Privacy policy

1. Data controller

The Calenoo service is operated by Ekylibr SA ("we", "Calenoo"). For any question about your personal data, write to us at privacy@calenoo.ch.

Postal address: Avenue du Mail 18, CP 389, 2002 Neuchâtel, Switzerland.

2. Data we collect

We only collect the data necessary to operate the service:

• Account data: email address, display name, preferred language. Your password is stored hashed and is never accessible in clear text.
• Poll data: title, description, location, proposed time slots, as well as the name, email address and responses of the organizer and participants.
• Technical data: IP address (stored hashed), browser type and error logs, for security and abuse-prevention purposes. Our analytics (Plausible) are aggregated and use no tracking cookie.

3. Calendar data (Google, Microsoft 365 / Outlook, Apple iCloud, Infomaniak)

If — and only if — you choose to link an external calendar, we process the specific data described below. This feature is optional and disabled by default.

• What data is collected? For Google: OAuth access and refresh tokens, stored encrypted. For Apple and Infomaniak: your email address and a dedicated app-specific password, stored encrypted. The events in your calendar are never stored on our servers: they are read on the fly and displayed only in your browser.
• What is it used for? Two uses, both visible to you: (a) reading (Google scope calendar.readonly), to display your busy times in the background while you create or answer a poll, and to compute the free slots of your booking page (your availability minus your busy times); (b) writing (Google scope calendar.events), when a guest books a slot on your booking page, to create the corresponding event in your Google Calendar and, if you enabled it, add a Google Meet link, and to delete that event if the booking is cancelled. Calenoo never modifies or deletes events it did not create.
• How long is it kept? Until you unlink the calendar or delete your account. Deletion is immediate upon your action.
• Is it shared? No, never. No calendar data is shared with other Calenoo users or with third parties, nor used for advertising purposes.
• What are your rights? You can unlink a calendar in one click from your dashboard. Deleting your account results in the complete deletion of the associated credentials and revocation of access at the provider.

4. Compliance with the Google API policy

Calenoo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google Calendar data only to provide and improve the user-facing features described above (reading your availability, and creating or deleting the booking events that Calenoo creates). We do not transfer or sell this data, and we allow no human to read it, except with your explicit consent, for security reasons, to comply with the law, or as part of internal operations on aggregated and anonymized data.

5. Legal basis for processing

We process your data on the following bases: performance of the contract (providing the scheduling service), our legitimate interest (service security and abuse prevention), and your consent (in particular for linking an external calendar, which you can withdraw at any time).

6. Retention period

Account data is kept as long as your account is active. Polls and their responses are automatically deleted after 90 days without activity (this period is extended with each new response); the organizer can delete them at any time. Calendar credentials are deleted as soon as you unlink the calendar or delete your account. When you delete your account, all your personal data is erased, unless a legal retention obligation applies.

If you request the deletion of your account, it takes effect after a 7-day grace period during which you can cancel it by signing in again. As soon as you request it, your linked calendars are unlinked and their access revoked, and your still-open polls are cancelled (their participants are notified). After the 7 days, your account and personal data are permanently deleted; your past polls and responses are anonymised and kept for the benefit of other participants. Erasure takes place within 30 days of your request at the latest (art. 32 nFADP).

7. Processors and sharing

We never sell your data. We rely on carefully selected processors, strictly to operate the service:

• Supabase (database hosting, EU region — Frankfurt).
• Vercel Inc. (frontend hosting).
• Resend (sending transactional emails: invitations, confirmations).
• Cloudflare Turnstile (anti-spam protection of forms).
• Plausible Analytics (aggregated analytics, no cookie).

8. International transfers

Our data is hosted in the European Union (Supabase for the database, Plausible for analytics). However, some processors are based in the United States: Resend (email delivery), Vercel (application hosting) and Cloudflare (Turnstile anti-spam protection). These transfers outside Switzerland and the EU are governed by standard contractual clauses (SCCs) or equivalent safeguards.

9. Security

Sensitive secrets — OAuth tokens and calendar app-specific passwords — are encrypted at rest. Communications are protected by TLS. Access to data is restricted and logged.

10. Your rights

Under the Swiss Federal Act on Data Protection (revFADP) and, where applicable, the GDPR, you have the right to access, rectify, delete, restrict and port your data, as well as a right to object. To exercise these rights, write to privacy@calenoo.ch. You may also lodge a complaint with the competent data protection authority.

11. Cookies

Calenoo uses no advertising or tracking cookies. We only use necessary technical cookies (for example to remember your language and your session).

12. Changes to this policy

We may update this policy. The last-updated date appears at the top of the page. In case of a significant change, we will inform you by appropriate means.