Calgora

Privacy Policy

Effective 23 September 2026 · Last updated 23 September 2026

Calgora is an iOS app made by Appè Latte Limited (“we”, “us”), operating as Appè Latte. Calgora is an independent app. It is not made by, endorsed by or affiliated with The City of Calgary, Calgary Transit, the Calgary Police Service or the Government of Alberta.

This policy explains what Calgora collects, why, where it is kept, how long it stays and what you can do about it. It is written to be read, not to be survived. If anything here does not match what the app does, the app is wrong and we want to hear about it: help@appe-latte.ca.

The short version

You can use most of Calgora without an account: transit, waste and recycling, road incidents, parking, city alerts, events, community safety and the 311 hand-off all work signed out. Ask Gary is the one exception — it needs an account, because the free allowance is counted per person.
An account is an email address and a password. Your name and phone number are optional extras you can add later. The account exists so your saved places, addresses, saved events, reminders, Home layout and subscription follow you between devices.
We do not track you. Calgora has no advertising identifier, no attribution SDK, no third-party analytics and no crash-reporting SDK. The app ships with no third-party code at all. There is no advertising of any kind. We do not sell or rent your information, ever, to anyone.
Ask Gary’s questions, photos and answers are not stored by us. We keep counters, not content.
You can delete your account, and everything on your phone, from inside the app.

1. What we collect, and why

1.1 If you create an account

What	Why	Where it lives
Email address and password	To create your account and sign you in	The email is on our server; the password is hashed by Supabase Auth and we never see it
Your name and phone number, both optional	To address you properly and to reach you if you ask us something	Our server and your phone
Saved places (Home, Work, places you add) — a label, the community name and a coordinate	To show departures, parking, incidents and alerts near the places you actually care about	Our server and your phone
Saved collection addresses — label, unit, house number, street, postal code, community, which one is your main address, and the City’s own spelling of the address when it matches their schedule data	To find your collection schedule, City alerts for your block, and to pre-fill a 311 report	Our server and your phone
Saved events — the event’s id, title, venue, start and end time, whether it runs all day, and its link	So an event you saved still reads properly on your other device, even after the City’s calendar stops listing it	Our server and your phone
Notification preferences — reminder time, alert categories, quiet hours, severity, daily brief	To send the reminders and alerts you asked for	Our server and your phone
Your Home screen layout — the order of the cards	So Home looks the same on your other device	Our server and your phone
Subscription status for My Calgora — the product, the status, the expiry date and any grace period, Apple’s transaction ids, whether the receipt came from the App Store’s test or live environment, and when we last checked it	To unlock what you paid for, on every device you sign in on	Our server and your phone
Ask Gary counters and the ask ledger	To count your free asks for the month and to stop abuse (see §3.3)	Our server

Your name and phone number are genuinely optional: nothing in the app requires either of them, and sign-up asks for neither.

1.2 If you use the app without an account

Nothing in the table above leaves your phone. Your places, addresses, preferences, Home layout and everything else stay in local storage on the device. Ask Gary is unavailable while you are signed out — the app says so and offers you the screens that work without it. Two things still travel, because you asked them to: the app fetches City data from the City and the other public sources (§4), and feedback you send reaches us (§1.5).

1.3 Your location

Calgora asks for location while you are using the app only, and only ever from a tap — never at launch. There is no background location, and Calgora never draws you on a map.

There are exactly three places that take a location fix:

“Use my location” on a 311 report, to fill in where the problem is.
“Use my location” in Address Lookup, to find your civic address.
A photo you take for Ask Gary. A fix is taken at the shutter; for a photo you pick from your library, the photo’s own GPS tag is read instead.

Turning a fix into an address takes a lookup, and the lookup leaves your phone. Calgora sends the coordinate to The City of Calgary’s open data service, which answers with the nearest addresses on its collection schedule. On a 311 report and on a Gary photo, if the City has nothing within 250 metres the coordinate then goes to Apple Maps instead; Address Lookup asks the City only, and tells you to type the address when the City has nothing. So at that moment the coordinate does leave your phone — to the City, or to Apple — and comes back as a street address. Neither of them is told who you are, and we do not keep the coordinate.

