Privacy Policy

1. Information we collect

We collect information you provide directly, such as your name, email address, password login details, OAuth provider identity details, support messages, optional app ratings and written feedback, billing selections, cancellation reasons and optional details, schedule content, branding preferences, and optional uploaded assets such as logos or images.

We also collect technical and usage information needed to operate the service, such as session identifiers, basic device or browser data, IP-derived region information, pages or features used, and bounded logs for performance, security, abuse prevention, and troubleshooting. If you enable push reminders, we collect the browser push endpoint, encryption keys, and time zone needed to deliver reminders.

2. How we use information

We use information to provide the service, authenticate accounts, sync schedules across devices, render published schedules and embeds, process subscription state, send requested push reminders, respond to support requests, prevent abuse, and maintain the reliability and security of the app.

We use aggregated or de-identified information to understand how people use Schedule Builder and to improve product decisions, pricing presentation, onboarding, and feature quality. We do not include Google Calendar data in analytics or product-usage measurement.

3. Calendar connections

Calendar Import is optional. You may connect Google Calendar or Microsoft Outlook without creating a Schedule Builder account on the website; Android cloud connections require a signed-in Schedule Builder session because browser authorization occurs in a separate secure tab. When you explicitly connect Google Calendar, we access the calendar names, identifiers, colours, and primary-calendar status needed for you to choose a calendar. For the calendar and week you select, we access event titles, start and end dates and times, and all-day status. We also access available event descriptions, which are always included in calendar imports, sync, and calendar-file previews; there is no description toggle. Microsoft Outlook supplies bodyPreview, not the full event body. Descriptions are limited to 4,000 characters per event, and event-count and schedule-size limits still apply. Review descriptions before publishing or embedding, where people with the public link or page can see them.

On Android, you may alternatively choose Google Calendar already synced to your device. After you explicitly grant Android calendar permission, the app reads only visible, sync-enabled Google calendars and the week you select from the device Calendar Provider. It does not read account email addresses, write events, perform a native network request, or retain the provider data outside the editable snapshot you choose to save.

In Connect a calendar, Import once is selected by default for unconnected schedules. Existing connections open in Keep in sync, with Import once unavailable until explicit disconnect and successful cloud adoption. This one-time Calendar Import uses this information to create the selected week’s editable Schedule Builder preview. Google and Microsoft Calendar Import use separate provider authorization. Apple Calendar Import uses your Apple Account email and an app-specific password; we never ask for your regular Apple Account password. This one-time import does not create an ongoing sync. Local calendar-file and Android device-calendar imports likewise do not enable background sync.

Provider credentials are not returned to the browser. For one-time Calendar Import, we store a credential only as AES-GCM-encrypted data for up to 15 minutes. Signed-in imports are bound to the current signed-in browser session. Guest Google and Microsoft imports are bound to an opaque, HTTP-only browser cookie; we store only a hash of that cookie. We delete the credential after a populated preview, cancellation, a failed provider request, or expiry. A valid empty-week result remains available only until that short session expires so that you can choose another week. We do not separately persist raw provider event data; an imported snapshot becomes Schedule Builder schedule content only after you confirm it. If you explicitly publish, embed, or export that resulting schedule, you direct us to provide it for that feature.

Keep in sync in the same dialog exposes automatic calendar sync, a separate optional connection requiring explicit owner setup and enable, eligible Pro, trial, or administrator access, and cloud-save/readiness protection. Selecting that mode never enables sync automatically. It retains one selected Google, Microsoft, or Apple calendar per owned schedule and reconciles the requested current or selected week in the saved time zone. Provider reads may include a bounded time-range margin to handle source-local date boundaries; we retain only that week’s supported event layer, not calendar history. Timed events use the saved zone; all-day events retain their source-calendar dates. We process calendar-selection metadata and event titles, times, dates, all-day status, and source identifiers needed to reconcile that week. Available descriptions are requested and included for Google, Microsoft, and Apple, even if an older client sends a description-off preference. Existing description-off sync connections include available descriptions on their next successful pull; a failed or incomplete read retains the last-good snapshot. Apple CalDAV may return additional event fields transiently, but we save only supported event fields. We do not maintain a separate raw provider-event cache or mirror your entire calendar history.

