Privacy Policy

Overview

ScheduleMerge (“we”, “our”, “the service”) is operated by William Wood, a sole proprietor in California, USA. This policy explains what we collect, why we collect it, how calendar integrations work, and how you can delete or request your data.

What we collect

What we do not collect

• Event titles, descriptions, attendees, or locations from connected external calendars.
• Calendar data beyond busy/free windows and selected calendar names/IDs.
• Marketing identifiers or third-party advertising cookies.
• Browsing or analytics tracking beyond what is required to operate the service.

Google API Services Limited Use disclosure

ScheduleMerge’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We use Google user data only to provide the scheduling features described in this policy.
• We do not use Google user data for advertising.
• We do not sell, transfer, or share Google user data for marketing or promotional purposes.
• We do not use Google user data to develop, improve, or train generalized AI/ML models.
• No human reads Google user data unless you give explicit consent for a specific review, or it is necessary for abuse investigation, legal compliance, security, or operations.

Google scopes we request

Microsoft identity and Graph scopes we request

Where data is stored and protected

Data is stored in the United States on managed services: Vercel for application hosting and Neon for PostgreSQL database hosting. Outbound transactional email is sent via Resend. Data is encrypted in transit with HTTPS/TLS. OAuth tokens are encrypted at rest with AES-256-GCM.

How long we keep data

• Calendar busy/free blocks are refreshed periodically and replaced with newer data.
• Old busy/free blocks past a project’s scheduling window are deleted.
• Calendar OAuth tokens are deleted immediately when you disconnect a calendar.
• Project data is retained while the project exists. Projects whose date range ended more than 6 months ago are automatically retired.
• When you delete your account, all data tied to your account is deleted immediately.

Deleting your account and data

You can permanently delete your account and associated data at any time by going to Settings → Delete account. This immediately deletes:

• Your account record, including name, email, and password hash.
• Your encrypted calendar OAuth tokens.
• All projects you own, including slots, meetings, and guest data.
• Your saved contacts, places, and personal booking links.
• Your busy/free block history.

Projects you co-host that are owned by other users remain; you are removed from them. If you cannot reach the settings page, email support@schedulemerge.com and we will delete your account within 30 days.

Your other rights

• Access the data we hold about you.
• Receive a copy of your data on request.
• Disconnect calendar integrations at any time.
• Correct inaccurate data.
• Withdraw consent for any processing that requires consent.

Email support@schedulemerge.com for access or correction requests. We respond within 30 days.

Third-party services

Children’s privacy

ScheduleMerge is not directed at children under 13, or under 16 in the EU/UK. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

Changes to this policy

If we make material changes to this policy, we will notify account holders by email and update the “Last updated” date above. Continued use of the service after the new policy takes effect constitutes acceptance.

Contact

ScheduleMerge is operated by William Wood, a sole proprietor based in California, USA. For privacy questions or requests, email support@schedulemerge.com.