What happens next depends on the screen. In Address Lookup the address lands in the form in front of you and goes no further. On a 311 report the address fills the location field, and because a real fix stands behind it the coordinate is written into the draft too — as a “Location: 51.04720, -114.04310” line. That line is part of the text Calgora copies to your clipboard when you hand the draft to 311, so if you paste the draft into the City’s form, the coordinate goes to the City with it. Nothing is sent by the app; typing in the location field by hand clears the fix, and the line goes with it. With a photo for Ask Gary, it is the address — plus how accurate the fix was, and whether it came from the camera or from the photo’s own tag — that travels with the photo to our server and to the AI provider. The coordinates themselves do not.

Everything else that looks “near me” — nearby stops, parking zones, road incidents, alerts — works off a place you saved, not off a live fix.

We do not keep a history of where you have been. A fix is used for the request in front of you and then discarded.

About the coordinates you save. A saved place is a point you picked, and its coordinate is kept in your account so the same place works on your other device. It is what Calgora uses to ask the City what is near you, so that coordinate goes out with those requests (§4). The copy that goes to Ask Gary is rounded to four decimal places — roughly 11 metres — before it leaves your phone.

You can refuse location entirely. The app keeps working; the screens that need it say so plainly and offer to search instead.

1.4 Photos and the camera

A photo for Ask Gary leaves your phone. It is resized to at most 1280 pixels on the long edge and re-encoded as a JPEG, which drops the original file’s metadata, and then it is sent to our server and on to the AI provider that reads it (§3). It comes back as a description, and the photo is not kept — not by us, not in your ask record, not anywhere on our server. If Gary drafts a 311 report from what it saw, the draft carries the text, not the photo.

A photo you attach to a 311 report does not leave your phone. It is held in memory for that one draft. Calgora has no way to file a 311 request for you, so you add the photo yourself on the City’s own form.

An attachment on a community safety report or tip does not leave your phone either. Calgora strips the location metadata out of it first — and refuses to attach it at all if the stripping fails — then holds it in memory for that draft. You attach it yourself on the Calgary Police Service’s or Crime Stoppers’ own site.

A profile photo is cropped and saved as a file on your phone. It is never uploaded.

1.5 Feedback (“Tell the Developer”)

When you send feedback we store the message, the category you chose, and — only if you turn on “Attach diagnostics” — your app version, your device model and the name of the last screen you were on. The server keeps only those three diagnostic fields and discards anything else. No addresses, no saved places, no coordinates.

If you are signed in, we also store your account email with the message so we can reply to you. If you are signed out we have no address for you, so we cannot reply — the app still gives you a reference number.

1.6 What we never collect

No advertising identifier. No IDFA. No device fingerprint. No contacts, calendar, health or financial data. No analytics or crash-reporting SDK of any kind. No browsing history. No background location. No push-notification device token — every reminder and alert Calgora shows you is scheduled by your own phone, so we cannot send you a notification and we hold nothing that would let us.

Payment details are handled entirely by Apple — we never see your card, and Apple does not give it to us.

2. What stays on your phone

To be specific, because “we don’t collect it” is worth spelling out. None of the following is stored on our server or synced to your account. It lives on your device, and it is erased when you delete the app or delete your account:

311 report drafts and community safety report drafts, and anything attached to them
Your profile photo
Collection check-ins (“put out” / “collected” / “missed”) and missed-collection records
311 requests you follow
Your activity list
A running parking timer, including the plate you typed
Your notification history
What you have told Gary to forget, and the watch switches on the What Gary Knows screen
Cached copies of City data, so the last good copy can be shown (clearly labelled) when you are offline
Your conversations with Gary

One thing to be straight about: asking Gary a question uses some of this. To answer, the app sends with your question the category and location of a 311 draft, the request numbers you follow, a running timer’s zone and end time, and the last few turns of the conversation — never the plate, never a photo attached to a 311 draft, never your notification history. Those details are sent, used to write the answer, and not stored: §3.3 lists exactly what is kept afterwards, and it holds no content of any kind. If you would rather a saved detail stayed out of it, the What Gary Knows screen turns it off, and not asking Gary sends nothing at all.

