latest campaign labels in your browser tab’s session storage, for up to 30 days or until that session ends. We pass those labels and the landing page path to Cal.com when you book. These labels are restricted to campaign codes, campaign/ad/creative identifiers, experiment labels, and a recognized landing-page path. Arbitrary URL parameters and free-text booking answers are not copied into attribution. If session storage is blocked, permitted campaign labels can travel in links between our pages so booking still works.
On pages with an embedded calendar, it loads automatically when you open the page. Your browser connects to Cal.com to display available times, including before you make a booking, and supplies the permitted campaign labels and landing page path described above. Cal.com receives connection information such as your IP address and browser information. You can also use the direct Cal.com link. Cal.com’s own privacy notice applies to its service. Loading the calendar does not require advertising permission.
Optional Advertising Measurement
Optional Meta and LinkedIn advertising measurement is currently disabled on this website. No Meta or LinkedIn advertising scripts or pixels are installed.
The advertising preferences control is separate from enabling a platform on the website. Saving a preference cannot activate a disabled platform. Booking remains available if you refuse advertising, withdraw permission, block browser storage, or cannot load scripts.
If a platform is enabled after review and you give permission for that platform, we intend to associate campaign labels and real browser/click identifiers with confirmed bookings, qualified conversations that took place, and verified payments. Optional identifiers are limited to Meta click/browser identifiers or LinkedIn click identifiers. After permission, a genuine Meta click ID in the current page URL can be formatted as Meta’s click identifier with its original creation time; we do not invent a browser identifier. Website attribution excludes names, email addresses or hashes, phone numbers, company names, free-text problems, and unrelated URL parameters. Operational booking details remain in our client system; they are not added to website advertising metadata.
When the first-party preference endpoint is configured, we send a random consent token, your platform choices, and the notice version to our client system. It stores a digest of the token and a server timestamp. Current permission must be confirmed there before the website supplies optional advertising metadata to Cal.com. A failed update suppresses advertising on the page. If the server cannot confirm a withdrawal, the preferences panel asks you to retry; contact us if it still fails.
Preferences are kept in this browser tab’s session storage for up to 30 days. Server permission also expires 30 days after the platform grant; page visits and repeated saves do not extend that grant. After expiry, a fresh choice is required. If browser storage is blocked, your choices apply to the current page only. You can use “Advertising preferences” on this Privacy page to withdraw at any time. Withdrawal clears optional identifiers from the website’s session state and requests a server preference update when configured. It stops future permitted use; it cannot recall data already sent. Changing a preference may close an unfinished embedded booking to remove its old metadata. A fresh booking remains available. We do not replay events that occurred before permission.
Before optional measurement is activated, the final recipient and event payload, provider terms, retention, and notice must be reviewed. Advertising will remain off until that separate review and activation are complete.
How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve our applications
- Synchronize your data across devices
- Recommend compatible AI models for your hardware
- Send important service-related communications
- Detect and prevent abuse or security incidents
Data Storage and Security
- All data is transmitted over TLS (HTTPS).
- OAuth tokens are encrypted client-side before being stored on our servers. We cannot decrypt them.
- Passwords are salted and hashed using industry-standard algorithms.
- Our infrastructure runs on dedicated servers. We do not use multi-tenant cloud platforms.
Data Retention
We retain your data for as long as your account is active. If you delete your account, we will delete your data within 30 days, except where retention is required by law.
Third-Party Services
Our applications connect to third-party services only at your explicit request. Each connected service is governed by its own privacy policy. We only access the scopes you authorize during the OAuth flow.
Your Rights
You may at any time:
- Access your data through the application
- Disconnect any linked third-party service, which removes the stored tokens
- Delete your account and all associated data by contacting us
- Export your data upon request
Children’s Privacy
Our applications are not intended for use by anyone under the age of 13. We do not knowingly collect information from children.
Changes to This Policy
We may update this policy from time to time. We will notify you of material changes via email or an in-app notice. Continued use of our applications after changes constitutes acceptance.
Contact Us
If you have questions about this privacy policy, contact us at privacy@serenity.software.