smartCal Privacy Policy

Effective October 26, 2026 · SmartApz LLC · עברית

smartCal (“smartCal”, “we”, “us”) is an online scheduling service at smartapz.com/smartcal, operated by SmartApz LLC. This policy explains what information we collect from hosts (people with a smartCal account) and guests (people who book time with a host), how we use it, and the choices you have. Contact: info@smartapz.com.

1. Information we collect

From hosts

• Account details: name, email address, a password (stored only as a salted scrypt hash), the link name you choose, your timezone, language and city for Shabbat times.
• Scheduling settings: event types, weekly hours, date overrides, buffers, prices and the questions you ask guests.
• Billing: if you subscribe to a paid plan, payment is handled by Stripe. We store your Stripe customer and subscription identifiers and plan status. We never see or store your full card number.
• Google Calendar data (only if you choose to connect Google): see section 3.

From guests

• The name, email address and (if the event needs it) phone number you enter when booking, your timezone and language, your answers to the host's questions, and the time you booked.
• If the booking is paid, payment is processed by Stripe; we receive the payment status and amount, not your card details.

Automatically

• Basic server logs (IP address, browser user agent, pages requested, time) kept for security and troubleshooting, and a session cookie that keeps hosts signed in. We do not use advertising cookies or third-party trackers.

2. How we use information

• To show a host's booking page, calculate free times, and create, confirm, reschedule and cancel bookings.
• To send booking emails: confirmations with a calendar (.ics) file, reminders, and cancellation or reschedule notices, to both the guest and the host.
• To process payments and subscriptions through Stripe.
• To keep the service secure (rate limits, abuse prevention) and to answer support requests.

We do not sell personal information, we do not rent it, and we do not use it for advertising.

3. Google Calendar data (Google user data)

Connecting a Google account is optional. If a host connects Google Calendar, smartCal requests these permissions:

• Free/busy information (calendar.freebusy): we read only whether time ranges on your selected calendars are busy or free, so guests can't book a time when you are already busy. We do not read the titles, descriptions, attendees or other details of your existing events.
• Create and manage events (calendar.events): when a guest books, we create that one event on your calendar (with a Google Meet link if the event type uses Meet), and we update or delete only events that smartCal created when the booking is rescheduled or cancelled.
• Basic profile (openid, email): to show which Google account is connected.

How we handle Google user data:

• We use it only to provide the scheduling features described above, which the host can see in the app.
• We store the OAuth refresh token encrypted (AES-256-GCM) on our server, plus the connected email address and the IDs of events smartCal created. Free/busy results are held in memory for about a minute and are not stored in our database.
• We do not sell Google user data, do not use it for advertising, do not use it to train AI or machine-learning models, and do not let humans read it, except with your explicit permission for support, when required for security, or to comply with law.
• We do not transfer Google user data to anyone, except as needed to provide the service (for example, the guest receives the meeting time and Meet link they booked) or as required by law.
• smartCal's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google at any time in smartCal under Integrations (we delete the stored token and revoke it with Google), or from your Google Account at myaccount.google.com/permissions.

4. Service providers

We share information only with providers that help us run smartCal, under their own privacy terms: DigitalOcean (hosting and database), Brevo (sending email), Stripe (payments), Google (only if you connect Google Calendar), and Hebcal.com (we send only your selected city's coordinates to look up Shabbat and holiday times; no personal information). We may disclose information if required by law or to protect the rights and safety of our users or the public.

5. Retention and deletion

• Host account data is kept while the account is open. You can delete your account in the app (Account → Delete account); upcoming bookings are cancelled first (each guest is emailed and paid bookings are refunded in full), then your profile, event types, bookings and Google tokens are deleted from our database immediately. Backups roll off within 30 days.
• Guests can ask a host to delete their booking, or write to us.
• Deletion on request: anyone can email info@smartapz.com to access, correct or delete their personal information, including Google user data. We answer within 30 days.

6. Security

All traffic uses HTTPS. Passwords are hashed, OAuth tokens are encrypted at rest, and access to the server is restricted. No method is perfectly secure, but we work to protect your information.

7. Children

smartCal is not directed to children under 13 (or 16 where local law requires), and we do not knowingly collect their information.

8. Your rights

Depending on where you live (for example the EU/UK, Israel or California) you may have rights to access, correct, delete or export your data, or to object to some uses. Email info@smartapz.com and we will help. We do not sell or share personal information for cross-context behavioral advertising.

9. Changes

If we change this policy we will update the date above, and for significant changes we will notify hosts by email.

10. Contact

SmartApz LLC · info@smartapz.com