Privacy Policy
Last updated October 2026
Who we are
CalX3 (“CalX3”, “we”, “us”) is a service of GenX3ai LLC (dba GenX3 AI), a Texas limited liability company. This policy covers the CalX3 booking platform at calx3.com and its dashboard.
What we collect
- Account information — name, email, phone number, and business details you provide when you sign up or complete onboarding.
- Social login information — if you sign in with Google or Facebook, we receive your name, email address, and a stable account identifier from that provider. We never receive your password.
- Booking & usage data — appointments, services, and client records you create while using CalX3, and basic product-usage information (pages visited, actions taken) used to operate and improve the service.
How we use it
We use your information to operate your CalX3 account, run the scheduling and reminder features you've set up, provide customer support, and keep the service secure. We do not sell your personal information.
Who we share it with
We share information only with the service providers that power CalX3 — for example cloud hosting and authentication (AWS, including Amazon Cognito), product analytics (PostHog, and only for visitors who have allowed it), and, once enabled for your account, payment processing (Stripe) and text messaging (AWS End User Messaging). These providers are only permitted to use your information to provide their service to us.
What we store on your device
CalX3 keeps a small amount of information in your browser's own storage — thelocalStorage andsessionStorage areas that websites are given. CalX3 itself sets no cookies. Three cookies are set by Stripe, our payment processor — two of them stored against calx3.com, and the third against Stripe's own domain, m.stripe.com, where Stripe rather than CalX3 is the party responsible for it. They are set only on the screens where a payment is being taken or a business is setting itself up to be paid — which now includes the step of a booking where you enter a card to pay a deposit, and still does not include simply looking at a booking page. All three are listed in full below.
Almost everything in the tables below is first-party — written and read only by CalX3 itself — and almost all of it is there either because the feature you asked for cannot work without it, or because it remembers a setting you chose yourself. Exactly one item needs your permission, and it is the analytics item described in the next section: it is not written at all unless you allow it. The other exceptions are Stripe's three cookies, which exist to check that a payment being made is genuine: two of them are stored against calx3.com but are written and read by Stripe's script rather than by us, and the third (m) is not first-party at all — it is set on Stripe's own domain, held by Stripe, and no page of ours can read it. None of it is used to profile you, none of it is used for advertising, and none of it is shared for advertising. You can delete all of it at any time by clearing site data in your browser; signing out removes most of it for you.
Kept until you sign out or clear your browser
Persistent storage. Nothing here has an expiry of its own; it stays until it is removed. Everything in this table is there because a feature you asked for needs it or because you set it yourself, with one exception — the PostHog item, which is written only if you allowed analytics and which refusing or withdrawing stops.
| Name | What it holds, and why | How long |
|---|---|---|
CognitoIdentityServiceProvider.* | The Amazon Cognito sign-in tokens (id, access and refresh) and the last-signed-in username, written by the `aws-amplify` library that we configure in `lib/amplify.ts`. They are the session. Without them a signed-in user is signed out on every page load. | Until you sign out or clear your browser storage. |
CognitoIdentityServiceProvider.*.oauthSignIn | Whether the current sign-in came through a social provider (Google, Apple or Facebook), written by the `aws-amplify` library. Signing out of a social sign-in also signs out of the shared sign-in page; this tells the library which kind of sign-out to do. | Until you sign out or clear your browser storage. |
calx3_session | Display details for the signed-in account: name, business, email, phone if the account has one, the Cognito subject id, the staff role, and which social provider was used. Renders the header and dashboard without a round trip on every navigation, and decides where a signed-in user lands. A UX gate — the real check is server-side on each API call. | Until you sign out or clear your browser storage. |
calx3_impersonate_token | A short-lived, server-signed grant that lets platform staff READ a customer account for support. It carries the organization it opens and the staff member it was issued to, and the API refuses every write made under it. Support access the staff member explicitly started, and the only thing that scopes those requests to the right business. Never written for a normal user. | Until the support session ends or the grant expires (four hours). |
