Privacy Policy

What CalendarPal is

CalendarPal follows sports fixtures (football, F1, and more) and keeps them up to date in a calendar you already use. This policy explains what data we collect, why, and how you can remove it.

What we collect

• Your email address and Google account identifier, from Google sign-in.
• The teams, leagues, or drivers you choose to follow, and your calendar preferences (timezone, how many weeks ahead to sync, which calendar to write to).
• If you connect Google Calendar sync: an OAuth access/refresh token, encrypted at rest (AES-256-GCM) and used only to create, update, and delete fixture events on your calendar via the Google Calendar API.
• If you use the subscribable calendar feed instead: a private feed URL token, which acts as a bearer credential — anyone who has that link can view the fixture list it generates until you reset it from your dashboard.
• Basic, non-identifying product analytics: an anonymous per-browser id, event names (e.g. “followed a team”), and, if you're signed in, your user id. We don't put emails, names, or other personal identifiers into analytics event properties.

What we deliberately don't do

• We don't read the events already on your calendar. The one exception is a brief, internal technical check: if your connection to Google needs to be re-verified after an authorization hiccup, we make a single lightweight call that touches at most one existing event, solely to confirm access is restored — nothing from that call is stored, displayed, or used for any other purpose. Outside of that, the Google Calendar permission we request is used only to create, update, and delete the fixture events CalendarPal itself creates.
• We don't sell your data, and we don't share it with advertisers.

Who else sees this data (subprocessors)

• Google — hosts your calendar and processes the events we create there via the Google Calendar API (calendar.events scope).
• Supabase — hosts our database and handles Google sign-in on our behalf.
• Vercel — hosts the CalendarPal application.
• Inngest — runs the background jobs that keep your calendar in sync; it processes the same fixture/event data described above, on our behalf.

How we protect your data

We treat the Google user data we handle — your Google account identity and, if you enable sync, your Google Calendar authorization — as sensitive, and protect it with the following mechanisms:

• Encryption in transit. CalendarPal is served exclusively over HTTPS (TLS). Every connection between the app, our database, and the Google APIs is TLS-encrypted end to end; we never transmit your data over an unencrypted channel.
• Encryption at rest. Google OAuth access and refresh tokens are encrypted by the application with AES-256-GCM — a unique initialisation vector and authentication tag per record — before they are written to the database. The encryption key lives only in the server environment and is never stored in the database, so a copy of the database alone cannot decrypt any token. The underlying Postgres database is additionally encrypted at rest by our hosting provider (Supabase).
• Access control. Row-level security is enabled on every table, so a signed-in user can only ever read or write their own rows. The table holding OAuth tokens has row-level security enabled with no access policy at all: it is unreachable from the browser or from any user session, and can be read only by our server-side sync jobs running under a separate service credential. Tokens are never sent to the client.
• Least privilege. We request only the calendar.events scope, not full or read-only calendar access, because we have no use case for reading your existing calendar. See “What we deliberately don't do” above.
• Operational access. Production secrets are held in the hosting provider's encrypted environment configuration, never in source control, and administrative access to production systems is limited to CalendarPal's operator on accounts protected by two-factor authentication.
• Minimisation. Analytics events carry no emails, names, or other personal identifiers, and we never copy the contents of your calendar into our systems.
• Incident handling. If we become aware of a breach affecting your personal data, we will notify affected users by email at the address on their account.

How long we keep your data

• Your account record, follows, and calendar preferences are kept for as long as your account exists.
• OAuth tokens are kept only while Google Calendar sync is connected. If you revoke CalendarPal's access from your Google account, the stored token immediately stops working and can no longer be used to reach your calendar.
• The bookkeeping rows that map a fixture to an event on your calendar are deleted as soon as you unfollow that team or competition, or disconnect sync.
• On an account-deletion request (see below) we delete your account record, tokens, follows, and preferences from our database.

Google user data — Limited Use disclosure

CalendarPal's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Deleting your data

Remove CalendarPal's access at any time from myaccount.google.com/permissions, or email us (below) to request full deletion of your account data. Revoking access stops future syncing immediately; previously created calendar events are yours to keep or delete as you like.

Children

CalendarPal is not directed at, and we do not knowingly collect data from, children under 13.

Changes to this policy

If this policy changes materially, we'll update the date at the top of this page.

Contact

Questions or deletion requests: bossuyt.arthur@gmail.com