Privacy policy

What Compass asks Google for

• Read access to the calendars of the Google account you connect (calendar.readonly).
• Permission to create, change and remove events (calendar.events). Compass uses it only on events Compass itself wrote; it never edits or deletes an event a person made.
• Your email address (openid, email), so Compass knows which Google account is connected.

What Compass does with it

• Shows your events together in one week view inside Compass, and links each event to the meeting notes it belongs to.
• Works out your free and busy times for your own booking pages and availability links.
• Writes events into your own connected calendars: Busy holds, copies of events at the level of detail you choose, bookings people make with you, and outside-working-hours blocks.
• Shows other people only what you choose to share in Settings. Booking pages and availability links show nothing else.

Where it is kept

• Events Compass reads are stored in its database (Supabase, United States, us-east-1), readable only by the account that connected them.
• Google access and refresh tokens are encrypted at rest with AES-256-GCM. The key is held only on the server, never in the browser.

What Compass never does

• Sell, rent or share Google user data with anyone.
• Use it for advertising.
• Send Google calendar data to an AI model, or use it to train one.

Compass's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Your control

• Remove a calendar in Compass (Settings, Calendars, Remove): its stored events are deleted, and so are the stored tokens once no other calendar from that Google account remains.
• Revoke Compass's access at any time at myaccount.google.com/permissions.
• Ask for everything to be deleted by writing to mick@rockstarcoding.com.

Changes

Any change to this policy is made on this page, with the date above.