Privacy policy

Account and workspace information

Google sign-in provides your verified email, Google account identifier, name, and profile image when available. CTS uses this information to verify workspace membership, maintain your account, and identify you to teammates. Additional Google calendar accounts are linked to your existing account and are not sign-in identities.

CTS stores work you submit, including tasks, assignments, messages, comments, uploaded files, meeting information, and preferences. Booking guests provide a name, email, timezone, chosen meeting time, and any notes they enter. Session records can include an IP address and browser information. Cookies and browser storage support sign-in, security, and preferences. File-share download attempts record their time, outcome, and limited browser information. Optional share passwords are stored as salted verifiers, not as plaintext.

Google Calendar access and use

With your permission, CTS reads calendar names, identifiers, timezones, access permissions, and busy times. It combines busy times from your selected calendars to calculate booking availability, including the calendars selected by required teammates.

The Team calendar view reads primary-calendar event details, including titles, descriptions, times, locations, attendees, and meeting links. Additional-account event details are not shown in that view. Public booking pages show available times, the host's display name, meeting information, and required attendees' display names; they do not expose raw busy intervals or connected-account details.

CTS uses event access to create booking events and Google Meet links in your chosen destination calendar and remove events when bookings are cancelled or replaced. Task deadlines create and update reminders in each assignee's connected primary calendar. Meeting information is shared with the participants you include.

Storage and access

The service stores account and workspace records, connected-account emails and identifiers, calendar lists and selections, access tokens, and Google event references in its database. Refresh tokens are encrypted before storage so calendar access can continue without repeated sign-in. Temporary credentials awaiting account confirmation are encrypted and expire after ten minutes.

Access within the app follows workspace permissions. Team members can see shared work and connected primary-calendar details; additional account settings are available to their owner. Authorized service operators maintain the database and supporting systems. Production connections to CTS use HTTPS.

Sharing and service providers

Google provides sign-in, calendar access, meeting invitations, and Meet links. CTS is hosted on Hetzner. When configured, Resend delivers notification and booking emails, and Cloudflare R2 stores uploaded files and database backups. These services process information needed for those functions. Google Calendar's own sharing settings also apply to events stored there.

CTS does not sell Google user data, use it for advertising, or use it to train AI models. Its use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting, retention, and deletion requests

You can disconnect a Google calendar account in Scheduling → Availability. This removes its stored access and refresh tokens from the active connection and stops using its calendars for availability. You can also revoke CTS's access in your Google Account's third-party connections settings.

Disconnecting does not delete your CTS account, existing bookings, events already created in Google, or connection identity and calendar metadata retained in CTS. Workspace records remain until removed by the workspace operator; deactivation does not erase historical work. Deleting or hiding an item in the app can retain audit records, and backup copies can retain previously stored information.

To request access, correction, or deletion of information, or ask about retention, contact your CTS workspace administrator or the person who shared a booking link with you. Requests involving shared work, another participant's records, or backups require review by the workspace operator.

Deleted file objects are recoverable for seven days before scheduled removal from file storage. File metadata and access logs may remain in audit history. Public file links expire within thirty days and can be revoked sooner; an already authorized download URL can remain valid for up to sixty seconds.

Contact and policy updates

For support or privacy questions, contact your CTS workspace administrator or the person who shared a booking link with you.

Updates to this policy will appear on this page with a revised date. Changes to how Google data is used require updated disclosures and any additional consent needed before the new use begins.