Calm Mere Privacy Policy
This policy explains how Forest of Knowledge INC, the software company operating Calm Mere at www.calmmere.com, handles information when you use its family-coordination services. It covers parents, invited relatives, and other participants. Questions and privacy requests can be sent to notifications@calmmere.com.
1. Information we collect
Adult account profiles: Your name, optional bio and sanitized photo are stored encrypted, separate from dating coordination and the parenting archive. Partial drafts are owner-only. Completed account profiles can be viewed by authorized active family members, but a dating connection does not grant access to the photo or bio. Dating invitations and scheduling do not require these fields beyond your display name. Family invitation requirements remain separate.
Optional dating photo: You can save a sanitized profile photo without completing a bio or detailed profile. That save explicitly enables photo-only access for your active dating connections. Existing account photos keep their previous audience until you make this choice. Peer metadata contains only an account identifier and a protected photo URL, never the bio, draft fields or profile completion state. Photo access is checked again against current sharing, revision and connection status. Photos remain in the existing encrypted account-profile store; location metadata is removed.
Invitation sign-in codes: A partner invitation can include a one-time first sign-in code in its email subject and body. Codes expire after 10 minutes and are stored as verification signatures, not plaintext codes. Code-entry links contain a challenge identifier and named invitation token; opening a link does not confirm identity or accept the invitation. Ordinary stored send and delivery metadata redact the leading sign-in code. Delivered emails, recipient email providers and email notification previews can contain it. Standard provider processing and backup retention still apply.
Account and family information includes names, email addresses, household relationships, roles, permissions, invitations, verification records, and agreement records. If you request texts, we collect your mobile number, selected notification categories, SMS consent time, verification and opt-out status, and delivery or error metadata. Verification codes are short-lived; we store a keyed verification signature rather than the plain code. We also receive information about someone when a family member invites them or includes them in a household record.
Content includes parenting plans, schedules, exchange times, requests, decisions, signatures, comments, messages, tags, uploaded files, and associated dates and history. Medical event records include the child involved, event time and priority, health-event description, care provided, follow-up or corrections, and version-specific acknowledgements. Childcare requests include selected grandparents, their responses, and the first acceptance that confirms the time block. Files and discussions may contain sensitive information about children, education, health, or legal matters. Session features can collect audio, video, recordings, transcripts, and notes when used.
Technical and operational information includes session identifiers, request and error logs, timestamps, email recipients and subjects, delivery results, and email interaction events. Hosting and email services may process network and device information such as IP addresses and browser details to deliver and protect the service.
Dating connections store encrypted invited email and single-purpose invitation tokens, participant identifiers, consent and revocation times. Dating resources store selected times and IANA timezones, proposal decisions, cancellation categories, optional shared explanations, author-only notes, pending future requests and immutable audit history. Availability overrides, including multi-day windows, are encrypted separately. A separate per-person choice controls whether a parenting calendar is used to derive broad available blocks. That choice is private to its account owner and is excluded from the recipient’s availability response. Legacy introduction records remain stored with their existing retention protections while their interface and automatic publication are disabled.
Memory boards can contain meeting dates and stories, a living or deceased person’s life story, descriptions, dates, photos, PDF documents, audio, video, named recipients, contributions, review status, and trash or recovery information. Family reference profiles can include a person’s name, relationship to children, living or deceased status, description, optional birth and death dates, and child links. Adding a reference does not create an account for that person.
School calendars: Parents can add school dates, breaks, early releases, timed events and bounded weekly schedules for selected children in their active family. Titles, child selections, notes, source excerpts and filenames are encrypted at rest; identifiers, date bounds, timezone, revisions, deduplication fingerprints and operational times support access and calendar queries. Active parents have school access by default and can explicitly grant a same-family adult relative read-only school calendar access through family permissions. School access is separate from parenting-calendar access, starts off for relatives including existing accounts, and is checked again when records are read. Revoking the permission stops future service access but cannot recall copies already obtained. Child and dating-only accounts do not receive school access. Only parents can import, add, edit or remove school events; private PDF import sources and previews stay limited to their requesting parent. Viewing or importing school events does not alter parenting assignments, handoffs, signed plans or dating availability.
