Privacy policy

A calendar is a record of where you are, who you meet and what you are dealing with. This policy explains what personal information CalAlign collects when you use our website at calalign.com and the CalAlign app, what we do with it, where it is kept, how long we keep it and what you can ask us to do.

About this policy

CalAlign is a New Zealand business. In this policy “CalAlign”, “we” and “us” mean that business, and “you” means anyone whose personal information we handle: people who use the app, people who book a meeting through a CalAlign booking link, and visitors to this website.

We follow the New Zealand Privacy Act 2020 and its information privacy principles. If you live outside New Zealand, the section If you live outside New Zealand describes the rights you have wherever you live. Our privacy officer reads every message sent to privacy@calalign.com.

The short version

• We read the calendars you choose so we can keep them aligned, protect your time and run your booking links.
• We do not sell your information, use it for advertising, or use it to train AI models.
• The tokens and app passwords that let us reach your calendars are encrypted, and event details never go into our logs.
• The app and its database run on Google Cloud in Sydney, Australia.
• Payments go through Stripe, and our service emails go through Resend. CalAlign never sees or stores your card number.
• If your organisation stays read-only for 90 days in a row (no trial, no paid-up subscription and no fee waiver), we email its owners and administrators, and we delete its data 30 days later unless someone pays.
• You can disconnect a calendar account at any time, and ask us to see, correct or delete what we hold about you.

What we collect

When you sign in

You sign in to CalAlign with a Google or Microsoft account. Your provider sends us a sign-in token that contains your account’s identifier, your email address and whether the provider has verified it, your organisation’s Google Workspace domain or Microsoft tenant identifier, and whether you used multi-factor sign-in. We use these to recognise you, place you in the right organisation and give you the right role. We keep the account identifier and the organisation it maps to. We use your email address to check whether your organisation has given that address a role, and, once you belong to an organisation in CalAlign, we keep it with your name in that organisation’s member list (described next). We never see your Google or Microsoft password.

If you sign in before your organisation exists in CalAlign, we store nothing about you yet, apart from the joining code attempts described below. Your sign-in details wait in a signed sign-up token in your browser session for at most 30 minutes, while you create or join an organisation.

When you create or join an organisation

CalAlign keeps a member list for each organisation: each member’s account identifier, name and email address as the sign-in provider gave them, whether the provider verified that address, their role, and when they joined, asked to join and last signed in. For the organisation we keep its name, the kind of account it is (Google Workspace, Microsoft, personal or other), whether colleagues join as soon as they sign in or wait for approval, and when it was created. When an owner or administrator invites someone, we keep the invited email address, the role offered and when the invitation expires. We store the invitation link only as a one-way hash, never the link itself.

If you sign in with a work or school account and your organisation already uses CalAlign and approves new members, your sign-in becomes a request to join. We add your name and email address to its member list as a request, and email its owners and administrators so one of them can approve or decline it. When they approve it, we email you. If they decline it, we keep the declined request and the date of the decision for 30 days, so signing in again during that time does not send them another request.

When you enter a joining code

We check the code in the app and never store, log or show the code you typed. To slow down guessing, we count attempts for your account, for a one-way hash of your network address and across everyone, for up to an hour. Our audit trail records each attempt: whether it was accepted, why it was refused, the name of the code if one matched, and a short keyed hash of your network address. Only CalAlign holds the key, and it changes every month. Attempts made before you belong to an organisation are recorded under your pseudonym, and erasing your data destroys that pseudonym's key too. When a code is accepted, we record its name, the organisation and when it was used.

When your organisation pays

Payments go through Stripe. When an owner or administrator subscribes, Stripe’s own payment pages collect the payer’s name, email address, billing address, tax number if they give one, and card or other payment details. CalAlign never sees or stores card numbers. CalAlign sends Stripe the number of users to bill, a random billing reference that does not name your organisation, and an owner’s email address, when the sign-in provider verified it, to fill in the form. Stripe handles payment details under its own privacy policy.

