Privacy Policy

From hosts

• Your name, email address and profile picture from Google or Microsoft sign-in, plus the username, time zone and (optional) mobile number you set.
• Calendar and conferencing connections: OAuth tokens for Google, Microsoft or Zoom, or an Apple/CalDAV app-specific password. These are stored encrypted (AES-256) and used only to read your busy times and to create, update or delete the meetings people book with you.
• Your event types, availability and booking settings.

From guests

• The name, email address, mobile number and any notes you enter when booking, your time zone, and the meeting you booked.
• Whether you confirmed, rescheduled, cancelled or attended.

Device and network signals (guests)

• When you book, we take your IP address and a browser fingerprint and store only salted one-way hashes of them, along with your browser's user agent, time zone and referring page. We never store the raw IP address.
• These are used only for show-up prediction: they let us recognise when two bookings with the same host came from the same device or network, so the host's show-up estimate can account for that history. They are kept for 90 days for this linkage and then deleted automatically.

Messages and meetings

• SMS message logs: the texts we send and receive about a booking, phone numbers, and delivery status.
• Records of what our SMS assistant decided (for example "confirmed" or "asked to reschedule"), so hosts can review it.
• Meeting attendance: when a meeting is watched by our attendance bot or by Zoom's meeting notifications, we store participant names or emails as the meeting platform reports them and the times they joined and left. We do not record audio or video and do not keep transcripts.

We use one session cookie to keep hosts signed in. We don't use advertising or third-party tracking cookies.

• To schedule meetings, put them on the host's calendar and create meeting links.
• To send confirmations, reminders and replies by email and SMS, and to let guests confirm, reschedule or cancel by replying.
• To estimate how likely a guest is to show up. The estimate is shown only to that guest's host and is used only to help them plan the meeting.
• To text the host when something changes, such as an unconfirmed guest joining the call.
• To keep the service secure and prevent abuse (for example, rate limiting).

We do not sell personal information, use it for advertising, or share it with third parties for their own marketing.

We use these service providers to run Cal Agent. Each gets only what it needs for its job:

• MongoDB Atlas: database hosting for all of the data above.
• Vercel: application hosting and server logs.
• Twilio: sending and receiving SMS (phone numbers and message text).
• Anthropic: the AI model behind the SMS assistant. It receives the guest's text messages and the booking details needed to reply (names, meeting time, open time slots).
• Recall.ai: the attendance bot that joins a meeting and reports who joined and left. Recording is turned off.
• Resend: sending email confirmations.
• Google, Microsoft and Zoom APIs: reading the host's busy times and creating calendar events and meetings on the host's behalf.

We may also disclose information if the law requires it, or to protect the safety of our users or the service.

Cal Agent's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We access your basic Google profile (name, email, picture) to sign you in, and your Google Calendar to read busy times and to create, update and delete the events people book with you (including Google Meet links).
• We use this data only to provide those scheduling features to you. We don't use it for advertising, don't sell it, and don't use it to train generalized AI or machine-learning models.
• We transfer it to others only as needed to provide the service (the providers above), for security, to comply with the law, or with your consent. People don't read it unless you ask us to, it's needed for security or legal reasons, or it has been aggregated and anonymised.
• You can disconnect Google at any time from Dashboard → Calendars, or revoke access in your Google Account's third-party connections settings.

• Consent. When you book, you choose whether we may text you about that meeting (the "Text me about this meeting" checkbox). Hosts opt in to alerts by adding their mobile number. Texting isn't required to book.
• What we send. Booking confirmations, requests to confirm, reminders, replies to your messages, and notices when a meeting is moved or cancelled.
• Message frequency varies, usually a few messages per booking.
• Msg & data rates may apply.
• Reply STOP to opt out at any time. Because one Cal Agent number serves every host, STOP turns off texts from that number for all hosts. Reply HELP for help, or email mquinnstewart@gmail.com.
• Carriers are not liable for delayed or undelivered messages.
• We don't share mobile numbers or SMS opt-in information with third parties or affiliates for marketing or promotional purposes.

• Device and network signals (hashed IP and fingerprint): deleted automatically after 90 days.
• Bookings, guest details, SMS logs and attendance events: kept while the host's account is active, so the host can see meeting history and show-up rates.
• Calendar and conferencing tokens: deleted as soon as the host disconnects that account.
• To have your data deleted, or to get a copy of it, email mquinnstewart@gmail.com from the address you used (guests: include the phone number you booked with). We'll confirm and complete the request within 30 days, except for records we're legally required to keep.

Connections are encrypted in transit (HTTPS/TLS). Calendar credentials are encrypted at rest, IP addresses and fingerprints are stored only as salted hashes, and access to production data is limited to the people who run the service.

Cal Agent is not directed at children under 16, and we don't knowingly collect their personal information.

If we change this policy we'll update the effective date above, and for significant changes we'll tell hosts by email. See also our Terms of Service. Contact: mquinnstewart@gmail.com.