Your chat history with Gary is on your phone only. The app keeps the ten most recent conversations, of up to twenty turns each, in a file that iOS keeps encrypted until you first unlock the device. It is not backed up to us, and it does not sync between devices. Reinstalling the app loses it.

When Calgora copies a draft to the clipboard for a hand-off to 311 or to the police, it marks it local to this device and sets it to expire after ten minutes — so a draft containing your address never travels through Universal Clipboard to your other devices.

3. Ask Gary

Ask Gary is the part of Calgora that needs the most explaining, so here is the whole of it.

3.1 What is sent

When you ask Gary a question, the app sends to our own server:

your question, and any text you pasted in with it;
a photo, if you attached one;
a snapshot of context (detailed below);
up to the last six turns of the current conversation, so a follow-up makes sense;
the time, your time zone, your app’s language, the app version, and whether the device can place a call;
your account’s session, so we know whose free asks to count, and whether you are on the free or paid plan.

The snapshot of context holds:

the saved places you chose to keep — the label, the community and the coordinate, rounded to four decimal places — and your collection addresses, each as its full street address and its community;
whether you are signed in, whether you have allowed location, and your reminder settings: reminders on or off, the reminder time, and whether iOS is letting notifications through;
the state of every City data feed — live, stale, failed or missing, when it last updated, and what it cannot tell Gary;
and, when the question calls for them: your collection dates, road incidents near your saved places, the drive time to Work and what is slowing it, transit alerts and the next departures from your nearest station or stop, the 311 counts the City publishes for your community, the 311 request numbers you follow, your own 311 drafts (number, category, location and status), today’s weather, the events you saved and what is on near Home, any Alberta Emergency Alert covering a place you saved, and a running parking timer’s zone and end time — never the plate.

Anything you told Gary to forget on the What Gary Knows screen is left out of the snapshot before it is built.

When Gary looks at a photo (the camera’s “what is this?” step) much less is sent: the photo, any note you typed, and the address and accuracy described in §1.3. The snapshot that goes with it is stripped down to three things the server needs to accept the request — whether you are signed in, whether you have allowed location, and your reminder settings. No saved place, no address, no City data and no conversation go with it.

3.2 Who processes it

Our server adds Gary’s instructions and sends the request to Anthropic’s Claude API, which generates the answer. Anthropic is our processor: it processes the request to answer your question and for nothing else.

Anthropic processes these requests in the United States, under its commercial terms. Your questions, photos and answers are not used to train any model — not by us, and not by Anthropic.

Your Calgora account id, email, name and phone number are not sent to Anthropic. It sees the question, the snapshot, the conversation turns, the photo, and whether you are on the free or paid plan — not who you are.

Gary may also run up to three web searches per question, and only against a fixed list of official sites: calgary.ca, data.calgary.ca, calgarytransit.com, calgaryparking.com, calgarypolice.ca, alberta.ca, emergencyalert.alberta.ca, albertahealthservices.ca, myhealth.alberta.ca, weather.gc.ca and calgarylibrary.ca. Those search terms go through the same provider. The search carries a fixed, approximate location — “Calgary, Alberta, Canada”, in the Calgary time zone — which is the same for every person using Calgora and is not your own position.

3.3 What we keep

For every ask we keep a ledger row containing: an id, your account id, the month, whether it was an ask or a photo, whether the server could rule it out of your allowance before the answer came back, whether it counted against your free allowance, what happened to it, a topic label from a fixed list (for example waste_schedule, transit, civic_report), the model name (or a failure code), token counts, how many searches it used, a one-way hash of the request so that pressing Retry does not charge you twice, a link to the earlier row when it was a replay, and timestamps. We also keep a per-month counter for your account.

It contains no question, no answer, no photo and no text you wrote. We keep it to count your free asks, to enforce a burst limit, and to know roughly what Gary is being asked about so we can make it better.

Our server also writes one diagnostic log line per request: ids, enum values and numbers only — the request id, the ask’s own id, whether it was an ask or a look, which part of the app it came from, the outcome, the topic label, the model, token counts, how long it took, and error codes. It carries no question, no snapshot, no photo, no answer and not even your account id. Supabase keeps those logs for a short period under its own retention for our plan, and then they are gone. We do not copy them anywhere else.

