Introduction
When. ("we," "our," or "the Service") is a group scheduling application that helps people find meeting times that work for everyone. We take your privacy seriously and built When. with a deliberate principle: collect the minimum data necessary, and never look at what we do not need.
This Privacy Policy explains what we collect, how we use it, how we protect it, and how you can remove it. If you have questions, contact us at whenapp.now@gmail.com.
1. Data We Collect
1.1 When You Sign In with Google
- Your email address
- Your full name
- Your profile picture (avatar) URL
We also generate a unique internal user ID and store your selected timezone. We do not access your Google Calendar during sign-in.
1.2 When You Connect Your Google Calendar
- The Gmail address of the connected account
- Your Google account identifier
- OAuth access token, refresh token, and expiry timestamp
- A list of your calendars so you can choose which ones to include
1.3 What We Collect from Your Calendar
We read only event start and end times, plus an internal Google event ID used for sync. We do not collect event titles, descriptions, locations, attendees, or other event content.
| Field We Store | Purpose |
|---|---|
| start_time_utc | When the busy block begins |
| end_time_utc | When the busy block ends |
| provider_event_id | Used only for deduplication and deletion detection |
All-day and cancelled events are skipped.
1.4 Data You Choose to Provide
- Preferred time slots for specific events
- Notes on proposed times
- Acceptance status for invited events
2. How We Use Your Data
We use your data only to help groups find meeting times that work for everyone.
2.1 Availability Heatmap
- Reads participant busy slots and preferences
- Computes aggregate availability counts in memory
- Returns only aggregate counts for display
- Does not create extra persistent availability records
2.2 Smart Proposal Ranking
- Generate candidate time slots in 30-minute intervals
- Count overlaps with busy and preferred slots
- Rank by lowest conflicts, then highest preferences, then earliest start
- Save only top 5 suggestions with anonymous counts
We do not use your data for advertising, profiling, or training machine learning models.
3. How We Store and Protect Your Data
3.1 Infrastructure
- Stored in PostgreSQL on Supabase
- Encrypted at rest (AES-256)
- Encrypted in transit (TLS)
3.2 Row Level Security
PostgreSQL RLS policies enforce access control so users can only access data they are authorized to see.
3.3 OAuth Tokens
Google tokens are stored as encrypted records and accessed only by authenticated server processes that need them for calendar sync.
4. Background Calendar Sync
- Runs once per hour
- Reads events from now up to 90 days ahead
- Extracts only start/end times and Google event IDs
- Deletes busy slots for deleted/cancelled Google events
- Stops access immediately if refresh token is revoked
5. Data Retention and Deletion
5.1 Disconnecting a Calendar
- Revokes Google OAuth tokens immediately
- Deletes associated calendar account record and credentials
- Removes busy slots for that calendar
5.2 Deleting an Event
Deleting an event removes participant lists, preferred slots, proposed times, and notes through database cascade rules.
5.3 Deleting Your Account
- Disconnect all connected calendars and revoke tokens
- Delete profile and related personal records
- Delete planning-stage events you coordinated
- Anonymize your identity from already confirmed coordinated events
- Remove your participation from other users' events
You can also request deletion by emailing whenapp.now@gmail.com from your account email.
6. Third-Party Sharing
We do not sell, rent, trade, or share your personal or calendar data with third parties.
Limited exceptions include Google, Supabase, and valid legal requirements.
7. Google API Services User Data Policy
When. adheres to the Google API Services User Data Policy, including Limited Use requirements.
8. Google OAuth Scopes We Request
Login
| Scope | Why We Need It |
|---|---|
| openid | Identify you and create a session |
| userinfo.email | Use your email as login identifier |
| userinfo.profile | Display your name and photo to participants |
Calendar Connection
| Scope | Why We Need It |
|---|---|
| calendar.readonly | Read event start/end times for free/busy and deletion sync handling |
| calendar.events | Create finalized event on your chosen write calendar |
9. Children's Privacy
When. is not directed to children under 13 (or under 16 in the EEA). If you believe a child has created an account, contact us and we will delete it.
10. International Users
The service operates from infrastructure primarily in the United States and European Union. By using the service, you consent to data transfer to these locations.
11. Your Rights
- Access your personal data
- Correct inaccurate data
- Delete your data
- Export your data
- Object to or restrict certain processing
- Withdraw Google Calendar consent at any time
To exercise these rights, email whenapp.now@gmail.com.
12. Security Incidents
If we become aware of a security incident affecting your data, we will notify you and relevant authorities within legally required timeframes.
13. Changes to This Policy
- We update the Last Updated date
- We notify users by email for material changes
- We request renewed consent when required by law
14. Contact Us
For privacy questions, deletion requests, or rights requests, email whenapp.now@gmail.com.