Fan Calendar Build my calendar

Privacy

fancal privacy policy

Effective date: October 9, 2026

1. Who we are

fancal.app (“fancal”, “we”, “us”) is operated by NDC Group Technology, LLC, a Florida limited liability company based in Miami. This policy explains what personal information we collect when you use fancal.app and its calendar feeds, how we use it, and the choices you have. It's part of our terms of service.

We keep data collection to what's needed to run the service. We don't sell your personal information.

2. Information we collect

  • Account: email address, username, display name, and password (stored only in hashed form). From you, when you sign up.
  • Signing in with Google, Apple or Microsoft: where we offer it, you can sign up or sign in with one of these accounts instead of a password. The provider shares your name, your email address and an account ID with us, and tells us whether your email address is verified. With Apple you can choose Hide My Email, in which case we receive a private relay address that forwards to your inbox. We use this only to create your account, sign you in, and link it to an existing fancal account with the same verified email address. We never receive your password for that account, and we don't store your profile photo or keep any access to your Google, Apple or Microsoft account.
  • Membership and billing: plan, subscription status and dates, payment history, and billing details you give at checkout. Card numbers are handled by Stripe; we see only limited details such as card type and last four digits.
  • Feed preferences: teams, competitions and custom feeds you follow, feed names, and your private feed token.
  • Student status (school calendars): if you create a school calendar, we store that you told us you're a student, which school you chose, and when. We use it only to provide that calendar. We don't verify it or share it.
  • Feed usage: when each feed was last fetched and how often, recorded when your calendar app downloads it.
  • Feed access logs: a hashed (one-way) IP address and device user-agent, with first and last access times.
  • Custom feed creation: a one-way hash of the IP address used to create a custom feed, used to prevent spam and rate-limit creation.
  • Server logs: IP address, browser type, pages requested and timestamps, kept by our hosting provider.
  • Messages: anything you send us by email.
Website analytics. If you accept analytics cookies, Google Analytics collects pseudonymous usage data on fancal.app, such as pages viewed, device and browser type, approximate location and referring site. See section 5.

We don't collect your precise location, contacts, or the contents of your calendar. Adding a fancal feed lets your calendar app download our events; it doesn't give us access to your calendar.

3. How we use information

We use your information to:
  • create and run your account and build your personal calendar feeds;
  • process payments, manage your plan, and apply plan limits;
  • send service emails, such as a link to confirm your email address when you sign up, account notices, feeds paused after a plan change, and warnings before paused feeds are deleted;
  • detect and stop shared, scraped or abused feeds, and prevent spam;
  • keep the service secure, fix problems, and understand overall usage so we can improve it;
  • respond to your messages and meet legal obligations.
We only send marketing emails if you've agreed to them, and every one includes a way to unsubscribe.

4. Who we share it with

We don't sell your personal information or share it for cross-context behavioral advertising. We share it only with:
  • Service providers that help us run fancal, under contracts that limit their use of it: our payment processor (Stripe), our web host (GoDaddy), our email provider (Google), and our analytics provider (Google Analytics).
  • Sign-in providers. If you choose to sign in with Google, Apple or Microsoft, that provider knows you used your account to sign in to fancal, under its own privacy policy. We don't send it your feeds or other fancal activity.
  • Legal and safety. When required by law or to protect the rights, safety or property of fancal, our users or others.
  • Business transfers. If NDC Group Technology, LLC is involved in a merger, acquisition or sale of assets, your information may transfer as part of it. This policy will continue to apply to it.
The sports data providers that supply fixtures and scores never receive your personal information.

Third-party links. Event descriptions may link to streaming, ticketing or other sites, some through affiliate programs. If you click through, that site's own privacy policy applies, and it may know you came from fancal.app.

5. Cookies and similar technologies

fancal.app uses cookies that are needed for the site to work: they keep you logged in, protect forms against forgery, and remember your session during checkout. A fancal_consent cookie remembers your cookie choice for 180 days. If you choose a team on a team page before signing up, a fancal_follow cookie remembers that team, and nothing else, for up to one day, so it can be added to your account once you've signed up. Calendar feeds themselves don't use cookies.

With your consent, we also use Google Analytics, which sets its own cookies, to understand how visitors use the site: pages viewed, device type, approximate location (city or country) and how people found us. Analytics doesn't load until you click Accept on our cookie banner, and you can change your choice anytime with cookie settings. Google processes this data on our behalf. You can also opt out with Google's opt-out browser add-on or by blocking cookies. Free-plan sponsor messages inside calendar events are plain text and don't track you.

You can block or delete cookies in your browser settings, but you won't be able to log in without them.

6. How long we keep it

  • Account and feed preferences: until you delete your account.
  • Student status: until you delete your account or your school calendar.
  • Paused feeds (after premium ends): 90 days, then permanently deleted, with a warning email at day 75.
  • Feed access logs (hashed): 30 days after the last access, then deleted automatically.
  • Custom feed creation IP (hashed): as long as that custom feed exists.
  • Billing and payment records: as long as tax and accounting law requires, typically up to 7 years.
  • Server logs: per our hosting provider's standard retention.
  • Google Analytics data: 14 months, then deleted automatically by Google.
  • Emails you send us: as long as needed to handle your request.
When you delete your account, we delete or anonymize your personal information within 30 days, except records we must keep by law.

7. Your choices and rights

Anyone can:
  • update your account details and feeds from your account and my feeds pages;
  • regenerate your feed token to cut off access from old feed URLs;
  • unsubscribe from marketing emails using the link in each one;
  • change your cookie choice at any time with cookie settings;
  • ask us for a copy of your information, to correct it, or to delete your account by emailing legal@groupndc.com.
US state privacy rights. Depending on where you live (for example California, Virginia, Colorado or Florida), you may have the right to know what we collect, get a copy, correct or delete it, and opt out of sale or targeted advertising. We don't sell personal information or use it for targeted advertising. We won't treat you differently for using these rights.

EU, UK and similar laws. If these laws apply to you, our legal bases are: performing our contract with you (running your account and feeds); legitimate interests (security, abuse prevention, improving the service); legal obligations (tax records); and consent (marketing emails, analytics cookies). You can also object to or restrict some processing, ask for your data in a portable format, withdraw consent at any time, and complain to your local data protection authority.

We'll respond within 30 days, or sooner if the law requires. We may need to verify your identity first, usually by confirming a request comes from your account's email address.

8. Security, children and international users

Security. We use HTTPS throughout, hash passwords and IP addresses, give every feed URL a private random token, protect administrator accounts with two-factor authentication, and limit admin access to the people who run the service. No system is perfectly secure. If we learn of a breach that affects your information, we'll notify you as the law requires.

Children. fancal isn't directed at children under 13, and we don't knowingly collect their personal information. If you believe a child under 13 has given us information, contact us and we'll delete it.

International users. fancal is run from the United States, and your information is stored and processed there. US data protection laws may differ from those where you live.

9. Changes and contact

We may update this policy as the service changes. If a change is material, we'll notify you by email or on the site before it takes effect, and we'll always update the effective date at the top.

Questions or requests about your privacy:
NDC Group Technology, LLC · Miami, Florida, USA · legal@groupndc.com