3.4 What Gary will not do

Gary will not look up private information about another resident, will not search for people or for records tied to an address, and will not tell you who reported something to 311. It answers from the snapshot above, from official pages it cites, and from what you tell it — and it says “I can’t confirm that yet” rather than guessing.

3.5 Gary is not an emergency service

Gary is not a dispatcher, a doctor, a lawyer or the City. In an emergency, call 911. Do not rely on Calgora for anything where being wrong is dangerous.

4. Where your information is kept

Calgora’s backend runs on Supabase, in a data centre in the United States (US East, Ohio). Ask Gary’s model provider, Anthropic, also processes requests in the United States.

This means that information covered by this policy is stored and processed outside Canada, and while it is there it may be accessible to United States courts, law enforcement and national-security authorities under the laws of that country. We think you should know that before you create an account. Everything in §1.2 stays on your phone and never crosses a border. So does everything in §2 — until you ask Gary a question, when the details named there travel with it, are used to write the answer, and are not stored.

Our service providers

Provider	What they do	Where
Supabase	Hosts the database, accounts and the server functions	United States
Anthropic	Generates Ask Gary’s answers and runs its web searches, as our processor	United States
Apple	Handles all purchases, subscriptions and app delivery, under Apple’s own privacy policy	Apple’s regions

We use these providers to run Calgora. None of them are permitted to use your information for their own purposes.

What Apple gets from us. Apple runs the purchase itself, so it sees what a purchase needs. One extra thing goes with it: when you start a purchase from the Ask Gary paywall while signed in, Calgora attaches your Calgora account id to the transaction (Apple calls this the app account token), so the receipt our server checks can only belong to your account and nobody else’s. That id is an internal UUID that means nothing outside Calgora. Restoring a purchase sends no id at all. Nothing else about you reaches Apple from us — not your name, not your email, not an address.

City of Calgary and other public data. When Calgora shows you transit, waste, road, parking, 311, event, weather or alert data, it is reading public data. Those requests go from your device to The City of Calgary’s open data service (data.calgary.ca, which also carries Calgary Transit’s schedule and real-time feeds), to the City’s events calendar (hosted for the City by Trumba), to Environment and Climate Change Canada (api.weather.gc.ca) and to Alberta Emergency Alert. Calgora makes the same requests in the background when iOS gives it a moment, so your alerts and your daily briefing still arrive while the app is closed.

What those requests contain. The data coming back is public, but the request that asks for it says something about you, so here is what goes out. To get your collection schedule, Calgora asks the City’s open data service for your collection address. To find the stops, parking zones, community boundary or civic address near a place you saved, it sends that place’s coordinate. Nothing else goes with either request: no name, no email, no account id, nothing that tells the City which resident is asking. Those services see your IP address the way any app or browser would, and none of them tell us who you are.

Apple Maps (MapKit) draws the maps in the app, suggests places while you type in the place search, turns a coordinate into a street address when the City has none, and works out travel times and routes. What you type, the place you pick and the coordinates involved go to Apple, under Apple’s privacy policy.

The 311 data Calgora reads is the City’s published, community-level data: every request in it sits at its community’s centre point, so it carries no reporter’s name and no report location.

5. How long we keep it

What	How long
Account email, name, phone, saved places, addresses, events, preferences, Home layout	Until you delete it in the app, or delete your account
Subscription status	Until you delete your account (we keep it while the subscription is live so it works on your devices)
Ask Gary ledger rows and monthly counters	Until you delete your account
Server log lines	Supabase’s own short retention for our plan, then gone
Feedback messages	See below
Your questions, answers and photos	Not kept at all
Everything in §2	On your phone until you delete it, or delete the app

Feedback is the exception. A feedback message you send is a support record. If you later delete your account, the message and any diagnostics you chose to attach are kept, so a bug report does not vanish mid-investigation — but they are unlinked from your account and the reply address is deleted with the account, which means we can no longer contact you about it. If you would rather we deleted a specific feedback message entirely, write to help@appe-latte.ca with the reference number the app gave you (it looks like FB-2601) and we will.

