Privacy Policy

When you use Scadool, we collect only what we need to find shared free time and manage bookings:

• Your account. Your name and email address, provided by Google when you sign in.
• Your availability. Through Google Calendar's read-only permission we receive your events and extract the busy/free time blocks needed to compute overlap. We do not store event titles, descriptions, attendees, or locations.
• Events we create. When a booking is confirmed, we add an event to your calendar: its time, a short title, and the other person's name and email.
• Imported calendars. If you add an iCal link (Outlook, Apple Calendar), we read its busy/free times the same way.
• Bookings. When someone books time with you, we collect the name, email, and any message they enter on your booking page.
• Essential technical data. Your authentication session and standard server logs that keep Scadool secure and reliable.

We use your data only to operate Scadool:

• To compute and display shared free time across everyone's calendars, the core of the product.
• To create and update calendar events when a booking is made.
• To send transactional emails (booking confirmations and reminders) through our email provider.
• To send the push notifications you opt into, through your browser.

We never use your data for advertising, profiling, or training AI models.

Scadool uses Google sign-in and the Google Calendar API. We request two permissions:

• calendar.readonly: to read your busy/free times.
• calendar.events: to create events when you confirm a booking.

Scadool's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In practice:

• We use Google Calendar data only to compute free/busy overlap and to create events you've approved.
• We do not sell this data, ever.
• We do not use it for advertising or to build advertising profiles.
• We do not transfer it to others except as needed to provide Scadool, or to comply with applicable law.
• We do not let humans read it, except with your explicit permission, for security, or to comply with the law.

You can review or revoke Scadool's access anytime from your Google Account permissions.

• Your data lives in a Supabase (PostgreSQL) database hosted in the United States.
• It is encrypted in transit (TLS) and encrypted at rest.
• Access is limited to your authenticated session and the minimal Scadool systems required to run the service.

We do not sell your data, and we never share it for anyone's marketing. To run Scadool we rely on a few trusted providers:

• Google: sign-in and calendar access.
• Supabase: database and authentication (United States).
• Resend: delivery of transactional email.
• Your browser's push service: delivery of push notifications you opt into.

Each provider is bound by contract to protect your data and use it only to provide its service to us.

We don't use advertising cookies, and we never sell or share your data. We do use two privacy-focused analytics tools (Vercel Analytics and Google Analytics) to count page views and understand which features get used. Aside from those, the only thing we store in your browser is the Supabase authentication session that keeps you signed in.

You're always in control of your data:

• Delete your account anytime from Setup → Account. This permanently and immediately removes your profile, calendars, classes, squads, plans and bookings. Nothing is retained.
• Revoke Scadool's Google access anytime from your Google Account permissions.
• Or email privacy@scadool.com and we'll erase everything within 30 days.

If we update this policy, we'll change the effective date above. For material changes, we'll also notify you by email or in the app before they take effect.

Questions about your privacy or this policy? Email us at privacy@scadool.com. A real person will reply.