Privacy

What we keep

• The names people type on a plan, and the days they pick.
• Emails that organizers add to a plan or to their saved people. We keep them encrypted.
• If you sign in: an id from Apple, Google or Microsoft, your email and your name, so you can sign in again.
• Whether each invite email was sent and delivered.
• One-way hashes of addresses that asked not to get our emails or that bounced. A hash can't be turned back into the address.
• If you turn on notifications: your browser's push address, encrypted.
• Which days look busy on your calendar, for 15 minutes, when you tap Check my calendar.
• One cookie, so we know it's the same phone next time. It holds a random number, not who you are.
• If you ask for a code to open a private plan: the email you typed, encrypted, until an hour after the code stops working.

What we never do

• We never collect your location.
• We never use analytics or ad tools, show ads or sell data.
• We never read your address book. On Android, the contact picker hands us only the people you pick.
• We never read your chats.

Your calendar

Checking a calendar is optional. It only puts stripes on days that look busy. You still pick your days.

• We use only the times your calendar marks as busy, for this plan's days.
• We keep which days look busy for 15 minutes, never what, where or with whom.
• Only you see it. Not the organizer, not the group.
• We never change your calendar. Microsoft's screen says we can read it, but we ask only for times. Apple sends whole events, and we keep only busy days. We use an Apple special password once and never store it.
• Signed in, we keep Google or Outlook access encrypted until you turn it off, which deletes our copy at once and cancels it with Google. We use it only when you tap Check my calendar.
• Google data follows Google's API Services User Data Policy, including Limited Use: never used for ads, never sold, never used to train AI.

Emails we send

We send four kinds of email, and nothing else:

• A code you ask for, to open a private plan.
• An invite, after an organizer checks it and taps Looks good.
• A reminder, when an organizer taps Remind people for me.
• An It's on! email when an organizer sets the date, to people who got the invite.

No newsletters, no ads and no tracking. Every invite, reminder and It's on! email has a link to stop emails.

Notifications

Notifications stay off until you turn them on for a plan. We send only these: the date is set, a reminder from the organizer, and, for organizers, everyone has answered. Turn them off on the plan's page or in your browser.

If you got an invite email

An organizer added your email to a plan, and we emailed you their invite.

• We have your address because that organizer typed it or picked it from their contacts.
• We use it only for that organizer's plans: the invite, reminders and It's on! emails. Never for marketing.
• If the organizer is signed in, your name and email are saved in their list for next time. Only they can see it.
• On a plan, we keep your address until 365 days after the plan's last day. A saved list keeps it until the organizer deletes it or their account, or 2 years pass without using it.
• To stop emails, tap the link at the bottom of any email. You can stop emails from that organizer, or from us.
• To have your address removed from saved lists, write to [email protected].
• If an email looks like spam, tap Report abuse at the bottom of it. You can also write to [email protected], or complain to the data protection authority where you live.

How long we keep things

• Plans, names, days, name emails and invite statuses: 365 days after the last day or the set date.
• Deleted plans: 30 days.
• Unsent plans: 7 days after the last change. Sent ones: 30 days.
• Saved people and groups: until you delete them or your account, or 2 years unused.
• Email send records: 31 days, with the address removed as soon as the email is sent or we give up.
• Choices not to get emails, complaints, abuse reports and email holds on organizers: kept as one-way hashes for as long as they're needed, even after an account is deleted.
• Addresses that bounced: 365 days, as a hash.
• Busy days: 15 minutes.
• Code requests: 1 hour after they stop working.
• Kept Google or Outlook access: until turned off, 365 days unused or 30 days broken.
• Notification sign-ups: until turned off, refused by the push service, or the phone's record is deleted.
• Phones we haven't seen: 400 days.
• Accounts: until deleted.
• Access logs and backups: 14 days.

Contact

Write to [email protected] about privacy, or [email protected] about anything else.