2. How we use information
We use information to verify accounts, connect household members, enforce permissions, manage plans and approvals, deliver communications, store and export records, provide requested AI and session features, troubleshoot failures, prevent misuse, and respond to legal obligations and privacy requests. We retain consent records so an acceptance can be tied to the version presented.
3. Sharing within your family
Access depends on household roles and permissions. Parents manage family access, and document permissions can distinguish uploading, viewing, and access to particular files. Review recipients and permissions before sharing. Authorized users may download, print, or export accessible records.
Notification emails may include a full discussion thread, dates, decisions, and responses. Tagged people and other recipients determined by the feature may receive those emails. Removing a tag, changing permissions, or withdrawing a request cannot retrieve copies already sent or downloaded. Do not include information in a shared thread that its recipients should not receive.
Medical events and their follow-ups are available only to parents in the relevant household; relatives and child accounts cannot access this feature. Email notices about medical events and SMS notices use a general message and a link to sign in, without clinical details or child names. Acknowledgements identify the account and version acknowledged; email tracking is not a medical acknowledgement.
Dating data is separate from household records. Only active participants in that connection can access intentionally shared available windows and date plans. The bounded availability projection defaults to the upcoming 30 days and excludes original parenting intervals, handoffs, children, locations and recurring source rules. Each adult chooses sharing independently; no-share and revoked-share states reveal no available windows. A revoked or inactive connection cannot read date resources or availability through the service. A dated proposal may offer a day with no time, a range from which the recipient chooses an available day, or an exact time. These choices are checked against current shared availability. Civil dates and IANA timezones are retained without treating an untimed date as a full-day reservation. A partner never receives co-parent privileges through this connection.
Cancellation keeps the original event visibly cancelled and may create a separate unconfirmed replacement proposal or open-ended request. Optional cancellation notes and rescheduling prompts are shared only with the other adult; private proposal notes remain author-only. Ordinary emails omit these texts, locations and child details and link to authenticated date plans. Date emails and reminders default off. One explicitly scheduled follow-up requires both adults’ opt-in. No dating notice is sent to a co-parent. Detailed profiles beyond the optional photo, ex-reference/photo, child messaging, partner memory sharing and co-parent disclosure are disabled. Automatic 90-day disclosure is disabled.
You can set daily start and end hours for an available date range, such as 10 AM–8 PM on each selected day. Only those daily windows are offered from that rule. When private parenting-derived availability is enabled, the daily hours narrow those free periods and do not extend them past a parenting boundary. Manual windows and blocked periods remain explicit choices. The daily rule is stored encrypted with your own availability; the other adult receives only the resulting available intervals and applicable length limits.
You may block a specific time or an inclusive date range inside wider availability. Blocked time is excluded from choices offered to the other adult. An available window may also have a maximum date length, such as one or four hours. The limit applies separately to each date selected from that window. Overlapping saved available windows combine and keep the strictest limit. Limits remain in effect when availability comes from more than one source or both adults share times. Timed proposals must fit entirely outside blocked periods and meet every applicable limit. Untimed day or range requests need a proposed length when a limit applies, with enough consecutive available time on an eligible day; the exact start time can still be agreed later. Limits and availability are checked again before acceptance. Existing confirmed history is preserved.
Private date discussions: Optional shared request notes and comment text are encrypted at rest and scoped to the two adults in an active dating connection. Linked requests, confirmed dates and rescheduling share their discussion. These comments are kept outside family messages, co-parent views, parenting exports and AI processing. Comment identifiers, participant identifiers, account display names, timestamps and delivery status remain available to enforce access and operate notifications. Ending the connection stops discussion access immediately without silently deleting retained comments. Request and comment emails require individual date-email opt-in and omit shared notes and message text. Existing author-only private notes remain private. Availability update notices are also specific to the connection; in-app notices do not require email opt-in. Automatic parenting calendar changes do not generate availability update emails.