From Stripe, CalAlign keeps the identifiers of your organisation’s Stripe customer and subscription, the subscription’s status, renewal date and whether it is set to cancel, the number of users billed, the trial dates, and the notices Stripe sends us about the subscription (their identifiers, types and times). We use these to show the billing page and to decide whether your organisation has full or read-only access.

When your organisation becomes read-only, we also record when that started, when we sent a deletion notice and the date set for the deletion, as described in Organisations that stay read-only.

From the calendar accounts you connect

When you connect a Google, Microsoft or iCloud account, we keep:

• the account’s email address or username and the provider’s identifier for it, so a reconnect updates the same connection, and so you can see which account is which;
• the permissions you granted;
• the list of calendars in that account (names, colours, whether each is your primary calendar and what access you have to it) and which ones you chose to sync or to receive busy blocks;
• for Google and Microsoft, a refresh token, which lets CalAlign keep reading your calendars after you close the browser;
• for iCloud, the app-specific password you created for CalAlign (never your Apple ID password);
• the times of the last successful sync and of the last error, and a fixed error code, never the provider’s error text.

From your calendars

For each calendar you choose to sync, CalAlign reads its events and keeps a copy of: the start and end times and time zone, whether the event is all-day, busy or free, cancelled or tentative, the title, the description (for Microsoft, the short preview Microsoft provides), the location, the organiser’s email address (Google and Microsoft), your own answer to the invitation, the event’s visibility and colour, and its repeat rules and exceptions. We do not copy the guest list of events we read. We use the copy to work out when you are busy, to show your events together in the app, to check booking-link availability and to detect conflicts.

When you turn on busy blocks for a calendar, CalAlign writes events into it. By default each block carries only the word “Busy” and its times. You can choose to copy the title, location or description of the original event as well. A booking made through your booking link is written into the calendar you choose, with the link’s title and the name of the person who booked.

When you use the app

We keep what you set up in CalAlign: protection setups and their history, booking links and their settings, events you create in CalAlign, team templates, and, for organisation owners, the organisation’s policy. We also keep a list of your active sign-in sessions (when each started, was last used and expires, and whether it used multi-factor sign-in) so you or an administrator can end one.

From people who book through a booking link

When you book a meeting through someone’s CalAlign booking link, we collect your name, your email address and the time you chose. The person who shared the link sees them. Your name goes into the meeting in their calendar; your email address does not. We send you no email: the confirmation page gives you a private link to reschedule or cancel, and we store only a fingerprint (a one-way hash) of that link, never the link itself. While you are choosing a time, we keep a one-way hash of your network address for the few minutes a held time lasts, so one visitor cannot hold every slot. We never keep the address itself.

When you contact us

If you email us, we keep your message, your email address and our reply so we can help you and follow up.

When you visit this website

This website runs no scripts, sets no cookies, and loads nothing from other companies: its font is served from calalign.com. Like every website, the server that delivers a page receives your IP address, the page you asked for, your browser’s user agent and the address of the page that linked you here. Our hosting provider uses these to deliver the page and protect the site from abuse, and may keep them in its logs for a short time.

Information about other people

Your calendars can contain information about other people, such as the email address of the person who organised a meeting or a name in an event title. We collect it from your calendar, not from them, and use it only to provide CalAlign to you. It is never used to contact them, and it is deleted on the same schedule as the rest of your calendar data. If you are one of those people and want to know what we hold, or want it corrected or removed, email privacy@calalign.com.

How we use it

We use personal information to:

• sign you in, keep your session secure and apply your organisation’s rules;
• create your organisation, run invitations and requests to join, and show owners and administrators who belongs to it;
• check joining codes and limit how fast anyone can guess them;
• bill your organisation for its users through Stripe, and work out whether it has full or read-only access;
• send service emails: requests to join to an organisation’s owners and administrators, a message to you when your request is approved, and notices before an organisation’s data is deleted, which go to its owners and administrators;
• read the calendars you chose and keep the busy blocks in your destination calendar matching your commitments;
• check that the blocks are still there, compare your calendar’s free/busy answer with what we expect, and repair gaps;
• offer times on your booking links, write booked meetings into your calendar and flag new conflicts with them;
• show you, and your organisation’s administrators, whether each connection is healthy;
• keep an audit trail of changes to settings, connections and data, for security and accountability;
• measure how the service performs (counts and timings, with no personal information in them);
• answer your messages and requests;
• prevent abuse, investigate security incidents and meet our legal obligations.