calx3_user_type | Whether this account is a customer or a business, cached from the server. First paint has to pick a portal before any request completes; without it, one render lands in the wrong place and then jumps. | Until you sign out or clear your browser storage. |
calx3_active_org | The id of the organization currently selected, for accounts belonging to more than one. Keeps you in the business you were working in instead of resetting on every load. | Until you sign out or clear your browser storage. |
puck-sidebar-widths | How wide the site editor’s two side panels were left, in pixels. Two numbers. No personal data, no page content. The panel widths a staff member dragged stay where they put them the next time they open the editor. | Until you sign out or clear your browser storage. |
calx3_consent | The privacy choices you made on this browser: which purposes you allowed or refused, when you decided, the version of this policy you decided against, and a random receipt number for that decision. The receipt number is generated at random on your device, is not derived from anything about your browser or your connection, and is never used to recognize you — it exists only so that our record of the decision and your copy of it can be matched up if you ask what you agreed to. Not in use yet (provisional wording, pending legal review): once first-party analytics is switched on and you allow it, this record also lists which business pages on this browser hold an analytics cookie (an internal business id and the page address, nothing about you), so that withdrawing can delete each one. Remembers the answer you gave, so you are not asked again on every page — and so a refusal keeps applying after you navigate. Deleting it puts you back to having made no choice. | Until you withdraw your choices, the policy version changes, or browser storage is cleared. |
cx-theme | The string `light` or `dark`. Absent when the theme follows the device setting. Remembers the theme the user chose with the toggle. Read by a small inline script before first paint, so the page does not flash the wrong theme. | Until changed back to the system setting, or browser storage is cleared. |
calx3_nav_collapsed | The list of dashboard sidebar sections the user has collapsed. A layout preference the user set by clicking a section closed. | Until you sign out or clear your browser storage. |
calx3_nav_rail_collapsed | The value `1` when the user has collapsed the desktop dashboard sidebar to icons, otherwise `0`. A layout preference the user set with the sidebar collapse button. | Until you sign out or clear your browser storage. |
calx3_next_steps_dismissed_* | Which "Recommended next steps" items a staff member has dismissed — item names only. One key per organization id. No personal data. Pressing "Dismiss" on a suggested setup step has to keep it dismissed on this browser. | Until you sign out or clear your browser storage. |
calx3_avatar | The account id and the URL of that account’s profile photo. Never the image bytes. Shows the profile photo on first paint instead of a placeholder that swaps a moment later. | Until you sign out or clear your browser storage. |
calx3_plan_catalog | The subscription plans on sale — names, prices, features. No personal data. Renders pricing immediately rather than after a request. | Until replaced by a newer copy, or browser storage is cleared. |
calx3_plan_* | Which plan one organization is on, and when it started. One key per organization id. Renders the plan on first paint; reconciled against the server immediately after. | Until you sign out or clear your browser storage. |
cf.turnstile.u | Cloudflare’s own entry, stored in Cloudflare’s bot-check frame (challenges.cloudflare.com) rather than on CalX3’s pages — an opaque, signed value Cloudflare writes and reads. CalX3 cannot read it, it is never sent to us, and it holds nothing about who you are or what you booked. Part of the check that a person rather than a script is making a booking: it lets Cloudflare’s bot check recognize that this browser has passed recently. Cloudflare is the party that writes it and its own privacy terms govern it. It is written only on the booking page, and only while the bot check is switched on. | Not documented by Cloudflare; it stays until your browser storage is cleared or Cloudflare replaces it. |
ph_*_posthog | PostHog’s record of this browser for product analytics: a random identifier it generates for the device, the current visit, and which pages and steps have been seen. The `*` is our PostHog project’s public key. It holds no name, no email and nothing you typed — the form-capture and session-recording features that would collect those are switched off in code, not merely unused. Counting how many people reach each step of a booking or a signup, so the parts that lose people can be found and fixed. It is written only if you allowed analytics, it is never written before you are asked where the law requires asking, and refusing or withdrawing on your privacy choices page stops it. It is not used for advertising, and nothing about you is sold or shared. | Until you withdraw your permission or clear your browser storage. |
Kept only until you close the tab
Scratch space for one tab. It is discarded when that tab closes, and most of it is read once and deleted straight away.
