This product collects the minimum needed to run a personal booking page: owner account details, schedules, event types, and guest name, email, timezone, and optional answers.
What we store
- Owner identity via Better Auth (email, password hash or Google sign-in).
- Public profile (handle, name, bio, timezone) and booking rules.
- Appointments, including location snapshots used for invitations.
- Optional Google Calendar credentials, encrypted at rest with a versioned server key.
- Delivery metadata (queued, accepted, bounced) without message bodies in logs.
What guests see
Public pages show published event details and available times. Private meeting URLs, telephone numbers, and addresses are shown only to the booked guest (management link and confirmation email) and the owner. Unauthenticated calendar downloads stay redacted.
Retention
- Temporary holds last 90 seconds; booking attempts expire within a day. Expired OAuth state and management links are removed by scheduled cleanup.
- Booking history is removed 365 days after the appointment ends. Completed delivery records, queued-message payloads in terminal states, webhook metadata, and audit logs are removed after 90 days. Active delivery work is retained until resolved.
- Account deletion immediately disables your page and management links. Background cleanup cancels upcoming appointments, removes guest contact details and private meeting information from booking records and queued messages, and disconnects calendars. Limited operational records and provider backups may remain.
Export and deletion
Owners can download a JSON export and delete their account from Settings. Deletion requires typing your handle, followed by password verification or a Google sign-in within the last five minutes. Calendar cancellation delivery is attempted before disconnecting; if the provider is unavailable, a calendar copy may remain.