6. Your choices and your rights

In the app, right now:

See it. My → Account → Export My Data shares a JSON copy of your profile details, your account email and sign-in method, your saved places, your collection addresses, your activity list, your reminder settings and the ids of the events you saved. It does not include your Gary conversations (they are on the phone, in the app), your profile photo, or feedback you have sent (ask us for that).
Change it. My → Profile edits your details and your Saved Places; the Address screen manages your collection addresses.
Delete it. My → Account → Delete Account deletes your account and everything listed in §1.1 from our server, and then erases everything listed in §2 from your phone. The server deletion happens first: if it fails, nothing is erased and the app tells you why. It is immediate and it cannot be undone. Signed out, the same row reads Delete My Data and clears this phone. Your App Store subscription is separate — cancel that through Apple.
Ask Gary what it knows. The What Gary Knows screen lists every fact that goes into a snapshot. “Forget” on a row stops Gary using it from the next ask onwards. It does not delete the saved place or address itself — use Profile → Saved Places, or the Address screen, for that. “Forget everything” clears every fact at once and also deletes every Gary conversation on this phone. The same screen turns off the watches: the one that lets Gary read the 311 requests you follow, for instance.
Turn things off. Location, notifications, camera and photo access are all iOS permissions you can withdraw at any time in Settings. Calgora keeps working without them and says what it cannot do.

How your consent works. The screens that need nothing from you send us nothing, so there is nothing to consent to. Creating an account is your consent to the list in §1.1. Location, camera, photo and notification access are iOS permissions you grant to Calgora and can take back at any time in Settings. Asking Gary a question is your consent to send that question, and what §3.1 lists, to our server and on to Anthropic — not asking sends nothing. You can withdraw your consent by turning a permission off, by using Forget on the What Gary Knows screen, by deleting a saved place or address, or by deleting your account.

Under Canadian privacy law — the Personal Information Protection and Electronic Documents Act, and Alberta’s Personal Information Protection Act — you have the right to ask what personal information we hold about you, to ask for a copy, to ask us to correct it, and to withdraw your consent. Write to help@appe-latte.ca and we will answer within 30 days. If you are not satisfied with our answer you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or to the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca).

7. Security

Accounts are protected by row-level security: the database will not return one person’s rows to another person, regardless of what the app asks for. Every request to our server is over HTTPS. Passwords are hashed by Supabase Auth and we never see them. Feedback lives in a schema the public API does not expose at all. The key that lets Calgora talk to the model provider lives only on our server and is never in the app. On your phone, the Gary conversation file is stored with iOS file protection, and drafts copied for a hand-off are local to the device and expire after ten minutes.

No system is perfect. If we ever have a breach that creates a real risk of significant harm to you, we will tell you and the Privacy Commissioner, as the law requires.

8. Children

Calgora is a city-services app for a general audience. It is not directed at children under 13 and we do not knowingly collect personal information from them. If you believe a child has created an account, write to help@appe-latte.ca and we will delete it.

9. Changes to this policy

If we change this policy in a way that matters — new information collected, a new provider, a new purpose — we will update the date at the top and tell you in the app before the change takes effect. Small corrections and clarifications will just be updated here.

10. Contact us

Appè Latte Limited, operating as Appè Latte.

Privacy, support and data requests: help@appe-latte.ca

One person at Appè Latte Limited is accountable for privacy and for this policy, and that address reaches them. Write for a copy of what we hold, a correction, a deletion, to withdraw your consent, or to complain — we answer within 30 days.

We do not publish a postal address; email reaches us and is the fastest way to get an answer.

You can also reach us from inside the app: My → Help & Feedback → Suggest an Idea or Report a Problem (the sheet is titled “Tell the Developer”).

What changed

23 September 2026 — first published version. Nothing has changed yet. When it does, the change will be listed here with its date, and anything that matters will be told to you in the app before it takes effect.

Privacy, support & data requests

Appè Latte Limited. Write for a copy of what we hold, a correction, a deletion, or to withdraw consent — we answer within 30 days.

help@appe-latte.ca