| Name | What it holds, and why | How long |
|---|---|---|
CognitoSignInState.* | An in-progress Amazon Cognito sign-in: the username being signed in, which challenge Cognito asked for, and Cognito's own session handle for it. Written by the `aws-amplify` library that we configure in `lib/amplify.ts`. Lets a sign-in you started — such as confirming your email with a code while booking — finish after a page reload instead of starting over. | Until the sign-in finishes or this browser tab is closed; ignored after three minutes. |
calx3.booking.resume.* | A part-finished booking on a public booking page: the chosen location, service, staff member, date and time slot. One key per booking slug. A visitor who signs in mid-booking comes back to their selections instead of an empty page. Deliberately not the URL, so a half-finished booking stays out of browser history. | Until this browser tab is closed. Read once on return and deleted immediately. |
calx3.booking.card-save.* | A finished booking whose customer has been sent to Stripe to save a card: its reference, the confirmation the booking page just showed them (service, provider, location, time, price lines, the calendar links, the confirmation email address) and the name they typed. One key per booking slug. No card details, no card number and no address — Stripe holds the card, and this holds what the customer already saw on this page. Survives the redirect out to Stripe’s own payment page and back, so a customer who returns lands on their booking confirmation (with Add to calendar) instead of an empty booking page (#2192). Never in the URL; the offers on that screen are not stored, so they are not shown again. | Until this browser tab is closed. Read once on return and deleted immediately. |
calx3_dismissed_warnings_* | Which configuration hints a staff member has hidden — the entity, the hint, and the values it was about. One key per organization id. No personal data. Pressing "Dismiss" on a hint has to actually dismiss it, including after moving to another page. Held for the session only, so a genuine misconfiguration cannot be hidden permanently, and the hint returns by itself if the values it was about change. | Until this browser tab is closed. |
calx3_pending_booking_link | The booking slug and business name for an account being created straight after a booking. Survives the redirect out to the identity provider and back, so the new account is linked to the booking the visitor just made. | Until this browser tab is closed. |
calx3_pending_invite | The code from a team invitation link, plus the organization name and role once the preview returns them. Accepting an invitation means signing in first, which leaves the page. Without this the code is lost on the way back. | Until this browser tab is closed. |
calx3_invite_notice | A one-shot record that an invitation was just accepted: the organization, its name and the role granted. Carries the "you are in" confirmation across the redirect to whichever page the user lands on. | Until this browser tab is closed. Read once and deleted. |
calx3_signup_intent | Whether the sign-up was started from the customer or the business side of the site. The sign-up path is chosen before the account exists and has to survive a social sign-in redirect, or the new account lands in the wrong portal. | Until this browser tab is closed. |
calx3_checkout_activating_* | A flag saying a checkout for one organization has just been paid for and its confirmation has not arrived yet. One key per organization id, and nothing about the payment itself — no card, no amount, no Stripe identifier. The "we’re activating your plan" message and the checking that goes with it have to survive a refresh in the few seconds between paying and the plan appearing, or the page says "no plan yet" to somebody who has just paid. It replaced the same signal being left in the address bar, where every later refresh replayed it (#866). | Until this browser tab is closed. Deleted as soon as the plan appears, or as soon as the wait is given up on. |
Cookies
CalX3 sets none of its own, and the analytics tool described above is deliberately configured to set none either — it uses your browser’s own storage instead, which is the item listed in the first table. The three below are set by Stripe, on three screens, all to check that something is genuine: when a business is paying us for a plan, when a business is verifying its identity so it can be paid by its own customers, and when you are entering a card to pay a deposit for a booking. Two are stored against calx3.com; the third (m) is set on Stripe’s own domain, m.stripe.com, which makes Stripe rather than CalX3 the party responsible for it. They are set only on those screens, and never merely because you are looking at a booking page — Stripe recommends loading its scripts on every page of a site, and we deliberately do not.
