Privacy Policy

This website collects the following information to function correctly:

• Name
• Email address
• Date and time information for created meetings
• Meeting respondents' names

Cookies

Your session is stored as a secure, httpOnly cookie managed by our authentication provider (Supabase). It is cleared when you log out. This cookie is strictly necessary for the service to function.

In the future, we may use cookies and similar technologies for additional purposes such as remembering your preferences, understanding how the service is used, and improving it. These technologies apply only to non-Google data (for example, your CalenGrab account and usage information). We do not use cookies or similar technologies with Google user data, and we never use Google user data for advertising. Our use of Google user data always remains subject to the Google API Services User Data Policy, including the Limited Use requirements described below.

If you sign in via an external identity provider (e.g. Google, Microsoft), the following information is collected from the provider:

• Name
• Email address

Separately, if you choose to link a Google or Microsoft calendar (from Settings), the following additional information is collected:

• Events on your linked calendar, to show conflicts when responding to a meeting

When a meeting is scheduled for which you are a respondent, an event will be created on each of your linked calendars. If the meeting is unscheduled or deleted, those events will also be deleted.

How we share, transfer, and disclose your data

We do not sell your data or Google user data, and we do not use it for advertising. We only share, transfer, or disclose it in the following limited circumstances:

• Service providers (sub-processors). We use the following third parties strictly to operate CalenGrab on our behalf: Supabase (database storage and authentication) and Vercel (application hosting). They may process your data only as needed to provide these services to us and are bound by their own privacy and security obligations.
• To provide the service you requested. When you link a calendar and are a respondent to a scheduled meeting, we transfer the relevant event details to Google (or Microsoft) in order to create, update, or delete events on your calendar at your direction.
• With your consent. We may share data in other ways only when you explicitly direct or authorize us to do so.
• Legal requirements. We may disclose data if required to do so by law, or in response to a valid legal request from a public authority.

CalenGrab's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to third parties except as necessary to provide or improve the service, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to affected users.

How we protect your data

We take reasonable and appropriate measures to protect your data, including sensitive data such as Google Calendar events and linked-calendar access credentials (OAuth tokens):

• Encryption in transit.All data exchanged between your browser, our servers, and Google's and Microsoft's APIs is encrypted using HTTPS/TLS.
• Encryption at rest. Data stored in our database, including calendar data and access credentials, is encrypted at rest by our storage provider (Supabase).
• Access controls. Access to stored data is restricted through authentication, row-level security, and least-privilege access, so that your data is accessible only to you and to the systems required to operate the service.
• Secure credential handling. Calendar access tokens are used only to perform the actions you authorize and are deleted when you unlink a calendar or delete your account.
• Data minimization and retention. We collect only the data needed to provide the service and retain it only for as long as your account is active or as needed to provide the service.

Data retention and deletion

When your account is deleted, all of the data related to your account will also be deleted, including your profile information, meetings which you created, group memberships, and any linked calendar credentials. However, events already created on your linked calendars will not be retroactively deleted.