Privacy Policy

• Account information — your email address and display name, provided when you sign up or via OAuth (Google, Microsoft).
• OAuth tokens — access tokens and refresh tokens issued by Google and Microsoft when you connect a calendar account. These are stored encrypted at rest using AES-256-GCM. We never store your Google or Microsoft account password.
• Calendar data — event titles, times, descriptions, locations, attendees, and organiser details fetched from your connected calendar providers. This data is stored in our database to power sync and sharing features.
• Contact and directory results — when you search for an attendee, we query contacts, relevant people, organisation directory entries, and rooms available through your connected Google or Microsoft account. Search results are returned on demand and are not copied into JoinCal as an address book. An email address is stored only when you add it to an event or proposal.
• Location and travel data — when you use location search or automatic travel protection, Google Maps processes the location text and coordinates needed to return place suggestions and estimate a route. JoinCal stores the selected event location, Place ID, coordinates, travel mode, estimated duration, and your configured safety margin to protect the relevant time on your calendar.
• Usage data — IP addresses and user-agent strings logged in our audit trail when share links are accessed. We do not use third-party analytics.
• CalDAV credentials — for Apple iCloud, Yahoo, GMX, WEB.DE, Fastmail, Zoho, Nextcloud, mailbox.org, Posteo, and generic CalDAV servers, we store your app-specific password encrypted at rest. You should never provide your primary account password.

• To sync your calendars and display events in your dashboard.
• To suggest attendees and bookable rooms that your connected account is permitted to see.
• To generate combined calendars and serve them to people you share with, at the permission level you configure.
• To send transactional emails — share invitations, OTP verification codes, and re-authentication notices. We do not send marketing emails.
• To maintain an audit trail of sharing activity so you can review who accessed your calendars.

We do not sell, rent, or trade your personal data or calendar contents to any third party.

JoinCal integrates with the following services to deliver its core functionality:

• Google Calendar and People APIs — to read and write calendar events and, when you search for attendees, read matching contacts and people from your Google account.
• Google Maps Platform — Places API (New) provides location autocomplete and the Routes API estimates distance and travel duration. Google processes these requests under the Google Privacy Policy.
• Microsoft Graph API — to read and write Outlook / Microsoft 365 events and, when permitted, search contacts, relevant people, organisation directory entries, rooms, and shared availability.
• CalDAV providers — to synchronize events from Apple iCloud, Yahoo, GMX, WEB.DE, Fastmail, Zoho, Nextcloud, mailbox.org, Posteo, or another HTTPS CalDAV server you explicitly connect.
• Supabase — authentication and database hosting. Data is stored in EU-West (Ireland) by default.
• Resend — transactional email delivery.

Each of these providers has their own privacy policies governing how they handle data on their infrastructure.

• Your calendar data is retained while your account is active.
• Disconnecting a calendar account immediately deletes all synced events from JoinCal for that account.
• Deleting your JoinCal account removes all your data within 30 days, except where retention is required by law.
• Audit logs are retained for 90 days.

We take security seriously:

• OAuth tokens are encrypted at rest with AES-256-GCM. The encryption key is stored separately from the database.
• All traffic is served over HTTPS/TLS.
• Share links can be revoked instantly. Password-protected and email-gated links add additional access controls.
• We request read-only contact and directory scopes for attendee suggestions. Calendar write access is used for event creation and updates; room directory access may require Microsoft tenant administrator approval.

Depending on your jurisdiction, you may have the right to access, correct, or delete your personal data. To exercise these rights, email us at privacy@joincal.net. We aim to respond within 30 days.

JoinCal uses session cookies set by Supabase Auth to keep you signed in. We do not use advertising or tracking cookies.

We may update this policy from time to time. When we do, we will update the "Last updated" date above. Continued use of JoinCal after a change constitutes acceptance of the updated policy.

Questions about this policy? Email privacy@joincal.net.