For automatic sync, Google and Microsoft use separate calendar authorization with offline refresh access, not just account sign-in. We retain refresh/access credentials or Apple app-specific credentials server-side as AES-GCM-encrypted data protected by a dedicated calendar-sync encryption secret. We store the selected calendar, time zone, a compatibility description-inclusion field, last-success/next-attempt timestamps, bounded error status, and provider watch identifiers and validation metadata. Google and Microsoft provider notifications assist scheduled reads; Apple uses polling. Credentials are never returned to clients. Losing Pro pauses reads but does not delete those encrypted credentials. A calendar-resource access error retains credentials and the last-good snapshot; Google/Microsoft may refresh once and retry an unauthorized resource read. Access denied does not by itself establish that a grant was revoked. Confirmed revoked or expired refresh authorization, missing refresh credentials, or invalid Apple app-password authorization requires reconnection and clears the stored credential. Disconnect deletes persistent credentials, OAuth transactions, and local webhook bindings; deleting the owned schedule or account also removes connection data. Signing out alone does not disconnect.

Synced source events are read-only in Schedule Builder, including for collaborators, and updates never write to the third-party calendar. Local weekly events, private notes, and tasks are not reconciled; Google Tasks, Microsoft To Do, and Apple Reminders are not integrated. Each successful read saves a minimal last-good week-start/time-zone window with the source events, even for an empty week. Displays retain that snapshot’s original dates until a successful update rather than relabeling old appointments as a newer requested week. This minimal window can accompany public and collaborator schedule data; private connection records and credentials do not. Disconnect removes the window/source markers and retains any successful snapshot, including an empty week, as an editable local snapshot frozen on the last-good week until you edit or delete it. A connection that never produced a snapshot leaves ordinary week settings and local content unchanged on disconnect. Portable schedule copies and JSON exports/imports also remove connection/source/window metadata and preserve an editable frozen week; they do not restore background sync or include credentials. Owner copies/backups preserve private notes and available task backup data. Publishing or embedding a connected schedule directs us to display changing synced events and always-included available descriptions to people with access to the public link or page. Disconnecting does not unpublish that retained content. You can separately revoke provider access or an Apple app-specific password in the provider’s settings.

Schedule Builder’s use and transfer of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google Calendar data, use it for advertising, user profiling, creditworthiness, lending, or data brokerage, or use it for analytics. We do not allow people to read Google Calendar data unless you give affirmative agreement for specific data, or access is necessary for security, legal compliance, or permitted aggregated operational purposes.

4. Sharing your information

We share information with service providers only when needed to run ScheduleBuilder, including Cloudflare for hosting, database, storage, and abuse protection; Google Play for Android subscription payments and verification; Stripe for web payments; ZeptoMail for transactional email; and browser push services when you enable reminders. Support translation uses OpenAI as described below. We do not provide Google Calendar data to advertising, analytics, data-broker, or other unrelated service providers.

We may disclose information if required by law, to protect rights or safety, to investigate abuse, or as part of a merger, acquisition, financing, or sale of assets involving the service. Any use or transfer of Google Calendar data in those circumstances remains subject to the Google API Services User Data Policy and Limited Use requirements.

We do not sell your personal information for money. Published schedules are available to anyone with the link or embed, without a password, and we record when a published link was last accessed. Private backgrounds require owner or authorized current-collaborator access; public image access requires an active publication referencing that image. Configured branding-logo URLs can be public while the owner has eligible access. Previously downloaded or cached copies cannot be recalled.

5. OAuth, payment, push, support, and telemetry

If you sign in with Google or Microsoft, we receive the account details those providers make available for authentication and account creation, such as your name, email address, and provider identifier. We store the provider and provider subject with your account; provider access tokens used for sign-in are not stored as account data.

Google Play handles Android subscription payments and Stripe handles web payments. For Play purchases, we store purchase tokens, an opaque account-binding identifier, package, product and plan identifiers, subscription state, expiry, acknowledgment status, and purchase-replacement information to verify access, acknowledge purchases, reconcile renewals, and prevent ownership transfers. For web subscriptions, we receive Stripe customer, subscription, price, and Checkout identifiers, status, billing period, trial, and cancellation information. We do not store full payment-card details. Cloudflare country metadata at registration assigns a stored regional pricing tier for later web checkouts; Android purchase prices come from Google Play.

When you explicitly enable push reminders, we store the browser push endpoint, encryption keys, and time zone with your account. To deliver a reminder, we send an encrypted Web Push payload containing the event title, schedule name, occurrence time label, and a link to the builder to that browser’s push service.

In-app support stores ticket subjects and messages. Authorized support administrators can view the requester’s name, email address, subscription status, and schedule names to resolve a ticket, but the support view does not expose schedule contents. We use ZeptoMail to send support notification emails containing the ticket subject and relevant sender identity, not the full message body.

For automatic support translation, we send support subjects, message text (including staff replies), and language information such as the app-locale hint and translation target to OpenAI. This includes public Contact messages that create a ticket for an existing account; accountless email replies are not automatically translated. We store original subjects and messages separately from cached translations, along with language and translation-status information, as part of the support record. OpenAI API requests use store: false; this does not guarantee zero retention by OpenAI, whose processing is subject to its applicable data-handling policies. We do not automatically send your account identity or schedule contents to OpenAI for translation, but any personal information you put in a subject or message is included. Avoid sharing sensitive information.

