Easy Calendar Tracker (easycalendartracker.com, “the app”) is an invoicing tool that turns your Google Calendar into a timesheet. It is operated by Twelve Tone Creative (“we”). You sign in with your Google account. Questions or requests: info@easycalendartracker.com.
Information the app accesses
- Google account profile — your name, email address, and profile picture, used to sign you in.
- Google Calendar data — the list of your calendars, and the events (titles, dates and times, attendee email addresses, and event links) on the calendars you select inside the app.
How that information is used
- Displaying your events, grouping them by project, and computing hours and totals.
- Drafting invoices you explicitly initiate.
- Writing to your calendar happens in exactly two cases, both started by you on a single event inside the app: when you rename an event, the new title is saved back to that event in Google Calendar; when you change an event’s length, its end time is moved (the start time is never changed). The app never creates or deletes events.
What is stored, and where
- Your settings — tracked project codes, hourly rates, invoiced-event IDs, selected calendar IDs, event-scope preference, and billing start date — are stored in Cloudflare KV, keyed to your Google account ID, so they sync across your devices.
- Your calendar events are not stored on our servers. They are fetched from Google on demand. Your own browser keeps a local cache of the last fetch (and a copy of your settings) on your device for fast loading. In the iPhone app, calendar events are stored on your device only if you turn on offline calendar data in Settings; your settings are cached on the device either way.
- Authentication tokens live in an encrypted session cookie in your browser. There is no server-side database of tokens or users.
What is shared
We do not sell your data, show ads, or use analytics or tracking. Your data is handled only by the services required to run the app:
- Google — the source of your account and calendar data.
- Cloudflare — hosts the app and stores the settings described above.
- Mercury— only if you click “Draft via Mercury,” the line items you selected (event dates, cleaned titles, hours, and rates) are sent to Mercury to create a draft invoice in the operator’s Mercury account.
Google user data — Limited Use
Easy Calendar Tracker’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the user-facing features described above — never for advertising, and never transferred except as necessary to provide those features, to comply with law, or as part of a merger or acquisition with prior notice to you.
Retention and deletion
- Your synced settings are kept until you ask us to delete them — email info@easycalendartracker.com and they will be removed.
- You can revoke the app’s access to your Google account at any time at myaccount.google.com/permissions; the app then has no access to your calendar data.
- The on-device cache is removed by clearing this site’s data in your browser. In the iPhone app, turning off offline calendar data (or signing out) removes it.
How your data is protected
Security procedures are in place to protect the confidentiality of your data, including your Google user data and calendar data:
- Encryption in transit — all traffic between your browser, our servers, and Google is encrypted with HTTPS/TLS. The app is served exclusively over HTTPS.
- Encryption at rest — the settings stored in Cloudflare KV are encrypted at rest by Cloudflare.
- Sensitive data minimization — your calendar events are processed in memory only to answer your request and are never written to server-side storage. OAuth tokens live only in an encrypted session cookie in your browser; there is no server-side database of tokens.
- Access controls — every application API route requires your authenticated session. Your synced settings are keyed to your Google account ID and are only ever returned to your own signed-in session. Administrative access to the hosting and storage accounts is restricted to the operator.
- Incident notification — if we become aware of a security breach affecting your data, we will promptly notify affected users at their account email address and take steps to contain it.
Cookies
The app uses only the cookies required for sign-in (encrypted session cookies) — no third-party or tracking cookies.
Changes
If this policy changes materially, the effective date above will be updated and notice will be posted on this page.