Privacy Policy

WhenFree exists so you can find a time to meet without showing anyone what is on your calendar. Your friends only ever see whether you are free or busy. They never see the title, location, guests, or notes of anything in your calendar.

We do not sell your data, we do not use it for advertising, and we do not use it to train any AI or machine learning model.

WhenFree is operated by the individual reachable at jbenzadon3@gmail.com. That address is also how you exercise any of the rights described below.

Account information. When you sign in with Google we receive your name, email address, and profile picture. We use these to identify your account and to show you to people you add as friends.

Calendar data. If you connect a calendar, we request the Google scope https://www.googleapis.com/auth/calendar.readonly. We use it in two distinct ways, and the distinction matters:

• Busy times, stored. We save the start and end time of each busy period from the calendars you enable, for roughly the next 60 days. These records contain no event content — only that you are occupied between two moments. This is what makes availability matching possible, and it is the only calendar information your friends can ever see.
• Event details, not stored. So that you can see your own week inside the app, we read your event titles and times directly from Google each time you open a calendar view. They are shown to you and discarded. They are never written to our database and are never visible to anyone else.

Things you create. Friend connections, plans you propose, and invites you send. If you invite someone by email or text message, we store that address or number in order to send the invite.

Access tokens. To keep your calendar in sync we store the credential Google issues us, encrypted with AES-256-GCM. It is only ever decrypted on our server to call Google on your behalf.

WhenFree's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically: we use Google user data only to provide the availability and scheduling features described here; we do not transfer it to others except as required to run the service or to comply with the law; we do not use it for advertising; and no human reads your calendar data except where you explicitly ask us to for support, or where the law requires it.

• People you have accepted as friends can see your name, handle, profile picture, and the times you are busy. They cannot see any event details.
• People you share a plan with can see your name and profile picture.
• Everyone else sees nothing. Accounts cannot be browsed or listed; someone can only find you if they already know your exact handle, or have your phone number and you have left phone discovery enabled.

We do not sell your data. We use a small number of providers to run the service, each of which only receives what it needs:

• Supabase — hosts our database and handles sign-in.
• Vercel — hosts the application.
• Google — provides your calendar data at your request.
• Email and SMS providers — receive only the address or number and the text of an invite you asked us to send.

Busy times are continuously replaced as your calendar changes, and only the near future is retained. Disconnecting a calendar deletes its stored busy times and revokes our access token immediately.

Deleting your account removes your profile, friend connections, plans, invites, and all stored calendar data. Email us to delete your account; we will action it within 30 days.

• Choose which of your calendars count toward your availability, or none of them.
• Turn off the ability for people to find you by phone number.
• Disconnect your calendar at any time, from the Connect calendars screen.
• Revoke our access directly from your Google account permissions.
• Request a copy of your data, or its deletion, by email.

Calendar credentials are encrypted before storage. Access to your data is enforced at the database level, so the rules about who can read what are applied by the database itself rather than only by application code.

No service can promise perfect security. If we ever discover a breach affecting your data, we will tell you.

WhenFree is not intended for children under 13, and we do not knowingly collect their data.

If we change this policy in a way that materially affects how your data is handled, we will notify you in the app before the change takes effect.