Last revised October 29, 2026. Controller: Webhaus LLC, 2108 N St, Ste 4030, Sacramento, CA 95816, USA; hello (at) webhaus (dot) info.
This page says what the site stores, in plain words, calendar by calendar. There are no accounts, no newsletter and no sale of data.
When you make a calendar
- Your email address is stored with the calendar. It is used to send you the secret edit link when the calendar is created, and again if you ask for your links on the My calendars page. It is not shown to anyone who opens the calendar, not used for marketing and not passed to anyone else. It is deleted with the calendar.
- The calendar’s content: the title, the background you chose, the text, links and uploaded photos behind the doors, the settings (number of doors, dates, an optional password, stored as a hash). This is what the calendar shows to the people who open its link.
- The IP address the calendar was created from, stored with the calendar to limit abuse (how many calendars one address can create per hour). Deleted with the calendar.
- The edit link is stored only as a hash. We cannot read it back; the “My calendars” page issues new ones.
When you open a calendar
- The calendar’s link is unlisted: it is not published anywhere by us and carries a
noindexinstruction for search engines. Anyone who has the link can open the calendar, which is why it should be sent to the person it is for. - If the calendar has a password, a cookie on your device remembers that you entered it (120 days). The site’s own pages set no other cookies. Your browser’s local storage remembers which doors you have opened and your choices in the Effects tab (snow, lights, chime, music, videos), on your device only.
- Videos behind a door come from YouTube (through the privacy-enhanced player at youtube-nocookie.com), Vimeo (with the “do not track” parameter), TikTok or Instagram. A video door first shows a note naming the service; the video loads only after you tap “Open it”, and that choice is remembered on your device until you switch it off in the Effects tab (“Videos open straight away”). When a video loads, the service receives the request (your IP address, the page it came from) and applies its own privacy policy; ads inside a YouTube player are YouTube’s. Nothing loads from these services before that tap.
- GIFs behind a door are images served by GIPHY. Opening such a door sends the request to GIPHY, which applies its own privacy policy. The GIF search in the calendar maker runs through our server: GIPHY receives the search words, not your address.
- Christmas music plays only after you switch it on in the Effects tab. It is a YouTube player (youtube-nocookie.com), and the same applies as for videos.
- Links behind a door lead to other sites, which have their own policies.
How long calendars are kept
A calendar is kept through its season and into the new year. On March 1, calendars of the previous season are deleted together with their uploads and the email address. You can delete your calendar at any time with the edit link; deletion is immediate and complete.
Server logs and the content delivery network
The web server and Cloudflare, which delivers the site, record requests (IP address, time, page, browser) in their logs for security and operation. Cloudflare’s processing is governed by its own privacy policy. The hosting provider’s logs are retained for a short period and are not combined with calendar data.
Advertising on the site
The editorial pages and the calendar pages may show advertising served by Google AdSense. Google and its partners may use cookies and similar technologies to show ads based on your visits to this and other sites; where the law requires it, you are asked for consent before such cookies are set, and you can change your choice through the consent notice. Google’s use of data in advertising is described at https://policies.google.com/technologies/partner-sites, and you can manage ad personalisation at https://adssettings.google.com/. No advertising is shown inside the doors of a calendar.
Affiliate links
Some links on the editorial pages are affiliate links: if you buy something through them, the vendor may pay the site a commission. The vendor may set a cookie to attribute the purchase. The affiliate disclosure lists the programs. There are no affiliate links inside calendars.
The edit-link emails are sent from the site’s own server. We do not send any other email.
Your rights
You can ask what we hold about you, ask for its correction or deletion, and object to processing, by writing to hello (at) webhaus (dot) info with the calendar link or the email address used. For a calendar, the fastest way is the edit link’s “Delete this calendar”. Readers in the European Union and the United Kingdom have these rights under the GDPR and may complain to their data-protection authority; readers in California have the rights described in the CCPA, and the site does not sell personal information.
Children
The site’s pages are written for adults; calendars made for children are made by their parents or teachers. We do not knowingly collect personal information from children. A teacher sharing a class calendar should follow the school’s rules on pupils’ photos and names; the page on photos of children behind a door summarises them.
Changes
Changes to this policy are dated at the top of this page.