Smirk
Privacy Policy
Smirk is a calendar for iPhone made by Vennory LLC. This policy explains what we collect, why, who sees it, and how to delete it. It is written to be read.
1. Who we are and what this covers
Vennory LLC ("Vennory," "we," "us") is the controller of the personal data described here. This policy covers the Smirk app for iPhone and iPad, the smirk.co website, public booking pages at smirk.co/<username>/<link>, time-offer links at smirk.co/t/<code>, and the servers behind them (together, "Smirk"). Vennory's other websites and products have their own policy.
2. Information we collect
2.1 Information you give us
- Account. You sign in with your Google Account. We store the name, email address, and profile photo Google provides, plus an account identifier we generate.
- Username and booking pages. The username you claim, and for each booking link: its name, duration, meeting location or video provider, availability windows, buffers, and the calendars whose busy times block it.
- Your content. Contacts you add or edit in Smirk (names, emails, phone numbers, addresses, birthdays, photos, notes, tags), events you create, todos, gift ideas and gift history, and voice notes you record. Attachments and voice notes are stored with the item they belong to.
- Email-in. If you forward an email to your personal Smirk address, we receive that message (sender, subject, body, attachments) to suggest a contact from it.
- Support. Anything you send us when you ask for help.
2.2 Information from Google, with your permission
Smirk is a Google Calendar client. When you grant access we use these Google APIs:
| Google data | What we access | What we do with it |
|---|---|---|
| Google Calendar | Your calendar list, events (titles, times, attendees, locations, descriptions, conferencing links), and free/busy times. | Show your calendar in Smirk; create, edit, and delete the events you manage in Smirk; write confirmations for meetings booked through your booking links and time offers; compute which times are free on your booking pages. |
| Google Contacts (read-only) | Names, emails, phone numbers, photos, addresses, birthdays. | Read once, only when you tap Import, to create people entries in Smirk. Never read in the background. |
| Google Tasks (read-only) | Task titles, notes, due dates, completion status. | Read once, only when you tap Import, to create todos. Never read in the background. |
Smirk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the features you see in Smirk. We do not sell it, do not use it for advertising, do not let humans read it except with your permission, for security, or as required by law, and do not transfer it to third parties except as needed to run Smirk (Section 4) or as the law requires. You can revoke Smirk's access at any time at myaccount.google.com/permissions.
Server-side calendar access. Booking pages need to stay accurate while the app is closed. When you turn on "Keep availability fresh" for a booking link, Smirk stores a Google Calendar credential for that account on our servers, reads that account's free/busy times server-side, and keeps a cache of busy intervals so your public page can show open slots. Our servers also write confirmed bookings and time-offer confirmations to your Google Calendar. If you never turn this on, calendar access happens only on your device.
2.3 Information from your device, with your permission
- Contacts — to import the people you choose. Read only when you run an import.
- Calendars — to show your iPhone and iCloud calendars alongside Google, and to count their events as busy time on booking pages. Read on the device; never uploaded.
- Reminders — to import open reminders as todos, when you choose to.
- Photos — to attach images to todos and contacts.
- Microphone — to record voice notes.
- Notifications — a device push token, so we can deliver reminders and booking alerts.
You can change any of these in iOS Settings at any time. Smirk does not request your device location.
2.4 Information from people who book you
Guests who use a booking page give us their first and last name, email address, the time they chose, their time zone, and an optional note. Recipients of a time-offer link give us their email address. We use this to create the calendar event, send the invitation, and show the booking to the host. Guests do not need a Smirk account, and this policy applies to their data too.
2.5 Information collected automatically
- Usage analytics. Firebase Analytics records app events such as opening the app, completing setup, seeing a paywall, starting a trial, finishing an import, or creating a booking link, with device model, OS version, app version, country, and an app-instance identifier. Events never include names, emails, contact details, or event titles.
- Crash and performance data. Firebase Crashlytics and Performance Monitoring collect crash logs, stack traces, app start time, and network timing, with device and OS details.
- Feature flags. Firebase Remote Config fetches configuration values using an app-instance identifier.
- Server logs. Our servers log requests with IP address, timestamp, and the endpoint called, kept for operations and security.
Smirk contains no advertising SDKs, does not use the Apple advertising identifier (IDFA), and does not track you across other companies' apps or websites.
