Privacy Policy for OpenHour

This Privacy Policy explains how OpenHour collects, uses, stores, and shares information when you use the OpenHour mobile application, website, and related services.

By using OpenHour, you acknowledge the practices described in this Privacy Policy.

Depending on how you use OpenHour, we may collect:

• Account information such as your email address and sign-in details
• Profile information such as your name, handle, profile photo, and bio
• Phone number and contact-discovery preference, if you choose to enable phone discovery
• Schedule and connected-calendar data, events, club information, RSVPs, messages, invitations, and other content you submit
• Data from the calendars you select for Calendar Sync, including calendar names, event dates and times, titles, descriptions, recurrence details, and event identifiers
• Encrypted calendar credentials or authorization tokens when needed to continue the sync you requested
• Photos you upload as plan memories and images you select for schedule import or automated parsing features
• Phone numbers from your address book when you explicitly run Quick Add; these are checked for matching accounts and are not added to your profile
• Reports, blocks, and other safety actions you submit
• Subscription status and purchase history needed to provide paid features
• Short-lived deferred-link matching data: opaque link and click IDs, click time, platform, coarse operating-system and browser family, operating-system major version, device family, language, time zone, screen-size buckets, a truncated network prefix, and a random app-install session ID
• Device, log, and diagnostic information needed to operate, secure, and troubleshoot the service
• Notification tokens and related technical data used to deliver push notifications

When you open an invitation, referral, club, or event link and then install OpenHour, we may use the short-lived technical data listed above to try to resume that link. Android uses a signed opaque click ID supplied through Google Play. Because Apple does not provide an equivalent install-referrer mechanism, iOS may compare only coarse signals and resumes a link only when one recent candidate is a sufficiently strong, unambiguous match.

We do not use an advertising ID, IDFA, device fingerprint, precise location, raw IP address, contacts, or cross-app tracking for this matching. Network addresses are reduced before storage to an IPv4 /24 or IPv6 /64 prefix. Screen dimensions are stored as broad buckets, and operating-system versions are reduced to the major version. This data is used for app functionality, abuse prevention, and aggregate reliability measurement—not advertising.

A click is eligible for deferred matching for no more than 30 minutes. Expired click matching records are scheduled for deletion by an hourly cleanup job, so under normal operation they are removed within one hour after the matching window ends. Minimal event and consumption records may be retained longer to enforce one-time use, prevent replay, investigate abuse, and measure aggregate link reliability.

Calendar Sync is optional. When you connect a supported provider such as Google Calendar, Microsoft Outlook, or Apple Calendar, OpenHour accesses the calendar information needed to show available calendars, import the calendars you select, and keep your OpenHour schedule updated.

To provide Calendar Sync with Google Calendar, OpenHour requests exactly two OAuth scopes through Google's Calendar API. Both are shown on the Google consent screen at the time you set up Calendar Sync:

• Read-only access to your calendar list (https://www.googleapis.com/auth/calendar.calendarlist.readonly), used only to show you the calendars in your Google account so you can choose which ones to import.
• Event-level read and write access (https://www.googleapis.com/auth/calendar.events), used to read events from the calendars you select so OpenHour can display your events and availability, and, only if you choose to enable two-way sync, to create, update, and remove OpenHour-managed events on the single writable calendar you select.

OpenHour does not request any scope that would allow it to modify calendar settings, sharing permissions, or calendar subscriptions, and it does not use these permissions to modify or delete any events other than the OpenHour-managed events it created on your behalf. If you leave two-way sync off, OpenHour writes nothing to your Google Calendar.

If you enable two-way sync for a supported provider, OpenHour may create, update, or remove OpenHour-managed events in the writable calendar you select. We do not change unrelated calendar settings or sharing permissions.

We store calendar credentials or authorization tokens encrypted at rest and use connected- calendar data only to provide and improve user-facing calendar and availability features. Imported events follow your OpenHour schedule visibility settings; they are not sold or used for advertising.

You can disconnect a calendar in the app at any time. When you remove a Google Calendar connection, OpenHour deletes the Google Calendar data associated with that connection from its live systems as part of that same request: the events imported from the connection, the per-calendar records, the links between Google events and OpenHour schedule items, and the stored Google authorization and refresh tokens. OpenHour also revokes the authorization with Google. If you keep a connection but deselect an individual calendar, the events imported from that calendar are deleted at the moment you save the change. No Google Calendar content is retained after a disconnect. The only record kept is a disconnect audit entry noting that a disconnect occurred, the provider, a one-way hash of the account identifier, and whether provider cleanup succeeded; it contains no calendar content. Copies may persist briefly in encrypted operational backups until those backups expire on their normal rotation, after which no Google Calendar data remains.

OpenHour's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. OpenHour uses Google user data only to provide and improve the user-facing calendar and availability features you request; does not transfer that data except as necessary to provide those features, to comply with applicable law, or in connection with a merger or acquisition; does not use it for advertising; does not sell it; and does not allow humans to read it except with your affirmative consent, for security purposes, to comply with applicable law, or where the data has been aggregated and anonymized. Google user data is never used to develop, improve, or train generalized artificial intelligence or machine learning models.