Common Ground: Each questionnaire is scoped to two active dating participants. Answers, priorities, skips, and optional notes are encrypted at rest. Session identifiers, participant identifiers, consent, progress, submission times, expiry, revisions, and minimal audit events remain available to operate access. Before both adults consent and submit, only the author can read their draft answers; the other adult receives general participation status, never draft choices or notes. Submission locks answers. After both submit, the same comparison is available to both; optional notes are included only when both independently opted to share notes. The fixed discussion guide uses answer comparisons without a compatibility score or prediction. Questionnaire content is excluded from AI processing, family messages, co-parent views, parenting exports, search, and notification bodies.
Common Ground sessions expire after 60 days. Withdrawal immediately stops shared report access without deleting the other adult's records. Ending a dating connection also stops access. Each author can export their own answers and explicitly remove their own answers after withdrawal, subject to unreleased retention holds; minimal audit metadata remains. Copies already received cannot be recalled. Account closure and any retained records follow the itemized deletion and retention review described below. No questionnaire is filled out, shared, or sent to a prospective companion automatically.
Relationship memory boards start owner-only. Dating-partner sharing is currently disabled. Life-story boards can be explicitly shared with selected active family accounts, covering the whole published board and future approved additions. Family membership is checked at invitation, acceptance and access; sharing does not traverse other family units. Child access requires a separate authorized parent-managed grant. No board is automatically released at a particular age.
Adult contributions and changes require owner review before publication. Pending or rejected contributions are visible only to their author and the owner, while a previously published version remains visible to readers until an approved replacement. Owners manage membership and removals; contributors manage their own submissions. A deceased parent’s reference profile has no login or approval role. Family references are available to parents in that circle; the memories themselves follow their separate board permissions.
Memory boards and media are excluded from ordinary parenting archives, household-wide exports, archive search, and AI processing. Invitations and review notices use generic email text without private stories or attachments. Board invitations require the named recipient’s verified account. No memory-board action automatically subscribes a person to SMS. Revoking access stops future service access but cannot retrieve copies already obtained.
4. Service providers and other disclosures
Cloudflare provides infrastructure used for hosting, databases, file storage, background processing, AI processing, and communication sessions. Amazon Web Services Simple Email Service handles outgoing email and delivery or interaction events. Amazon Simple Notification Service and AWS End User Messaging handle optional texts, including verification and carrier opt-out handling. AWS, telecommunications providers, and the recipient’s carrier process the destination phone number, text, routing and delivery metadata needed to deliver those messages. These providers process information needed for those functions. A recipient’s own email provider also processes delivered messages.
We may disclose information when required by law, to respond to lawful process, or as reasonably necessary to investigate abuse and protect people or the service. We may share information at your direction, including through exports and invitations. If operation of the service transfers to another operator, information may transfer with it, subject to applicable notice and legal requirements.
We do not sell mobile numbers, SMS consent records, or opt-in information, or share them with third parties or affiliates for marketing or promotional purposes. We disclose them only as needed to operate the requested messaging service through providers, at your direction, or as required by law. We do not use SMS consent as permission for marketing.
5. AI and recordings
When AI features are used, relevant permitted documents, extracted text, archived content, prompts, and responses may be processed by the service’s AI infrastructure. AI output can contain personal information and can be inaccurate. Check the original source before relying on it.
Communication sessions may be recorded and transcribed, with resulting artifacts stored in the archive. Participants should review session notices and obtain any legally required permission before recording or sharing another person’s information.