3. How we use information
- To run Smirk: show and edit your calendars, people, todos, and gifts; sync your account across every device you sign in on; publish your booking pages; confirm bookings; send reminders and alerts.
- To geocode addresses you type: when you enter or edit a location, the text is sent to Apple's Maps services for autocomplete and to resolve a state or region. Apple's processing is governed by Apple's privacy policy.
- To turn forwarded emails into contacts: the message you forward is processed by an AI model from Anthropic to extract a name, company, email, and phone number. Only the forwarded message is sent, never your Google data, and Anthropic does not use it to train models under our agreement.
- To verify your subscription: see Section 5.
- To understand and improve Smirk: aggregate analytics and crash reports tell us what breaks and which features people use.
- To protect Smirk and comply with law: preventing abuse of booking pages and email-in, enforcing our Terms, and responding to lawful requests.
For people in the EU, UK, and similar jurisdictions, our legal bases are: performance of our contract with you (running the service), your consent (Google and device permissions, notifications), our legitimate interests (security, analytics, improving the product), and legal obligations.
4. Who we share information with
We do not sell personal information and never have. We do not share it for advertising. We share it only with:
- Service providers that run Smirk, bound by contract to use data only for us: Google Cloud and Firebase (authentication, database, hosting, functions, push messaging, analytics, crash reporting) in the United States; Apple (payments, push notifications, Maps); Anthropic (email-in parsing only); Postmark (receiving forwarded emails).
- People you choose to share with. Your public booking page shows your name, photo, link name, and open times to anyone with the link. Guests' details are shown to you as the host. Calendar invitations you send go to the people you invite.
- Authorities when required by law, subpoena, or to protect the rights, safety, or property of Smirk, our users, or the public.
- A successor if Vennory is involved in a merger, acquisition, or sale of assets; this policy would continue to apply to your data.
5. Subscriptions and payments
Smirk is sold as an auto-renewable subscription through Apple's App Store. Apple processes the payment; we never see your card or billing details. To keep your subscription working on every device you sign in on, we verify it server-side with Apple's App Store Server API and App Store Server Notifications, and we store the product purchased, the paid-until date, Apple's transaction identifier, and a record of each verified notification. Manage or cancel the subscription in your Apple Account settings.
6. Where data is stored and for how long
Your account data lives on Google Cloud servers in the United States. If you are outside the United States, your data is transferred there; for EU and UK users we rely on Standard Contractual Clauses and our providers' data-protection commitments. Data is encrypted in transit (TLS) and at rest. Server-side calendar credentials are stored in a restricted collection that only our functions can read.
- Your content and Google data stay in your account until you delete them or delete your account.
- Booking and time-offer records are kept while the page or offer exists and removed with your account.
- Forwarded emails are processed and not retained after the suggestion is created; the suggestion itself is yours to keep or dismiss.
- Analytics and crash data are retained by Firebase for up to 14 months and reported to us in aggregate.
- Server logs are kept for up to 30 days.
7. Deleting your data
- Delete your account from Settings inside Smirk. This removes, from our servers, your booking pages and their bookings, aliases and username, email-in address, stored calendar credentials, subscription record, all synced content, and your account itself. Your Google Calendar is left untouched.
- Sign out to remove all Smirk data from that device without deleting your account.
- Revoke Google access at myaccount.google.com/permissions. Smirk then stops reading your Google data immediately.
- Cancel the subscription in Apple Account settings; deleting the account does not cancel it, because only Apple can.
You can also ask us to delete or export your data by contacting us (Section 11). We verify requests before acting on them.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to restrict or object to certain processing, to withdraw consent, and to complain to a data-protection authority. You can exercise most of these directly in the app; for anything else, contact us. We respond within the time the law requires and never discriminate against you for exercising a right.
California residents. The CCPA gives you the right to know what personal information we collect and how we use and share it (this policy), to delete it, to correct it, and to opt out of sale or sharing. We do not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of. We do not knowingly collect personal information of consumers under 16.
9. Children
Smirk is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us data, contact us and we will delete it.
10. Changes to this policy
When we change this policy we update the date at the top and, for material changes, tell you in the app or by email before they take effect. The current version is always at smirk.co/privacy.
11. Contact
Vennory LLC
United States
vennory.com/contact