We send no marketing email. Our service emails go through Resend, which receives each recipient’s email address and the message. A request to join names the person and gives their email address, and every service email names the organisation. They contain no calendar information.

We do not use your information for anything unrelated to these purposes without asking you first.

Information we receive from Google

CalAlign's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

CalAlign asks Google for: your basic account identity (to recognise the account), read-only access to your calendar list (so you can choose calendars), read-only access to events on your calendars (to work out when you are busy), and, only if you turn on busy blocks for a Google calendar, access to create, change and delete events (so CalAlign can manage its own busy blocks and booked meetings). In plain terms, for everything we receive from Google:

• we use it only to provide and improve the CalAlign features you can see and use;
• we transfer it to others only when that is needed to provide those features, to comply with the law, or as part of a merger, acquisition or sale of our business, and in that last case only after asking for your explicit consent;
• we never use or transfer it for advertising, including retargeting and personalised or interest-based ads;
• we never sell it, and never use it to decide anyone’s creditworthiness or for lending;
• no person at CalAlign reads it, unless you give us your explicit permission for specific events (for example, when you ask for help), it is needed for security purposes such as investigating abuse, it is needed to comply with the law, or it has been aggregated and anonymised for our internal operations;
• we never use it to develop, improve or train artificial intelligence or machine learning models.

You can remove CalAlign’s access at any time by disconnecting the account in the app, which also asks Google to revoke our access, or at myaccount.google.com/permissions.

Information we receive from Microsoft and Apple

We hold the information we receive through Microsoft Graph (for Microsoft 365 and Outlook.com calendars) and through iCloud to the same rules as Google information: we use it only to provide CalAlign’s features to you, never for advertising, never sell it, never use it to train AI models, and people at CalAlign read it only in the same limited cases. From Microsoft we ask for your basic profile and mailbox address, read access to your calendars, offline access (so syncing continues when you are away), and read and write access only if you turn on busy blocks for a Microsoft calendar. For iCloud, CalAlign uses the app-specific password you give it only to reach your calendars.

When you disconnect a Microsoft account we delete the access we stored. Microsoft keeps your consent until you remove CalAlign under the apps with access in your Microsoft account settings. When you disconnect iCloud we delete the app-specific password; to revoke it at Apple as well, delete it at appleid.apple.com.

Who can see it and who we share it with

We do not sell personal information. We share it only as follows.

• Your organisation. If you sign in with a work or school account, your organisation’s owners, administrators and auditors see its member list: your name, email address and role, and when you asked to join, joined and last signed in. Owners and administrators can see the health of your calendar connections (provider, status, dates and counts of calendars), but not your calendar names, your events or the full addresses of your connected calendar accounts. They can end your sessions, set rules for which providers may be connected, read the audit trail and ask for your data to be erased. If your organisation’s owner turns on delegated writes, an administrator can add or change events in a calendar you connected. They still cannot read your events through CalAlign, and each such write is recorded in the audit trail.
• People who book with you. Your booking page shows the times you are available, never what you are doing at other times.
• Your calendar providers. CalAlign sends busy blocks and booked meetings to the calendars you chose, and those providers handle them under their own privacy policies.
• Stripe. Stripe takes payments for us, as described in When your organisation pays. For the payment details you enter on its pages, Stripe also acts under its own privacy policy.
• Our service providers. The companies in the list below store or process information for us. They may use it only to provide their service to us.
• Webhooks your organisation sets up. If your organisation connects CalAlign to an automation tool, CalAlign sends that tool notices of syncs, policy changes, connection health and booking conflicts. These notices contain identifiers, counts and times, never event details.
• When the law requires it. We disclose information when a New Zealand law, court order or other legal process requires it, or when it is needed to prevent a serious threat to someone’s life, health or safety. We will tell you about a request unless the law prevents us.
• If our business changes hands. If CalAlign is sold or merged, personal information may pass to the new owner under this policy. For Google information we will first ask for your consent, as described above.