Optional school PDF import: When a parent selects Import PDF, the app can extract readable PDF text on the device automatically. Cloudflare receives the uploaded PDF for validation and the extracted text and instructions for AI suggestions; when device text extraction is unavailable, Cloudflare can also convert the PDF to text. Device-extracted text is untrusted source material, not verified documentary evidence. Only that source, instructions and school-year bounds/timezone are supplied to the importer, not parenting plans, messages, medical records or child names from the family roster. Once the upload is accepted, processing continues as a private background job even if the website closes. The source and unreviewed preview are encrypted and available only to the requesting parent in the selected family for up to seven days. If device text is unavailable, the PDF is temporarily stored in private encrypted storage and removed after its extracted text is saved; expiry and recovery cleanup handle interrupted work. Private import jobs are included in eligible account-deletion cleanup. Source files and previews are not added to Documents, parenting archives, search or the site assistant. Text conversion requests output without PDF metadata. Draft suggestions become shared school calendar records only after a parent reviews and adds selected events. Saved excerpts and filenames follow the event's encrypted storage and family access. AI can miss or misread dates; parents can edit, omit or enter events manually. Import progress does not automatically send email, SMS or push notices.
6. Cookies, browser storage, and email tracking
Cookies support authentication and session security. Browser storage remembers information such as the last-used email address and application preferences or locally maintained state. Clearing browser storage may remove those preferences or require signing in again; it does not delete server records.
Email logs can include sends, delivery, bounces, complaints, opens, and clicks where those events are available. Authorized administrators can use these logs to investigate delivery problems. Open and click signals may come from email privacy tools or automated scanners; they do not prove that someone personally read a message.
7. How long records remain
The current archive is designed to retain family records indefinitely rather than automatically delete them after a fixed period. Archived files and audit records use storage intended to preserve history. Requests, decisions, signatures, comments, medical events, follow-ups, acknowledgements, and related records may remain after cancellation, correction, removal from a household, or account closure.
Verification links expire, but expiration does not itself erase the associated verification or consent record. The app does not provide ordinary deletion controls for all retained records. This retention design does not override applicable privacy rights or legal retention limits. Contact us to request review of specific information and explain your request; we will assess applicable requirements and any restrictions affecting shared or legally retained records.
Legacy introduction records remain stored under existing retention rules while the feature is disabled. Disconnecting blocks further dating access without silently deleting retained proposals, cancelled dates or audit records. The ending adult may send an optional shared message, stored in the encrypted immutable connection audit. Only the other adult can read the resulting in-app connection notice and record its read time. This limited notice remains available after revocation; it does not reopen calendar or date-record access. Ending messages are excluded from email bodies, co-parent views and ordinary family messages. In-app delivery does not require opting into email. Copies already obtained cannot be recalled.
Memory boards use a separate removal policy. An owner can trash a whole board or any memory; a contributor can trash their own memories. Content is hidden immediately and recoverable for 30 days. Restoring a contribution can return it for owner review. Expired trash, superseded content, and associated media are removed from primary memory storage after that period. Limited operational or removal metadata may remain, and provider backup or disaster-recovery copies can persist until the provider’s applicable retention period expires; those copies are not an additional user recovery option. Removing a board does not retrieve copies already downloaded. Ordinary parenting records and shared partner-introduction history retain their existing retention rules.
Removing a school event hides it from the calendar. Its retained encrypted record and save-operation metadata follow applicable family-record retention, holds and account-deletion review; removal does not silently erase shared history. School events are kept separate from the parenting-time archive and are not automatically included in parenting exports or AI assistant retrieval.
8. Your choices and requests
You can update available profile details in Settings and ask a parent managing your household to review access permissions. Invitation recipients can decline an invitation to stop its reminders. Operational messages associated with participation may still be needed for account security and requested activity.
Depending on applicable law, you may have rights to access, correct, obtain a copy of, delete, or restrict use of personal information, or to object to certain processing. Contact us to make a request. We may need to verify your identity and authority, especially where another person’s or a child’s records are involved. We will explain restrictions that prevent fulfilling a request. You may also contact the relevant privacy regulator where that right applies.
