Privacy

What we keep. Your email address and name from sign-in; the settings of your wall (its address, timezone, location for weather, layout and colours); the photos you upload or pick from Google Photos, and the framing decisions you make; the address of any calendar feed you paste; and, if you connect Google Calendar or Microsoft Outlook, a token that lets the wall read the calendars you choose and add the events people enter on it. Weather comes from Open-Meteo using your chosen location only.

Google user data

Signing in with Google shares your name, email address and Google account id with us. We use them to create and recognise your account, and for nothing else.

Connecting Google Calendar asks Google for two permissions: to see the list of calendars in your account, and to view and add events on them. With them we read the names and colours of your calendars, so you can choose which ones your wall shows and which one new events go into; we read the title, time, all-day flag and place of events on the calendars you chose, from about six weeks ago to about ten weeks ahead, and for any other month someone turns the wall's calendar to, to show them on your wall; and we create the events you add on the wall, in the calendar you picked. We never change or delete events, and we never read events from calendars you did not choose.

Adding photos from Google Photos asks Google for one permission, in a step of its own: to see the photos you pick in Google Photos. Each time you use it, Google's own picker opens and you choose photos there; Hestia receives only the photos you chose, never the rest of your library, your albums, or anything else in your account. We copy each photo you picked into your wall's storage, with the date it was taken (a copy sized for your screen, a small thumbnail, and a larger copy for 4K screens), and show it on your wall like a photo you uploaded. Videos are skipped. To frame people well, the wall finds where the people are in each photo with an object-detection model that Cloudflare runs for us; the result is kept with the photo and used for nothing else.

How Google data is stored. The tokens Google gives us, a copy of the events your wall shows, and the photos you picked are kept with your wall on Cloudflare's servers, encrypted at rest; the events are refreshed every few minutes while the wall is in use. Only you, the wall, the screens you pair with it and the people you invite can see them.

Sharing. We do not sell Google user data, share it with anyone, use it for advertising, or use it to train AI models. No person at Hestia reads it, except with your permission to help you, or where the law or keeping the service secure requires it.

Removing access. Settings → Calendars → Disconnect revokes the token at Google and deletes the copied events straight away. Settings → Photos → Disconnect Google Photos deletes the photos token, and revokes it at Google when Google Calendar is not connected too (revoking ends all of Hestia's access to that Google account); the photos already copied stay on your wall until you delete them in Settings → Photos. You can also remove Hestia under Third-party connections in your Google Account. Deleting your account removes everything.

Limited Use. Hestia's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft user data

Connecting Microsoft Outlook (an Outlook.com, Hotmail or Live account, or a work or school Microsoft 365 account) asks Microsoft for two permissions: to read and write your calendars (Calendars.ReadWrite), and to keep that access without you signing in again (offline_access). It does not sign you in to Hestia and does not read your email, contacts or profile. With them we read the names and colours of the calendars in your account, so you can choose which ones your wall shows and which one new events go into; we read the title, time, all-day flag and place of events on the calendars you chose, from about six weeks ago to about ten weeks ahead, and for any other month someone turns the wall's calendar to, to show them on your wall; and we create the events you add on the wall, in the calendar you picked. We never change or delete events, and we never read events from calendars you did not choose.

How Microsoft data is stored and shared. Exactly as for Google above: the token and a copy of the events your wall shows are kept with your wall on Cloudflare's servers, encrypted at rest, refreshed every few minutes while the wall is in use, seen only by the wall and the screens you pair with it, never sold, shared, used for advertising or used to train AI models.

Removing access. Settings → Calendars → Disconnect deletes the token and the copied events straight away. Microsoft does not let an app withdraw its own permission, so to remove Hestia from your Microsoft account as well, use account.live.com/consent/Manage (personal accounts) or My Apps (work or school). Deleting your account removes everything.

Everything else

iCloud shared albums. If you paste a shared album link, we read that album through Apple's public album endpoints and show its photos on your wall. Keep the link private: anyone who has it can see the album.

Who can see your wall. Only you, the screens you pair, and the people you invite in Settings → Sharing, who can look but not change anything. Each screen and each invite has its own link, which works for whoever has it and which you can remove at any time. There is no public wall: anyone else is asked to sign in.

Payments. Subscriptions are handled by Stripe. Your card details go to Stripe on its own checkout page and never reach us; we keep the Stripe customer and subscription ids, the plan, its status and when it renews, so the wall knows whether to show.

Deleting. Settings → Account cancels your subscription and deletes your wall, its photos, its settings and tokens, and your account, right away.

Cookies. One signed cookie keeps you signed in and one keeps a paired screen on its wall. No other cookies, no tracking, no advertising. We count daily totals (sign-ups, wall views) without identifying anyone. Our public pages (the home page, setups, this policy, the terms and what's new; never your wall, its screens or Settings) use Cloudflare Web Analytics, which counts visits without cookies and without identifying you.

Contact. Write to hello@hestiacalendar.com.

Last updated October 25, 2026.