Privacy Policy | CalendarBot

1. Introduction

CalendarBot ("we", "our", or "us") is a calendar automation service that integrates with Google Calendar and Slack to help you manage your time more effectively. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our mobile application and related services.

2. Information We Collect

Account Information

Email address and password (securely hashed) when you create an account

Google Calendar Data

When you connect a Google account, we access the following via the Google Calendar API:

Calendar event details: titles, times, locations, attendees, and descriptions
Calendar metadata: calendar names and IDs
We request read/write access to create and manage bot-generated events (e.g., travel time blocks, flight reminders)

Slack Data

When you connect your Slack account, we access the following via the Slack API:

users.profile:write — to set and clear your Slack status text and emoji based on calendar events
dnd:write — to enable or disable Do Not Disturb when you're in meetings or focused work
users:read — to read your basic profile information

Usage Data

Feature settings and preferences you configure within the app
Slack status rules and automation settings
Managed event series configurations

3. How We Use Your Data

Synchronize calendar events to create and manage automated events (travel time, flight reminders, etc.)
Automatically update your Slack status and Do Not Disturb settings based on your calendar
Detect and handle special event types (flights, layovers, meetings) to provide relevant automations
Notify you of scheduling conflicts within the app

We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes.

4. Third-Party Services

CalendarBot relies on the following third-party services to function:

Google Calendar API — to read and write calendar events. Subject to Google API Services User Data Policy.
Slack API — to update your status and DND settings. Subject to Slack's Terms of Service.
Supabase — for authentication and database hosting. Your data is stored in a managed PostgreSQL database with row-level security policies.
Cloudflare — hosts this website only. No user data is processed by Cloudflare beyond standard web serving.

5. Data Storage and Security

All OAuth tokens (Google and Slack) are encrypted at rest using AES encryption before storage
Database access is protected by row-level security policies ensuring users can only access their own data
Authentication is handled via Supabase Auth with secure password hashing
All data transmission occurs over HTTPS/TLS

6. Data Retention

Your account data is retained for as long as your account remains active
Calendar event data is synchronized on an ongoing basis while your account is active
When you delete your account, all associated data (events, connections, settings, tokens) is permanently deleted
You may disconnect a Google Calendar or Slack account at any time, which revokes access and removes the associated tokens

7. Your Rights

You have the right to:

Access your personal data stored by CalendarBot
Correct inaccurate personal information
Delete your account and all associated data
Revoke Google Calendar or Slack access at any time from within the app
Export your data upon request

To exercise any of these rights, contact us at calendarbot@siddshah.com.

8. Google API Limited Use Disclosure

CalendarBot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page and notify you through the app. We encourage you to review this policy periodically.

10. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at calendarbot@siddshah.com.