Privacy policy

This policy describes the OnlyBusy service at onlybusy.com, operated as OnlyBusy. It applies to the website, the account you create, and the calendar connections you authorize. Questions about this policy go to privacy@onlybusy.com.

When you create an account we store:

• Your email address. Signing in with Google stores the verified email Google sends. The Google login token is not stored.
• A password hash, when the account is created with a password. The password itself is not stored.
• Whether you have finished the setup guide.

A session cookie named gb_session keeps you signed in. It is httpOnly, lasts seven days, and is marked secure in production.

Google Calendar and Microsoft 365 are asked for the event id, title, start, end, and busy status so OnlyBusy can show your own events. Descriptions, locations, and attendees are not requested. Titles are not stored and are not written onto the Busy blocks on your other calendars.

The delegated permissions used are:

• Google: openid, email, calendar list read, and calendar events.
• Microsoft: openid, email, offline access, User.Read, and Calendars.ReadWrite.

We also store the account email returned by the provider, the calendar name and color, and the settings you choose for that calendar, including the placeholder label, whether all-day events are mirrored, and any buffer.

On calendars you turn on for mirroring, OnlyBusy creates private events that show you as busy. Each event uses the label you chose for that calendar, has no guests, no notes, no location, and no reminders. A private marker identifies events OnlyBusy created so they are not mirrored again. Disconnecting an account deletes those events and stops further updates.

Beyond busy blocks, OnlyBusy writes to your Google calendar only when you ask it to, in two cases:

• Events you create or edit in OnlyBusy. We send the title and the start and end you enter to the calendar you choose, and update or move that event when you edit it. We do not store the title.
• Scheduling-link bookings. When a guest books a time on your public link, we create an event on the calendar you picked for bookings. The event has your link title and the guest's name as its title, the time, the location or video link, a description with the guest's name, email, and answers to your questions, and the guest as an attendee. Google Calendar then emails the guest the invitation.

For each booking we also store the guest's name, email address, time zone, their answers, the booked time, and the id of the calendar event, so you can see your bookings. That guest information comes from the guest, not from Google. We use it only to run the booking and we do not use it for marketing.

Events you create and bookings are your own calendar events. Disconnecting OnlyBusy deletes the busy blocks it made but leaves those events on your calendar. Delete them in your calendar if you do not want them.

To update and remove those busy blocks we keep:

• OAuth access and refresh tokens, encrypted with AES-256-GCM before they are written to the database.
• The start and end of each mirrored block, and an id for the event OnlyBusy wrote.
• For scheduling bookings, the guest's name, email, time zone, and answers, the booked time, and the calendar event id.
• Sync state, including the last successful sync, webhook channel identifiers, and the last error if a calendar needs attention.

The window we read is the past 7 days through the next 60 days. Busy blocks are written only for events that have not ended. Older mirrored records are dropped as they leave that window.

We do not sell personal information, and we do not use or transfer Google user data for advertising, for data brokers, or to build user profiles.

Data we receive from Google (calendar names and colors, event ids, start and end times, busy status, and the account email) is not shared with, transferred to, or disclosed to any third party, with these limited exceptions:

• Google itself. Mirroring sends the busy blocks we create back to your Google calendars through the Google Calendar API, and to your other connected calendars, such as Microsoft 365, only as a start time, end time, and the label you chose. Mirroring never sends event titles, descriptions, locations, or attendees to any other calendar. The only other writes to Google are the events you create and the scheduling bookings described above, which send the details you or your guest entered to Google Calendar.
• Our infrastructure providers. The hosting providers that run the website and the PocketBase database process stored records on our behalf to operate the service. They may not use that data for their own purposes. Stored OAuth tokens are encrypted before they reach the database.
• Legal requirements. We disclose data only if the law requires it, to protect the rights, safety, or security of users or the service, or as part of a merger or sale of the business, and in that case the data remains covered by this policy.

Payment processing by Stripe covers billing details only. Stripe receives no Google user data. Webhook notifications from Google and Microsoft contain calendar change signals, not event titles.

OnlyBusy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the calendar mirroring you ask for. Humans do not read it unless you ask for support and give consent, it is needed for security or abuse investigation, or the law requires it.

We do not use Google user data to develop, train, or improve any artificial intelligence or machine learning model, and we do not send it to any AI or machine learning service. OnlyBusy uses a third-party AI service only to draft marketing articles for our own website, and the only inputs are public topics and links. No calendar, event, booking, or account data is ever included.

We protect Google user data, including sensitive calendar data, with these measures:

• Encryption in transit. Every connection to OnlyBusy and to the Google and Microsoft APIs uses HTTPS.
• Encryption at rest for credentials. Google and Microsoft access and refresh tokens are encrypted with AES-256-GCM before they are written to the database. The encryption key is held in server configuration, separate from the database.
• Data minimization. We request the narrowest calendar permissions the feature needs, read a limited window (the past 7 days through the next 60 days), do not request descriptions, locations, or attendees, and do not store event titles.
• Secure sign-in flow. Authorization uses the OAuth authorization code flow with PKCE and a state check. Passwords are stored only as hashes. The session cookie is httpOnly and marked secure in production.
• Restricted access. Only the people who operate the service can reach production systems. Internal support tools show account details without event titles or OAuth tokens.
• Prompt removal. Disconnecting an account deletes its stored tokens and the busy blocks we created.

Account and calendar data stay while your account is open and a calendar stays connected. Disconnecting a calendar account removes the busy blocks OnlyBusy created, stops listening for changes, and deletes the stored tokens for that account. To delete the OnlyBusy account itself, email privacy@onlybusy.com from the address on the account. We delete the account record and the calendar data tied to it, except where we must keep a record to meet a legal obligation or resolve a dispute.

You choose which calendars are mirrored and the label each one shows. You can disconnect a provider at any time from Accounts, or remove OnlyBusy's access to your Google account at myaccount.google.com/permissions. You can sign out, which clears the session cookie. You can ask for a copy of the account data we hold, or for correction or deletion, at privacy@onlybusy.com.

If this policy changes, the updated version will be posted on this page with a new date. Continued use of OnlyBusy after that date is acceptance of the updated policy.