Privacy
What we read
When you explicitly import, the server requests busy intervals from the Google calendars you choose. We do not request event titles, locations, descriptions, or attendees. Busy intervals are processed in memory and are not stored.
What we store
Supabase stores your account, scheduling poll details, public display name, and the half-hour availability slots you confirm. Google access and refresh tokens are encrypted in an HTTP-only cookie; calendar import occurs on the server.
What others see
Poll details and consenting participants' names are public. Results show only meeting windows where at least 80% of confirmed, consenting participants can attend, rounded up, plus attendance counts and the names of those who cannot attend. Full availability grids and below-threshold counts are not returned publicly. Individual user IDs and stored availability rows remain owner-only. Named exceptions reveal confirmed unavailability at suggested times; small groups and changes over time can also reveal confirmed availability. Calendar event details are never disclosed.
Your choices
Importing creates a draft only. Change it before confirming, mark time manually, or submit no available slots. Confirming agrees to public meeting suggestions with named exceptions. Responses saved before this sharing policy require reconfirmation before being counted or named in results; their selections remain saved. Remove your response from the poll to delete its name and availability. Disconnect Calendar to revoke Google access; this does not delete submitted responses. Signing out clears the local Google token cookie without revoking access.
Links and retention
Treat poll links as shareable, not secret access controls. Poll metadata is publicly readable in the database. Responses remain until removed or their account/poll is deleted. This MVP does not implement automatic retention or account deletion; a deployment operator must provide an account deletion contact before public launch.
Service providers
Google provides authentication and calendar access, Supabase stores accounts and confirmed availability, and Render hosts the application. Their infrastructure may process request metadata. We add no analytics or advertising trackers.