For the optional one-time feedback invitation, we store an invitation record and its initial UTC planner-visit day with your account, rather than a detailed browsing history. Older aggregate visit dates and counts may remain in that record for compatibility, but are no longer updated or used to determine eligibility. We permanently record when the invitation is claimed so it will not be shown again. If you submit feedback, we store your rating, optional comment, interface language, and submission date. Authorized administrators can read this feedback with your account name and email address to help improve the app. Feedback is private and is not published as a review or testimonial.

We record first-party operational, error, export-failure, and conversion telemetry in our database. Conversion telemetry contains a limited event name, source, and optional billing interval or feature. Error and operational telemetry uses bounded, scrubbed technical metadata and is designed not to retain raw IP addresses, emails, cookies, tokens, request bodies, schedule contents, provider payloads, full URLs, or raw stack traces.

6. Cookies, local storage, and similar technologies

We use cookies, local storage, and similar technologies to keep you signed in, remember app state, store local schedule drafts, improve performance, and understand how core features are used.

Some local planning features may work without an account by saving information on your device. If you clear browser storage, those locally stored schedules or preferences may be removed.

7. Data retention

We keep personal information for as long as needed to provide the service, comply with legal obligations, resolve disputes, enforce agreements, and maintain security and financial records. A session may last up to 30 days, password-reset tokens expire after one hour, and temporary one-time Calendar Import credentials expire after up to 15 minutes. Persistent automatic-sync credentials are retained separately, including while access is paused, until disconnect, deletion of the owned schedule/account, or confirmed/missing refresh authorization or invalid Apple app-password authorization requiring reconnection. Retryable calendar-resource access errors do not delete those credentials. Retained snapshot events follow the schedule’s lifecycle.

One-time feedback invitation records and any submitted response are retained with your account and deleted when the account is deleted. You can decline the invitation without submitting a rating or comment.

Scheduled cleanup targets are 30 days for operational events and Stripe webhook idempotency records, 15 days for schedule-write operation records, 35 days for push-delivery metadata, and 365 days from creation for audit records. Actual removal depends on successful maintenance and may occur later. Account, billing, support, and shared-schedule records may have different retention periods based on operational or legal needs. Uploaded-image deletion is asynchronous and public caches may retain a copy until their cache expires.

After account deletion, Play purchase tokens and pseudonymous purchase-ownership and subscription records remain to prevent purchase reassignment or reclamation by recreating an account and to resolve outstanding billing verification. These records are not anonymous and currently have no automatic expiry. Deletion audit records are scheduled for cleanup 365 days after creation, but removal may occur later if maintenance is delayed. Image-cleanup records remain until cleanup succeeds. Payment providers retain their own records under their policies and legal obligations.

8. Your choices and controls

You can update profile details, manage subscription status, control what schedules you publish, and delete your account using available in-app tools or by contacting info@schedulebuilder.net. Cancel web subscriptions through the web account billing controls and Play subscriptions in Google Play before requesting account deletion. Deletion does not cancel billing or issue a refund, and limited retained records are explained above.

You can choose not to create an account and continue using local-only planning features. You can avoid one-time Calendar Import and automatic calendar sync by not connecting a provider. Manage an existing connection from the schedule entry’s Sync settings (schedule-title dropdown on Android), or Keep in sync in Connect a calendar. You can disconnect without losing its local snapshot, avoid public sharing by not creating share links or embeds, and decline browser push permission or remove a push subscription through your browser settings.

9. Security

We use reasonable administrative, technical, and organizational safeguards intended to protect personal information. No system is perfectly secure, and we cannot guarantee absolute security.

You help protect your information by using a strong password, keeping your device secure, and signing out or revoking access if you suspect unauthorized account activity.

10. Children

Schedule Builder is not intended for children under 13, and you should not create an account or submit personal information if you are under 13 or below the minimum age required in your jurisdiction to consent to online services.

11. International processing

Your information may be processed and stored in locations where our hosting, authentication, storage, or payment providers operate. Those locations may have privacy laws that differ from those in your country or region.

12. Changes to this Privacy Policy

We may update this Privacy Policy as the product and legal requirements change. When we do, we will update the last-updated date and may provide additional notice if the changes are material.

13. Contact

ScheduleBuilder is operated by Henrik Sandström, a Swedish sole proprietor trading as Sandström, Henrik. Contact: info@schedulebuilder.net.

For privacy questions, data requests, or concerns about this policy, contact us through the in-app support flow or at info@schedulebuilder.net.