Calm is a subscription meditation and sleep app from Calm.com, Inc., a privately held San Francisco company backed by Lightspeed, TPG, and Insight. Its privacy policy (updated December 12, 2024) covers mood check-ins, sleep habits, goals, session usage, device data, third-party-sourced data, and inferences like gender and age. Calm states it does not sell personal information for money but lets ad partners collect device identifiers and match hashed emails or phone numbers for cross-platform ad targeting - activity the policy says may be considered "sales" or "sharing" under state privacy laws, with an opt-out and Global Privacy Control support. Deletion rights extend to all users; the separate Calm Health product operates under HIPAA-oriented terms. No breach or regulator action was found; 2024 complaints against SDK vendor Twilio allege in-app mood answers reached third parties.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
10 ON FILE
[2023-04-25] · COLLECTION
Mozilla's *Privacy Not Included review of Calm (updated April 25, 2023) dinged the product for combining user data with data obtained from third parties, citing policy language permitting Calm to obtain information from publicly available sources, marketing and advertising partners, consumer research platforms, and business contact databases.
Calm's Privacy Policy (last updated December 12, 2024) lists among the information users may provide their password, language settings, goals, previous meditation experience, sleep habits, and the moods and reflections provided during check-ins; the policy also covers session usage, log and device data, and, with permission, sleep data received from Apple HealthKit or Google Health Connect.
TechCrunch reported on December 8, 2020 that Calm raised $75 million at a $2 billion valuation in a round led by prior investor Lightspeed Venture Partners with participation from Insight, TPG, and Salesforce CEO Marc Benioff; Calm.com, Inc. remains a privately held company without public-company reporting obligations.
Calm documents a separate product line, Calm Health, governed by its own privacy policy (last updated August 16, 2024); when Calm Health is made available through a health insurer, healthcare provider, or other HIPAA covered entity, the policy states the Services may be subject to that covered entity's HIPAA Notice of Privacy Practices, and the product is described as designed to align with HIPAA data-minimization standards.
The Calm Health Privacy Policy (last updated August 16, 2024) states that Calm Health does not sell personal information to third parties for payment, but discloses limited personal information to third parties for cross-context behavioral and targeted advertising, activity it acknowledges may fall under the CCPA's broader concepts of 'selling' and/or 'sharing.'
Calm's California disclosures (Privacy Policy, December 12, 2024) acknowledge that allowing advertising partners to use tracking technologies so Calm can advertise on other platforms may be considered 'sales,' 'sharing,' or 'targeted advertising' under certain privacy laws, and the policy offers an opt-out at calm.com/optout, including recognition of the Global Privacy Control universal choice signal.
Mozilla's *Privacy Not Included review (updated April 25, 2023) found Calm met Mozilla's Minimum Security Standards - encryption, strong passwords, security updates, and vulnerability management - and recorded no known privacy or security incidents in the prior three years, while noting one vulnerability disclosed at OpenBugBounty remained unpatched; Mozilla also credited Calm's June 16, 2022 policy change granting all users, regardless of location, the same rights to access and delete their data.
Consumer Watchdog reported in August 2024 that federal class actions filed in the Northern District of California against Twilio allege its Segment SDK, which is embedded in the Calm app, collected consumers' in-app activity - including answers about how they are feeling - without consent; the complaints were filed against Twilio, not Calm, and the allegations have not been adjudicated.
The 'Advertising and Analytics Services Provided by Others' section of Calm's Privacy Policy (December 12, 2024) states that third parties use cookies, web beacons, device identifiers, and other technologies across the Services, and that some advertising partners can convert a user's email address or phone number into an identifier to show targeted ads on other platforms.
A ClassAction.org attorney investigation (page last updated February 4, 2026; investigation complete) organized mass arbitration over suspicions that Calm.com and its app used tracking tools such as the Meta pixel to transmit subscribers' video-watching details and Facebook IDs to Facebook, which the attorneys believed could violate the federal Video Privacy Protection Act; these are attorney allegations, not court findings.