Adults can manage text categories, verify their own number, and stop texts in Settings → Text notifications when the service is available. SMS consent is separate from Terms acceptance and optional. Dating and partner-introduction texts are disabled. Reply STOP to cancel carrier texts or HELP for help; support is also available at notifications@calmmere.com. Stopping texts does not delete family history or necessarily stop operational emails. If your number changes, stop texts for the old number and verify the new one. Do not subscribe someone else’s number.
9. Children’s information
Parents and guardians should share only information they are authorized to provide and manage children’s access carefully. Children’s information may be included in schedules, files, messages, and recordings even when the child does not have an account.
A Terms checkbox or family invitation does not establish verifiable parental consent required by children’s privacy law. Where separate notice and parental consent are legally required, those requirements must be met before collecting the child’s information. A parent or guardian can contact us to review a child’s information, request correction or deletion, or report collection without appropriate authorization. Do not send additional sensitive information about a child in an initial inquiry.
10. Security and processing locations
The service uses authentication, access permissions, and infrastructure security controls to protect information. Medical descriptions, care and follow-up text, and the child-name snapshot in this feature are encrypted at rest using household-specific keys; identifiers, event times, priority, notification status, and acknowledgement metadata remain available to operate access and alerts. Partner profile text and photos are also encrypted at rest using keys separated by household, owner and content type. Profile photos are resized and location metadata is removed. Profile identifiers, owner and household identifiers, dates of disclosure and updates, status, visibility, notification status, and seen metadata remain available to operate access and disclosure. The service can decrypt content for users authorized by the relevant visibility rules; this is not end-to-end encryption. These controls do not prevent an authorized recipient from retaining a copy. No system can guarantee absolute security. Keep verification codes and acceptance links private and report suspected unauthorized access promptly. Providers may process information in locations outside your state or country, where privacy laws may differ.
Memory-board text is encrypted at rest and media is stored encrypted in a separate private Cloudflare R2 bucket. Access checks protect media viewing, playback, downloads, and uploads. The service can decrypt content for authorized board users; these features are not end-to-end encrypted. Identifiers, membership, visibility and review state, file type and size, upload progress, operational times, and recovery deadlines remain available to operate the feature. Photo location metadata is removed during preparation; other file formats may preserve metadata available to authorized recipients. No memory media is published under a public file URL.
Photo albums: Titles, stories and dates are optional when adding photos. When available, we read only the camera capture calendar date before preparing the image and store that date separately in encrypted album metadata. The uploaded photo is re-encoded without original EXIF, GPS or camera metadata and checked again on the server. A missing capture date stays blank; we do not substitute the file modification date. Photos added before this feature are not reprocessed to infer missing dates.
Adults who can view an album photo may like it or add a comment. Likes record the account, photo and operational times; comment text is encrypted at rest. Photo conversations are visible only to people currently authorized to see that photo, including its applicable contribution-review state. Child accounts remain read-only. Removing a comment hides it; encrypted retained content follows album/media recovery, cleanup and applicable holds. Photo conversations do not create family chat messages or enter the parenting archive or AI context. Photo activity notifications for comments and likes start on for new accounts and existing accounts without saved preferences. You can turn them off in Settings. Saved opt-outs are preserved, and changing preferences does not replay earlier activity. Only currently authorized photo readers can receive an activity notice, and push content stays generic. Turning off the choice or muting a board stops unsent activity delivery.
Album privacy acknowledgements: Before a new adult accepts board access, we record their explicit acknowledgement of the album privacy rules. The record identifies the board, recipient, accepting account, exact rule version and server acceptance time. An authorized parent acknowledges privacy expectations for a parent-managed child account; we do not claim that a child entered a binding contract. Existing members are not recorded as having agreed automatically. The rules do not create legal privilege, promise court exclusion or restrict lawful legal process, preservation duties, legal advice, safety reports or legal rights. Retention and legal-hold requirements remain unchanged.