Our service providers

We update this list before a new provider starts processing personal information for us.

Where your information is stored

The CalAlign app, its database, its encryption keys and its service logs are in Google Cloud’s Sydney region in Australia. This website is delivered through a content delivery network, which serves pages from locations near each visitor around the world. Requests to the app and its answers, including your sign-in session, calendar details and booking details, pass through Google’s Firebase Hosting network on their way to and from Sydney, so they are handled at the network location nearest you. The app marks its pages and answers so that network does not store copies of them.

Google Cloud stores and processes this information for us as our agent, so under section 11 of the Privacy Act 2020 we still hold it and remain responsible for it. Google may not use it for its own purposes. Its staff may reach it from other countries for support and security, under the security and confidentiality commitments in its contract with us. Where we disclose personal information to someone overseas who does not act only for us, we do so only when the information privacy principles allow it, for example when the recipient is subject to privacy laws that give comparable protection to New Zealand law, or when you have authorised it after we told you it may not be protected in the same way.

Billing and email are the exceptions to Sydney. Stripe handles billing information on its systems in the United States and other countries. CalAlign sends it only what billing needs, listed in When your organisation pays, and no calendar information. Resend, a United States company, sends our service emails and receives the email you send to our calalign.com addresses through its Tokyo region, and keeps them on its systems.

How we protect it

• All traffic to the app and this website is encrypted in transit (HTTPS).
• Refresh tokens and app passwords are encrypted with AES-256-GCM, each under its own data key, and those keys are protected by Google Cloud Key Management Service. Only one internal CalAlign service can decrypt them, and the other services receive short-lived access tokens instead.
• The database runs on Google Cloud, which encrypts stored data and backups. The copies of your events in our database are protected by that storage encryption and our access controls; they are not separately encrypted by CalAlign.
• Event titles, descriptions and locations, tokens, passwords and consent codes are never written to our logs, metrics or audit trail.
• The audit trail identifies people by pseudonyms and links its entries in a hash chain, so a changed or removed entry shows up when the chain is checked.
• Your sign-in session is held in a cookie that page scripts cannot read and that is never sent to other sites.
• Only the people who run CalAlign can reach production systems, and only when they need to.

Security incidents can still happen. If one affects your information, we will follow the steps in Privacy breaches.

How long we keep it

We keep personal information only while we need it for the purposes in this policy. These are the periods CalAlign applies today.

Deleted information can remain in database backups until those backups expire, which happens within 35 days. We do not restore information from a backup into the live service except to recover from an incident, and if we do, we delete again anything you had asked us to delete.

Organisations that stay read-only

If your organisation stays read-only for 90 days in a row (no trial, no paid-up subscription and no fee waiver), we email its owners and administrators a notice, and everyone in the organisation sees it in the app. The notice gives the date we will delete the organisation’s data, 30 days later. If someone subscribes or pays the overdue invoice before then, or we waive its fees, nothing is deleted. We delete nothing unless the notice reached at least one owner or administrator by email. This does not apply to organisations we set up with you during early access. Only CalAlign can pause a deletion, for example while the law requires the data to be kept. If that applies to your organisation, email support@calalign.com before the date in the notice.

On the date in the notice we delete the organisation’s member list, invitations and requests to join, calendar connections and stored access, copies of events, settings, protection setups, booking links and bookings, sessions, webhooks, performance metrics and billing records. We destroy every key that links the organisation’s audit trail entries to people, so those entries can no longer be connected to anyone. We keep a record that the organisation was deleted: its CalAlign identifiers, the kind of account it was, its Stripe customer and subscription identifiers and the dates, with no names or email addresses. Stripe keeps the invoices, as tax law requires.

