Privacy Policy

The short version

When? (when.direct) only reads whether you are free or busy. We never see your event titles, descriptions, attendees, or locations. We do not sell your data to anyone. That is the whole story.

What we collect

• Calendar free/busy data — time slots marked as free or busy, provided through Cronofy. We never access event titles, descriptions, attendees, or locations.
• Basic profile info — your name and email address from your calendar provider, used to identify you within your group.
• Group membership — which scheduling groups you have created or joined.
• Usage data — anonymous analytics (page views, feature usage) collected by Vercel Analytics to help us improve the product.

How we use your data

• To calculate and display overlapping availability within your groups.
• To send you email notifications when someone joins your group.
• To maintain and improve the service.

We do not use your data for advertising, profiling, or any purpose beyond operating When?.

Third-party services

We use the following services to operate When?. Each acts as a data processor on our behalf:

• Cronofy — calendar integration. Reads free/busy status from Google Calendar, Microsoft Outlook, and Apple Calendar. Subject to Cronofy's Privacy Policy.
• Supabase — database and authentication. Stores your profile and group data. Subject to Supabase's Privacy Policy.
• Resend — email delivery. Sends notification emails on our behalf. Subject to Resend's Privacy Policy.
• Vercel — hosting and analytics. Subject to Vercel's Privacy Policy.

Data retention

We keep your data for as long as your scheduling groups are active. If you disconnect your calendar or your group expires, we delete your free/busy data and calendar tokens. Anonymous analytics data may be retained indefinitely.

Your rights

You can disconnect your calendar at any time through your calendar provider's app settings (e.g., revoking access in Google or Microsoft). If you want us to delete all data associated with your email, contact us and we will process your request within 30 days.

Security

All data is transmitted over HTTPS. Calendar tokens are stored securely and are never exposed to other users. We follow industry-standard practices to protect your information.

Changes to this policy

We may update this policy from time to time. If we make significant changes, we will notify users through the app. The latest version will always be available at this URL.

Contact

Questions or requests? Reach us at support@when.direct.