Notification choices
When a verified primary email or an already verified backup email is replaced, we may send a security warning to the previous verified address as well as the current account contact. Prior destinations and verified join-applicant decision destinations are encrypted in a separate delivery queue, cleared after delivery, and removed after at most 30 days. These notices contain generic account/access information and do not grant access to family records.
Committed shared actions can generate an in-app notice for their authorized recipients, including plan reviews and signatures, calendar and childcare changes, shared documents, family access changes and account-security events. Account-security notices stay private to that account. Revoked-access receipts link to a safe landing page rather than the unavailable record. All activity notification categories, including photo activity, games, compatibility and due reminders, start on for new accounts and existing accounts without saved preferences. Saved opt-outs are preserved. You can turn categories off in Settings; phone push still requires device permission and activation, and SMS requires separate consent and verification. You can mute eligible boards or conversations and set digest and quiet-hour preferences. Changes apply to queued delivery; no action or notification counts as agreement, signature or medical consent.
Mobile apps and optional push notifications
The Calm Mere iOS and Android beta uses the same account permissions as the website. A dating connection does not grant co-parent access. Native sign-in checks your email code, Terms agreement when required, and any required second factor directly with our Cloudflare backend inside the app. Pending sign-in details stay in app memory; device credentials are protected by iOS Keychain or Android Keystore. Trusted mobile sessions expire after 30 days without renewal or 90 days in total and can be revoked from the Security center. Website cookie sessions retain their separate expiry.
With your permission, we register an installation identifier and an Apple or Firebase notification token. Tokens are encrypted at rest. Cloudflare Workers sends configured push deliveries to Apple Push Notification service or Google Firebase Cloud Messaging. Those providers process installation tokens and delivery metadata; Firebase is used for Android push delivery, not as Calm Mere's account or family-data backend. Lock-screen alerts contain generic update text and an opaque notification identifier; private content is fetched only after account and resource authorization. Push consent is independent of email and SMS. You can change categories or disable push in Settings or your phone settings. Delivery is best effort and is not an emergency service.
Adult dating beta access requires an age eligibility step and operator review. We retain the eligibility result, method and review metadata, not the entered birth date. Known child accounts cannot gain dating access by changing family circles. Later partner-profile, ex-photo and automatic co-parent disclosure features remain disabled.
Account closure and deletion requests
Request account deletion in Settings or start at our account-deletion page. Confirmation requires a fresh code to your account email and does not require accepting a newer Terms version. Closing an account revokes its access and stops ordinary inbox, push and family notification delivery. For this verified deletion request only, we temporarily retain an encrypted copy of the verified receipt email and private receipt link to send confirmation, processing-problem, retention-review and completion receipts. These receipts are separate from family notifications and do not include private family records. The encrypted receipt contact is removed after final completion delivery or at most 90 days; provider delivery records follow provider retention. Eligible private data is queued for removal from primary storage within 30 days. Your private receipt reports cleanup status and categories retained for review.
Shared parenting history, exported or shared records, and legal holds receive itemized retention review. Sharedness alone does not create an indefinite exemption. Each retained category must have a reason, designated reviewer and review date; continuing decisions are reviewed at least every 90 days. Unrelated private cleanup is not delayed by a held or shared record. Cloudflare D1 recovery history can retain a prior database state for up to 30 days after a primary-storage change. Such recovery history is not an additional user recovery option. Any restoration must reapply completed deletion manifests before service access resumes. Separately exported records and legal holds follow their itemized review rather than this database recovery window.
11. Policy changes and contact
We will publish changes with a new effective date and provide additional notice or seek consent when required. Dated versions remain available for reference. For privacy questions, contact Forest of Knowledge INC at notifications@calmmere.com or +1 484-464-2248. Our business mailing address is 1032 E BRANDON BLVD, #5582, Brandon, FL 33511, United States. Include enough information to identify your request, but do not send passwords, sign-in codes, acceptance links, or unnecessary family documents.