We share information only as needed to provide and protect OpenHour, including:

• With other users according to your privacy settings, friendships, plan participation, club membership, and the features you choose to use
• With service providers that host data, deliver notifications, process subscriptions, connect calendars, parse schedule images, or help operate and secure the service
• When reasonably necessary to comply with law, respond to legal process, prevent harm, investigate abuse, or protect rights and safety
• As part of a merger, financing, acquisition, reorganization, or sale of assets, subject to applicable notice and consent requirements

We do not sell personal information, share connected-calendar data with advertising platforms, or use connected-calendar data to train general-purpose artificial intelligence models.

We use information we collect to:

• Create and maintain your account
• Provide scheduling, friendship, circle, club, and event features
• Match contacts to users who opted into phone discovery when you choose Quick Add
• Connect, synchronize, and display calendars you authorize
• Authenticate users and keep the service secure
• Process uploaded images and extract schedule information when you choose to use those tools
• Send service-related notifications and activity updates
• Monitor performance, troubleshoot issues, and improve the service
• Comply with legal obligations and enforce our Terms of Service

We use analytics tools to understand how users interact with OpenHour. This includes information such as app usage, features accessed, and general interaction patterns. This data helps us improve app performance and user experience.

Some analytics providers may collect identifiers such as device information or anonymized user IDs. We do not use this data for third-party advertising.

Information received from Google APIs, including connected Google Calendar data, is not sent to analytics providers and is not used for advertising. It is handled only as described in Section 4.

For our public website, we may record the page visited, referring website, campaign parameters, general device and country information, and a short-lived one-way network identifier used to estimate daily unique visitors. We do not store raw IP addresses in our discovery analytics. We may also identify requests made by search-engine and AI crawlers from their published user-agent information.

We do not sell personal data to third parties.

If you allow notifications, OpenHour may send push notifications related to friend requests, events, invitations, reminders, or other account activity.

You can manage notification preferences through your device settings and, where available, in-app controls.

OpenHour relies on third-party service providers to operate parts of the application, including Supabase, supported calendar and authentication providers, AI schedule-image parsing providers, RevenueCat subscription services, Expo services, Vercel hosting, and Apple or Google platform infrastructure.

These providers may process limited technical data necessary to provide their services. Their handling of information is governed by their own terms and privacy policies.

Wherever OpenHour uses Google APIs, including the Google Calendar API and Google sign-in, OpenHour's use and transfer of information received from those APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. That commitment covers all Google user data OpenHour receives, however it is obtained, and is not limited to calendar sync mechanics. Google user data is not shared with the schedule-image parsing providers or analytics providers described above, and is not used to develop, improve, or train generalized artificial intelligence or machine learning models.

• Update your profile and privacy settings in the app
• Choose which calendars to connect and disconnect them at any time
• Control whether friends see event details or only your availability
• Decline or revoke contacts, photos, camera, and notification permissions in device settings
• Delete eligible messages, photos, events, calendar connections, or your account using available in-app controls
• Revoke OpenHour's access to your Google account at any time from your Google Account permissions page, in addition to disconnecting inside the app
• Contact us to request access, correction, or deletion where required by applicable law

We use reasonable administrative, technical, and organizational measures to protect information stored through OpenHour.

No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

We retain information for as long as needed to operate the service, maintain user accounts, resolve disputes, enforce agreements, and meet legal or operational obligations.

Some information may remain in backups, logs, or archived systems for a limited period after deletion.

Connected-calendar credentials are retained while the connection is active. Plan photos, messages, and other user content are retained until they or the related account or plan are deleted, subject to the limited exceptions above.

Information received from Google APIs is retained only while the connection that produced it remains active. Deletion of Google Calendar data on disconnect or revocation is described in Section 4, which governs that data instead of the general practices in this section.

You may delete your account through the application.

When an account is deleted, OpenHour removes active account data from live application systems, subject to limited retention in backups, logs, fraud-prevention records, or where required for legal or operational reasons.

Deleting your account also removes connected-calendar data, including any Google Calendar data, from live application systems.

OpenHour may request device permissions such as:

• Photos or files, if you choose to upload an image for schedule import
• Camera access, if you choose to capture an image in the app
• Contacts, if you choose to run Quick Add
• Notification permissions, if you want to receive push notifications

You can decline or revoke these permissions through your device settings, but some features may not function properly without them.

OpenHour is not intended for children under the age of 13.

If we learn that personal information has been collected from a child under 13 without appropriate consent, we will take reasonable steps to delete that information.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date on this page.

Continued use of OpenHour after an updated policy becomes effective means the updated policy applies going forward.

OpenHour is operated by:

OpenHour
Operated from Norman, Oklahoma, United States

Contact: app.openhour@gmail.com
Website: https://www.openhour.app