| Name | What it holds, and why | How long |
|---|---|---|
__stripe_mid | A random identifier for this browser, generated and read by Stripe. It is not our identifier, we never receive it, and it holds nothing about who you are or what you bought. Stripe uses it to tell a genuine payment from a fraudulent one — the same card being tried from many browsers, or many cards from one — and to spot fraud while a business is verifying its identity to receive payments. It is written only on the three screens where one of those things is happening: where a business is paying us for a plan, where a business is setting itself up to be paid, and where a customer is entering a card to pay a deposit for a booking. It is not written when you are browsing a business, checking a price, or making a booking with nothing to pay. CalX3 deliberately does not load Stripe on any other page, even though Stripe recommends it. | One year from the last time Stripe refreshed it, unless you clear your browser storage. |
__stripe_sid | A random identifier for this one visit, generated and read by Stripe. As above: not ours, never sent to us, and it says nothing about you. The short-lived half of the same fraud check — it lets Stripe see one attempt as one session rather than as unrelated requests. Written only on the same three screens as the cookie above, and only while somebody is actually paying or setting payments up. | Thirty minutes from the last time Stripe refreshed it. |
m | Stripe’s own cookie, set on Stripe’s domain (m.stripe.com) rather than on CalX3’s — a random identifier for this browser, generated and read by Stripe. Stripe is the one who holds it: it is never sent to CalX3, no page of ours can read it, and it holds nothing about who you are or what you bought. The same fraud check as the two cookies above, from the same Stripe script — it lets Stripe recognize a browser it has seen before and tell a genuine payment from a fraudulent one. Because it sits on Stripe’s domain rather than ours, Stripe is the party responsible for it and Stripe’s own privacy policy governs it. It is written as soon as Stripe’s payment script loads, and that script loads only where a payment is actually being taken: the screen where a business pays us for a plan, and the step of a booking where a customer enters a card to pay a deposit. It is not written when you are browsing a business, checking a price, or making a booking with nothing to pay. | Two years from the last time Stripe refreshed it, unless you clear your browser storage. |
cx-analytics-business | A random, sealed identifier for this browser on ONE business’s pages, readable only by our server (it is HttpOnly and limited to that business’s /b/<address> path, or, on a business’s own verified web address, to that address alone). A different business gets a different, unrelated identifier. It holds no name, email or anything you typed. Not in use yet (provisional wording, pending legal review). Counting how many distinct browsers that allowed analytics went on to complete a booking with that business, so the business can see which pages and campaigns work. Written only if you allowed analytics; withdrawing deletes it and the records behind it. | 30 days from when it is first set. It is not extended by visiting again. |
cx-analytics-marketing | A random, sealed identifier for this browser on CalX3’s own marketing pages, readable only by our server (HttpOnly). It is never linked to any business’s identifier and holds no name, email or anything you typed. Not in use yet (provisional wording, pending legal review). Counting how many distinct browsers that allowed analytics visited CalX3’s own pages. Written only if you allowed analytics; withdrawing deletes it and the records behind it. | 30 days from when it is first set. It is not extended by visiting again. |
Analytics and advertising
CalX3 runs one analytics tool, and only if you allow it. It is PostHog, and it counts how many people reach each step of a booking or a signup so we can find and fix the parts that lose people. It stores one item in your browser and sends us those counts. It does not load at all until you have given permission where the law requires us to ask, and it stops as soon as you refuse or withdraw. You can do either at any time on your privacy choices page.
What it deliberately does not do, because we switched these off in code rather than leaving them at their defaults: it does not record or replay your screen, it does not capture what you type or the text of what you click, it does not run surveys, and it does not build a profile of you as a person unless you are signed in. It also does not identify you by the characteristics of your device — no fingerprinting, whether or not you have given permission.
There is no advertising or marketing pixel anywhere in the product, no session-replay or heatmap tool, and nothing on your device is used for advertising. We do not sell or share personal information for cross-context behavioral advertising.
Apart from analytics, the only third-party scripts in the whole product are Stripe's. Between them they load on three screens and nowhere else.
The first is Stripe's payment script. It loads on the screen where a business enters a card to pay us for a plan, and on the step of a booking where you enter a card to pay a deposit to the business you are booking with. It is what draws the card field, and what checks the payment is genuine. The second loads on the single screen where a business sets itself up to be paid by its own customers — Stripe asks for identity and bank details there, because the law requires it to before it can move anyone's money, and that form is Stripe's rather than ours so those documents never pass through us at all.
