The short version.

No pixels, no ad networks, no third-party analytics. We collect what we need to run the product, we don't sell any of it, and you can delete your account whenever you want. To answer you, Cal sends your questions to the AI providers named below. The rest is just sentences.

What we collect

• The trial form. Name, email, brokerage, role, and whatever you put in the "anything we should know" box.
• Your account. Your name, email, brokerage, and role. If you use Sign in with Apple, Apple gives us your name and either your email or the private relay address Apple creates for you.
• Sign-in events. A short-lived sign-in link or a passkey, and a session token so we don't ask you to sign in twice.
• What you ask and give Cal. Your questions and Cal's answers; text and documents you paste or upload, such as AUS findings and Loan Estimates; property addresses you look up; and the scenarios, packages, contacts, and notes you save. Loan documents can include your borrower's information.
• Usage records. Which tools you use and how much AI processing each request took, so we can run plans and budgets. When you're signed in, Cal also records which features you open and for how long, on our own servers, to improve the product; it never includes what you type, we keep it 90 days, and we never share it.
• Server logs. Standard web stuff (IP, path, timestamp) kept for about two weeks for security and abuse-blocking. Then they're rotated out.

In the Cal app for iPhone and iPad, voice dictation is transcribed on your device. The audio isn't sent to us.

What we don't collect

• No Google Analytics, no Facebook pixel, no Hotjar, no Segment, no third-party heatmap.
• No cookies on the marketing pages, none at all. Open the inspector if you don't believe us.
• No tracking across other sites. We don't know where you came from and we don't care.

How we use it

To run Cal: answer your questions, run the tools you open, manage your plan, and keep the service secure. To check that Cal's answers are right, Chris reads a daily email of the previous day's questions and answers, along with the email address of each account that asked. We don't use your data for advertising.

Where it lives

The marketing site is on Hostinger shared hosting. The API and database run on a Hostinger virtual private server in the United States. Every request to askcal.io passes through Cloudflare, which delivers and protects the site. Backups: nightly copies on the server, kept for 14 to 30 days, and a continuous copy in Cloudflare's R2 storage, which encrypts what it stores, with about 30 days of history.

Payments

Paid subscriptions are processed by Stripe. When you subscribe, your card details go directly to Stripe and are handled under Stripe's own privacy policy. Cal never sees or stores your full card number. What we keep on our side is the Stripe customer and subscription identifier, your plan, and your billing status, which is what lets us know whether your account is active. If you have no paid subscription, none of this applies to you.

Who we share it with

We don't sell your data, and we don't share it with advertisers, data brokers, "lead enrichment" tools, other LOs, or anyone who emails us asking for it. We use these service providers to run Cal, and each one gets only what its job needs:

• Anthropic (Claude) writes Cal's answers. It receives your question, the context Cal adds to it (such as earlier messages and any text or document you've given Cal), and the guideline passages Cal found.
• OpenAI turns the text of your question into a search vector so Cal can find the right guideline sections.
• RentCast provides property value estimates. It receives the property address you look up.
• Stripe handles billing, as described above.
• Resend delivers our email, including sign-in links and the daily answer review. It receives the email address and the message.
• Twilio delivers SMS alerts to platform administrators, as described below.
• Sentry receives error reports from our servers so we can fix bugs. Fields named like email, phone, SSN, date of birth, account numbers, passwords, and tokens are removed before a report is sent.
• Cloudflare and Hostinger host and deliver the site and the API, and store the backups, as described above.
• Apple, if you use Sign in with Apple, tells us your name and email. We don't send Apple anything about how you use Cal.

The only other exception is a lawful court order, in which case we'll tell you unless legally barred from doing so.

SMS communications

Cal sends SMS messages only to platform administrators who have explicitly added their mobile number to the platform's admin settings. SMS is used for operational alerts: new user signup notifications, customer lead capture alerts, automated software quality eval notifications, and system health alerts. No marketing SMS. Ever.

• Frequency. Variable. Most days zero. A typical week might see 5–25 messages, scaling with platform activity. Capped at 20 per minute by the platform itself.
• Mobile numbers are not shared. Your phone number is never sold, rented, shared, or disclosed to any third party for any purpose. Not to affiliates. Not to lenders. Not to advertisers. Period.
• Carrier costs. Message and data rates may apply, depending on your wireless plan. Cal does not charge for SMS.
• Opt out anytime. Reply STOP to any message to opt out (also accepted: UNSUBSCRIBE, CANCEL, END, QUIT). You can also remove your phone number directly in the platform admin settings.
• Help. Reply HELP for assistance, or email chris@askcal.io.
• Carriers and providers. SMS is delivered through Twilio (our messaging provider). US carriers (AT&T, Verizon, T-Mobile, and resellers) are not liable for delayed or undelivered messages.

Deleting your account

In the Cal app for iPhone and iPad: Account, then Delete account, below Sign out. Anywhere else, email chris@askcal.io with "delete my account" in the subject. When an account is deleted:

• Right away. Any paid subscription is cancelled, you're signed out on every device, and your sign-in links, passkeys, API keys, Apple sign-in link, and saved memory are deleted.
• Erased. The text of your conversations with Cal, and the name and email on your account.
• Kept, locked. Records a mortgage business may be required to keep, such as the scenarios, packages, contacts, and documents you saved, and billing and security history. They stay stored but are no longer attached to an account anyone can sign in to.
• Copies elsewhere. Backups age out on the schedule above, within about 30 days. Daily review emails and error reports already sent aren't recalled, and the providers above keep request data under their own retention terms.

If your account owns a brokerage that still has other members, or is linked to a Cal staff login, the app asks you to email us instead.

How long we keep it

• Trial requests: kept so we can follow up. Email us and we'll delete yours.
• Active accounts: kept while you're a customer.
• Cancelled plans and unused accounts: kept until the account is deleted, by you in the app or by us when you ask. Nothing deletes accounts on a timer.
• Server logs: about two weeks. Backups: about 30 days.

Your rights

California (CCPA/CPRA) and EU (GDPR) folks: you have the right to ask what we have on you, ask for a copy, and ask us to delete it. Email chris@askcal.io with "privacy request" in the subject and Chris will handle it himself, usually within 72 hours, never more than 30 days. You can also delete your account yourself in the app, as described above.

Children

cal is a B2B tool for licensed mortgage professionals. We don't knowingly collect anything from anyone under 18, and you'd have to work hard to find a reason to give us yours.

Changes

If we change this policy in a way that materially affects you, we'll email every account before the change takes effect. Cosmetic edits (spelling, a clearer sentence) we just push.