Privacy Policy

Last updated: September 17, 2026

This Privacy Policy describes how Calendar Scheduler ("the Service," "we," "us") collects, uses, and protects personal data. It applies to both hosts (people who create an account, connect their calendar and video-meeting apps, and share a booking page) and invitees (people who book a meeting with a host through the Service).

1. Who is responsible

The Service is currently operated by Marcelo Kaczorowsky, an individual developer based in Germany, as a personal project in active development. For any question about this Privacy Policy or your personal data, contact: hello@calendar-scheduler.online.

2. What we collect

For hosts:

• Name, email address, and profile image, from signing in with Google.
• A username and the booking-page configuration you create (event types, availability, time zone).
• OAuth refresh tokens for Google Calendar and, if connected, Zoom — encrypted at rest (AES-256-GCM) and never stored in plain text.

For invitees:

• Name, email address, and (optionally) time zone, entered when booking a meeting.
• Basic marketing attribution parameters (UTM source/medium/campaign), if present in the booking-page link you arrived from.

For visitors of any booking page:

• First-party analytics events we generate ourselves — page views and time-slot clicks, an anonymous visitor identifier, and a coarse country, used only to show hosts aggregate traffic and conversion statistics for their own booking pages. This isn't shared with any third party, and we don't build a personal profile from it.
• If you consent to analytics/statistics cookies (see Section 4, "Cookies"), Google Analytics collects standard web-analytics data (pages viewed, approximate location, device/browser type) on our behalf.

3. Why we process this data

We process this data to operate the Service: to authenticate hosts, display real availability, create calendar events for confirmed bookings, and — where a host has enabled it — automatically generate a Google Meet or Zoom meeting link for a booking. For EU/EEA users, the legal basis is performance of a contract (providing the Service you asked to use) and, for the OAuth connections specifically, your explicit consent, which you can withdraw at any time (see Section 7). For the first-party analytics and Google Analytics described in Section 2, and for the analytics/statistics cookies described in Section 4, the legal basis is your consent, given (or withheld) through the cookie banner shown on your first visit — separate from, and not required for, OAuth or booking consent.

4. Cookies

We use two categories of cookies. Necessary cookies (such as your login session) don't require consent — the Service can't function without them. Statistics cookies, used for Google Analytics, are only set if you consent to them in the cookie banner. We use Cookiebot (Cybot A/S, Denmark) as our consent-management provider to record and honor that choice. You can review the current list of cookies below, and change your choice at any time using the "Cookie settings" link in the site footer.

5. Who we share it with

We do not sell personal data, and we do not share it with third parties for advertising. Data is shared only with the specific services needed to run the Service, grouped below by purpose:

Booking and communication:

• Google (Google Calendar API) — to check a host's availability and create the calendar event for a confirmed booking, and, if selected, to generate a Google Meet link.
• Zoom — only if a host has connected Zoom and selected it for an event type — to create a real Zoom meeting for a booking and retrieve its join link.
• Brevo — to send booking-confirmation, host-notification, and account emails, using your name and email address and the booking details needed for the email.
• ImprovMX — forwards email sent to our own @calendar-scheduler.online addresses (such as replies to a booking email) to our personal inbox.

Security:

• Cloudflare (Turnstile) — verifies a booking request isn't automated, using your IP address and browser signals.
• Upstash — stores your IP address briefly to rate-limit booking requests and prevent abuse.

Analytics and consent, only with your cookie consent where noted:

• Google Analytics — visitor analytics, only after you consent to statistics cookies.
• Cookiebot (Cybot A/S) — records and enforces your cookie-consent choice; this one runs regardless of your choice, since it's what implements the choice itself.

Infrastructure:

• Vercel (application hosting) and Neon (database hosting) — as infrastructure providers processing data on our behalf to run the Service.

Several of these providers are based outside the EU/EEA (including Google, Zoom, Brevo, Vercel, Neon, Cloudflare, and Upstash); data sent to them relies on those providers' own standard data-protection safeguards for international transfers.

Calendar Scheduler's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. How we protect it

All network traffic to and from the Service uses TLS. OAuth refresh tokens for Google and Zoom are encrypted at rest using AES-256-GCM before being stored. Credentials and encryption keys are kept as environment variables, never committed to source code, and are separated between our development and production environments.

7. Your rights, and how to exercise them

If applicable data protection law (including the GDPR) gives you rights of access, rectification, erasure, restriction, objection, or data portability, or the right to withdraw consent, you can exercise most of these directly, without waiting on us:

• Disconnect Google Calendar or Zoom at any time from your dashboard's Calendar page — this revokes our access with the provider directly, not just deletes our copy of the token.
• Delete your account at any time from your dashboard's Account page. This permanently deletes your event types, bookings, and calendar/Zoom connections, and cannot be undone.
• Withdraw or change cookie consent at any time using the "Cookie settings" link in the site footer, which reopens the consent banner.
• For anything else — including requests from invitees, who don't have an account to manage this themselves — contact us at the email above.

You also have the right to lodge a complaint with your local data protection supervisory authority.

8. Data retention

Host data is kept for as long as the account exists, and is deleted when the account is deleted. Booking records are kept for as long as the associated event type or host account exists. Deleting your account does not remove any calendar event or meeting already created on your own Google or Zoom account — those are your data, on those providers' own services, independent of us.

9. Children

The Service is not directed at children, and we do not knowingly collect personal data from children.

10. Changes to this policy

We may update this Privacy Policy as the Service changes. We'll update the date at the top of this page when we do.