Neither loads anywhere else. In particular, neither loads merely because you are on a public booking page — the pages anyone can visit without an account. Browsing a business, checking its prices, and making a booking that takes no payment all happen without any Stripe script loading at all; it arrives only at the moment a deposit is actually being taken, and it is gone again from every other page. Nothing in the dashboard loads one either until somebody is actually paying or actually setting payments up. Stripe recommends loading its scripts on every page of a site, because that gives it more to work with; we have read that recommendation and declined it three times, because where nobody is paying and nobody is signing up to be paid there is nothing they are necessary for.
If anything else is ever added, anything that is not strictly necessary will ask for your permission first where the law requires it, and this page will be updated before it ships. The permission check is not a promise about the future: it is built, it is running, and it is what stops the analytics tool above from loading for anyone who has not allowed it. You can see and change what it holds on your privacy choices page.
We keep a record of the answer you give. When you allow, refuse or withdraw, we store what you chose, when you chose it, which version of this policy you were shown, and which country our network reported you were in — so that we can show that your choice was asked for and honored. That record is tied to a random number generated on your device: it is not your name, not your account, not your IP address and not anything about your browser or hardware, and it is never used to recognize you. We deliberately do not store your IP address or your browser's user-agent string alongside it.
We do not sell or share your personal information for cross-context behavioral advertising. If your browser sends a Global Privacy Control signal, we read it and treat it as an opt-out from analytics and advertising, in every country, without you having to do anything else.
Google user data
CalX3 accesses Google user data in two optional features. We request only what each feature needs.
- Sign in with Google — we receive your name, email address, profile picture and a stable Google account identifier, and use them only to create and sign you in to your CalX3 account.
- Google Calendar sync — a business owner or staff member can connect their Google Calendar and choose how much CalX3 may see. With Busy only, CalX3 reads the times you are busy on your primary calendar, never what the events are. With Full sync, CalX3 can also read the events on your calendars, so the dashboard can show what is blocking a time. In both, CalX3 creates one calendar of its own, “CalX3 bookings”, and adds, changes and removes your CalX3 bookings on that calendar only.
How we use it. Calendar data is used only to work out your availability, so your booking page does not offer times you are busy, to show you your own schedule in the CalX3 dashboard, and to keep your CalX3 bookings in your Google Calendar. It is not used for advertising, not sold, not used to build profiles, and not used to train AI or machine-learning models.
How we store it. We store your Google account email, the permissions you granted and an access credential on AWS servers in the United States, plus a link between each CalX3 booking and the event we created for it. Busy times and event details are read from Google when needed and are not kept.
How we protect it. Google user data travels only over encrypted connections (HTTPS/TLS). Our database is encrypted at rest, and the Google access credential is additionally encrypted with a separate key before it is stored. Access is limited to the CalX3 service itself and to the few authorized CalX3 staff who need it for support or security.
Sharing. We do not share Google user data with anyone, except with the service providers that host CalX3 (AWS) to run the features above, when required by law, or as part of a merger or sale of the business with notice to you.
Retention and deletion. Sign-in information is kept for as long as your CalX3 account exists and is deleted when the account is deleted. Calendar data is kept only while the calendar is connected. Disconnect at any time from Calendar sync in the dashboard: we revoke our access at Google and delete the stored credential straight away. You can also remove CalX3 from your Google Account's third-party access page. To delete your CalX3 account and its data, see our Data Deletion instructions.
CalX3's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Changes. If we change how CalX3 accesses, uses, stores or shares Google user data, we will update this policy and its date, and tell affected users by email or in the dashboard before the change takes effect, asking for your permission again where required.
Marketing text messages
If you tick the separate marketing checkbox on a business's booking page, we record your mobile number, the time, your IP address and browser, and the exact wording you were shown, as the record of that choice. We use the number only to send that business's offers, review requests and announcements, from CalX3's marketing toll-free number. Up to 4 msgs/month. No mobile information is shared with third parties or affiliates for their own marketing. Reply STOP to a marketing text to stop them; we keep the record of your STOP so we do not text you again.
Your choices
You can review and update your account information at any time from Account settings inside the CalX3 dashboard. To review or change what we may store on your device — including Do Not Sell or Share My Personal Information — see your privacy choices. To request that we delete your data, see our Data Deletion instructions.
Contact us
Questions about this policy or your data? Email us at hello@calx3.com.
CalX3 is a service of GenX3ai LLC (dba GenX3 AI), Round Rock, TX.