Cookies and browser storage

This website sets no cookies. The CalAlign app uses only what it needs to sign you in and work:

• __session: the app's only cookie. It holds your sign-in session, which lasts until the session expires and is deleted when you sign out. While you sign in, it also holds the values that protect the round trip with your provider; those last at most 10 minutes and are deleted as soon as sign-in finishes. While you sign up, it holds your sign-up token for at most 30 minutes, and if you opened an invitation link, it holds that invitation until you use it or it expires, at most 7 days later. Page scripts cannot read this cookie, and it is never sent to other sites.
• Browser storage: the app remembers your display preference, and keeps your place in the setup steps for the current tab only.

We use no advertising, analytics or tracking cookies, on this website or in the app. Stripe’s payment and billing pages are on Stripe’s own website and set Stripe’s cookies, under Stripe’s privacy policy.

Your rights

Under the Privacy Act 2020 you can ask us whether we hold personal information about you, ask to see it, and ask us to correct it. You can also ask us to delete it. Email privacy@calalign.com from the address involved, or tell us how to recognise you, and we may ask you to confirm who you are before we act. Requests are free. We will reply as soon as we can and within 20 working days, and if we cannot do what you ask we will tell you why. If we do not correct information you asked us to correct, you can ask us to attach a statement of the correction you sought.

You can do several things yourself in the app:

• see and change the calendars CalAlign syncs or writes to;
• disconnect an account, which removes the busy blocks CalAlign wrote, deletes the stored access and removes the copies of that account’s events;
• delete protection setups and booking links;
• see and end your sign-in sessions.

If you ask us to delete everything, we delete your connections, stored access, copies of your events, settings, sessions and booking links, remove you from your organisation’s member list and delete invitations sent to your email address, and remove the names and email addresses of people who booked with you. Audit trail entries are kept so the record stays complete, but we destroy the key that links them to you, so they can no longer be connected to you. Your organisation’s billing records hold no card details and stay with the organisation. We keep only what the law requires us to keep.

If you live outside New Zealand

Wherever you live, you can ask us to: give you a copy of your personal information, including in a machine-readable format (JSON); correct it; delete it; limit how we use it while a question about it is resolved; and stop using it for a purpose you object to. Where we rely on your consent, such as your permission for CalAlign to read a calendar, you can withdraw it at any time by disconnecting the account. Use the same address, privacy@calalign.com. You can also complain to the data protection authority where you live.

If laws such as the European Union or United Kingdom GDPR apply to you, the legal grounds we rely on are: to perform our contract with you (running the service you signed up for); your consent (access to each calendar account you connect); our legitimate interests in keeping the service secure, preventing abuse and keeping an audit trail, which we balance against your rights; and compliance with legal obligations.

If your organisation manages your account

When an organisation sets up CalAlign for its staff, the organisation decides how CalAlign is used for its members, and its administrators can take the actions described in Who can see it. We handle that information on the organisation’s behalf. You can still contact us directly, and if a request is for your organisation to decide, we will pass it on and tell you.

Privacy breaches

If a privacy breach involving your information has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and tell you as soon as practicable, as Part 6 of the Privacy Act 2020 requires. We will tell you what happened, what information was involved, what we are doing about it and what you can do. Where another country’s law sets a shorter deadline, such as 72 hours to a regulator under the GDPR, we meet it.

Children

CalAlign is not for anyone under 16, and we do not knowingly collect personal information from children under 16. If you believe a child under 16 has given us personal information, email privacy@calalign.com and we will delete it.

Complaints

If you are unhappy with how we have handled your personal information, please tell us first at privacy@calalign.com, and we will try to put it right. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner (privacy.org.nz), New Zealand’s privacy regulator. If you live outside New Zealand you can also complain to your local data protection authority.

Changes to this policy

We will update this policy when CalAlign or the law changes. The effective date at the top shows when it last changed, and we keep earlier versions so you can ask to see them. If a change affects how we use information we already hold, we will tell you in the app or by email before the change takes effect.

Contact us

CalAlign, New Zealand. Privacy questions and requests: privacy@calalign.com. Anything else: support@calalign.com.