Easy Calendar Tracker (easycalendartracker.com, “the app”) is an invoicing tool that turns your Google Calendar into a timesheet. It is operated by Twelve Tone Creative (“we”). You sign in with your Google account. Questions or requests: info@easycalendartracker.com.
Information the app accesses
- Google account profile — your name, email address, and profile picture, used to sign you in.
- Google Calendar data — the list of your calendars, and the events (titles, dates and times, attendee email addresses, and event links) on the calendars you select inside the app.
How that information is used
- Displaying your events, grouping them by project, and computing hours and totals.
- Drafting invoices you explicitly initiate.
- Writing to your calendar happens in exactly two cases, both started by you on a single event inside the app: when you rename an event, the new title is saved back to that event in Google Calendar; when you change an event’s length, its end time is moved (the start time is never changed). The app never creates or deletes events.
What is stored, and where
- Your settings — tracked project codes, hourly rates, invoiced-event IDs, selected calendar IDs, event-scope preference, and billing start date — are stored in Cloudflare KV, keyed to your Google account ID, so they sync across your devices.
- Your calendar events are not stored on our servers. They are fetched from Google on demand. Your own browser keeps a local cache of the last fetch (and a copy of your settings) on your device for fast loading. In the iPhone app, calendar events are stored on your device only if you turn on offline calendar data in Settings; your settings are cached on the device either way.
- Google authentication tokens live in an encrypted session cookie in your browser (or, in the iPhone app, in the device keychain). They are not stored on our servers.
- Mercury connection— only if you choose “Connect Mercury,” the read-only access tokens Mercury issues for your account are stored in Cloudflare KV, encrypted with a key held outside the database and keyed to your Google account ID. They are deleted when you disconnect Mercury or delete your account. The app does not store your Mercury balances, account numbers, or transactions.
What is shared
We do not sell your data, show ads, or use analytics or tracking. Your data is handled only by the services required to run the app:
- Google — the source of your account and calendar data.
- Cloudflare — hosts the app and stores the settings described above.
- Mercury— only if you choose “Connect Mercury,” the app reads the name of the business on your Mercury account to show which account is connected; nothing is changed in Mercury. Where invoice drafting via Mercury is available, the line items you select (event dates, cleaned titles, hours, and rates) are sent to Mercury only when you click “Draft via Mercury,” to create an unsent draft invoice. Mercury is a fintech company, not an FDIC-insured bank. Banking services provided through Choice Financial Group and Column N.A., Members FDIC.
Google user data — Limited Use
Easy Calendar Tracker’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the user-facing features described above — never for advertising, and never transferred except as necessary to provide those features, to comply with law, or as part of a merger or acquisition with prior notice to you.
Retention and deletion
- Your synced settings are kept until you ask us to delete them — email info@easycalendartracker.com and they will be removed.
- You can revoke the app’s access to your Google account at any time at myaccount.google.com/permissions; the app then has no access to your calendar data.
- “Disconnect Mercury” (in the app, next to the Mercury connection) revokes the app’s access at Mercury and deletes the stored connection immediately. Deleting your account does the same.
- The on-device cache is removed by clearing this site’s data in your browser. In the iPhone app, turning off offline calendar data (or signing out) removes it.
How your data is protected
Security procedures are in place to protect the confidentiality of your data, including your Google user data and calendar data:
- Encryption in transit — all traffic between your browser, our servers, and Google is encrypted with HTTPS/TLS. The app is served exclusively over HTTPS.
- Encryption at rest — the settings stored in Cloudflare KV are encrypted at rest by Cloudflare.
- Sensitive data minimization — your calendar events are processed in memory only to answer your request and are never written to server-side storage. Google OAuth tokens live only in an encrypted session cookie in your browser (or the iPhone keychain). Mercury tokens, if you connect Mercury, are stored encrypted with a separate key, are used only to serve your own requests, and are deleted on disconnect.
- Access controls — every application API route requires your authenticated session. Your synced settings are keyed to your Google account ID and are only ever returned to your own signed-in session. Administrative access to the hosting and storage accounts is restricted to the operator.
- Incident notification — if we become aware of a security breach affecting your data, we will promptly notify affected users at their account email address and take steps to contain it.
Cookies
The app uses only the cookies required for sign-in (encrypted session cookies) — no third-party or tracking cookies.
Changes
If this policy changes materially, the effective date above will be updated and notice will be posted on this page.