Privacy policy

1. Controller

Letting Go Coaching Michael Schmid
Schlossgasse 2
86857 Hurlach, Germany
Email: info@embodied.de

JamDay is a private, non-commercial project in its test phase.

2. What data we process and why

When you create a meetup: the meetup name, date range, times of day, duration, place, and your browser's time zone and language (so times and texts are correct). There are no accounts; access works through a secret admin link.

When you join a vote: the name you enter, your starting point (as text and coordinates) and the times you tap. The starting point is only used to estimate travel time and to find a fair meeting spot; other participants never see it, only the estimated travel time in minutes.

Legal basis is Art. 6(1)(b) GDPR (using the feature you asked for) and, for calendar connections, your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time.

3. Google Calendar (optional)

You can connect your Google Calendar. Through Google you grant the scopes calendar.freebusy and calendar.calendarlist.readonly. This only lets us see when time is busy in your calendars, not titles, places, attendees or any other details.

We use the calendar list only to find all calendars you own (e.g. personal and work) so the search is complete. Subscribed calendars such as holidays or other people's calendars are ignored. We don't store your calendar names. If you untick this permission at Google, we only read your primary calendar.

We store a permission (refresh token) encrypted. Busy times are fetched fresh for each search, used only for that calculation and not stored. Nobody is shown them; others only see whether you can make a suggested date.

You can disconnect at any time in the app ("Disconnect calendar"). We then delete the stored permission and revoke it at Google. You can also remove access at myaccount.google.com/permissions.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't share this data, don't use it for advertising and don't use it to train AI models.

4. Outlook / Microsoft calendar (optional)

You can connect your Outlook calendar (Outlook.com, Hotmail or Microsoft 365). Through Microsoft you grant the permission Calendars.Read. Microsoft doesn't offer a pure free/busy permission for personal accounts. Technically this would let us read your appointments; we only request start, end, the free/busy status and "all day" from calendars you own. We don't request titles, places, attendees or contents.

We store a permission (refresh token) encrypted. Busy times are fetched fresh for each search and not stored. "Disconnect calendar" deletes the stored permission; you can also remove access in your Microsoft account at account.live.com/consent/Manage (personal) or myapps.microsoft.com (work account).

5. Apple Calendar via a shortcut (optional)

For Apple devices there is a shortcut (Shortcuts app) that you install and run yourself. It reads appointments on your device and sends us only their start and end. Titles, places, attendees and other details never leave your device. All-day entries are not sent.

We keep only the times within the meetup's date range and store them encrypted so the search can use them. Sending again replaces the old data. Others don't see the times, only whether you can make a suggested date. "Disconnect calendar" deletes them immediately; otherwise they are deleted with the meetup (see retention). We never get a password or access to your Apple account.

6. Services we use

• Vercel Inc. (USA) runs the app's servers (hosting). Technically necessary data such as IP address and time of access are processed. Transfers to the USA are based on the EU-US Data Privacy Framework or standard contractual clauses.
• Upstash Inc. stores the app's data in a database in Frankfurt am Main, Germany.
• Photon (komoot GmbH), a search service based on OpenStreetMap, is used for place search and venue suggestions. Our server sends your search text or the coordinates of the middle, not your IP address.
• Microsoft: only if you connect your Outlook calendar (see above).
• Google: only if you connect your calendar (see above). Links to Google Maps only open Google Maps when you tap them; Google's privacy policy then applies.

7. Cookies and browser storage

We only use technically necessary cookies: one for your chosen language (valid for one year), one briefly while signing in with Google or Microsoft (10 minutes), and one for the operator's internal statistics. Your browser also keeps a local list of your meetups so you can find them again; this list never leaves your device. There is no advertising and no analytics or tracking.

8. Retention

All data of a meetup is deleted automatically 6 months after the last change. You can ask for earlier deletion by email at any time.

9. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and you can withdraw consent at any time. Write to info@embodied.de. You can also lodge a complaint with a data protection supervisory authority.