Privacy Policy

Calendar Assistant · Last updated: 16 October 2026

Calendar Assistant ("we", "the app") is an AI assistant for Google Calendar, available as a Chrome extension, a phone app and a web app at app.thecalendarassistant.com. This policy explains which data we use, why, and your rights.

1. Who is responsible

Oumaima Chebbi
Email: calendardevteam@gmail.com

2. What we use and why

Your Google account. When you sign in with Google, we receive your Google account ID and email address, and permission to see and edit your Google Calendar events and to list your calendars. We store:

• your Google account ID and email, to know who you are;
• a Google refresh token, encrypted (AES-256), so the app can reach your calendar without asking you to sign in every time. It is only decrypted in memory while a request is being handled.

If you add more Google accounts, we store the same data for each added account.

Your calendar events. The app reads, creates, changes, moves, colors and deletes events in your Google Calendar only when you ask it to (in the chat, the calendar view or the dashboard). We do not keep a copy of your events; they are always read live from Google.

Your settings. Which calendars are shown, your categories (name and color), and your app language.

Your chat messages. To answer you, your message and the relevant calendar information are sent to Google's Gemini API (see section 4). Chats are not saved on our server. The chat history is kept only in your own browser's temporary memory and is erased when you close the browser. While a conversation is running, the server keeps the last messages in temporary working memory (not on disk) so the assistant understands follow-up questions; it is lost when the server restarts.

Voice messages (Premium). Your recording is sent to our server and to Google's Gemini API only to turn it into text. The audio is not stored.

Subscription. If you buy Premium, payment is handled by Lemon Squeezy (see section 4). We receive and store your plan, its status, renewal or end date, a subscription ID and a link to manage your subscription. We never see your card details.

Usage limits. On the Free plan we count your messages per day (date and number) to apply the daily limit. For the free Premium day for new users, we keep a one-way scrambled code (hash) of your Google account ID so the free day is given only once.

Sign-in session. A cookie (ca_session, 30 days) keeps you signed in. A second cookie (ca_lang, 1 year) remembers your app language. We use no advertising or tracking cookies and no analytics.

Server logs. Our workflow system does not save the content of requests. The web server may briefly keep technical logs (IP address, time, requested page) for security and error fixing.

3. Legal bases (GDPR)

• Providing the service you asked for: Art. 6(1)(b) GDPR (contract).
• Security, preventing abuse of the free day and limits: Art. 6(1)(f) GDPR (legitimate interest).
• Payments and tax records: Art. 6(1)(c) GDPR (legal obligation), handled by Lemon Squeezy.

4. Service providers

• Hetzner Online GmbH (Germany): hosts our server in the EU.
• Google: Google sign-in, Google Calendar API, and the Gemini API that powers the assistant and voice transcription. Gemini processing may take place outside the EU under Google's data processing terms. We use a paid Gemini plan, under which Google does not use our requests to improve its models.
• Lemon Squeezy (merchant of record): sells the Premium subscription, processes payments and taxes. Lemon Squeezy acts under its own privacy policy for payment data.
• Cloudflare: domain registration and name service (DNS) only; your app traffic does not pass through Cloudflare.

We do not sell your data and do not share it with anyone else.

5. Google API Services: Limited Use

Calendar Assistant's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the calendar features you see in the app. We do not use it for advertising, we do not sell it, and we do not use Google user data to develop, improve or train AI or machine-learning models. Humans do not read your calendar data unless you ask us for support and give permission, or the law requires it.

6. How long we keep data

• Sign-in sessions: 30 days, or until you sign out.
• Account data, tokens, settings and categories: until you delete your data.
• Chats and voice recordings: not stored (see section 2).
• The free-day hash: kept to prevent repeated free days, even after you delete your data.
• Payment records: kept by Lemon Squeezy as required by tax law.

Delete everything at any time: in the app, use "Delete my data" (⋯ menu on phones). This removes your account, tokens, linked accounts, settings and categories from our server and disconnects your Google account. Your events in Google Calendar are not affected. You can also remove the app's access in your Google Account under Security → Third-party connections.

7. Security

We protect your data with HTTPS encryption, encrypted storage of Google access tokens (AES-256), no storage of chats, voice recordings or calendar events, and access to the server limited to the operator. No online service can be completely secure, so we cannot guarantee that data will never be accessed without permission. If a data breach happens that is likely to put your rights at risk, we will inform you and the responsible authority as required by law.

8. Your rights

You have the right to access, correct, delete, restrict or move your data, and to object to its use (Articles 15–21 GDPR). Write to calendardevteam@gmail.com. You can also complain to a data protection authority, for example the one where you live.

9. Children

Calendar Assistant is not meant for children under 16.

10. Changes

If we change this policy, we will update the date above and, for important changes, tell you in the app.