Privacy Policy

1. Scope

This Privacy Policy applies only to the hosted version of Thirty available at thirtycalendar.com. If you deploy or self-host the open-source Thirty software, you are solely responsible for your own privacy practices, and this Privacy Policy does not apply to your deployment.

2. Information We Collect

We collect two types of information when you use the hosted Service:

• **Voluntarily provided information**: Data you provide directly, such as when creating an account, booking meetings, or contacting support.
• **Automatically collected information**: Data sent by your device, such as IP address, browser type, operating system, and usage statistics.

3. Google User Data (Read-Only / One-Way Sync)

When you connect your Google account, Thirty requests only the minimum Google data necessary to display and sync your calendar events into our product. Typical data accessed includes:

• Your Google email address and basic profile.
• Your list of Google Calendars.
• Event metadata (title, start/end time, description, attendees, location, etc.).

**Important:** Thirty only *reads* your Google Calendar data to keep your Thirty calendar in sync. We do not create, modify, or delete events in your Google Calendar — syncing is one-way from Google to Thirty.

We only request the OAuth scopes required for read access (for example, the Google Calendar read-only scope). Any use and transfer of Google data adheres to the

and the Limited Use requirements.

Human access to Google user data is disallowed by default and is only permitted with explicit in-app user consent or when strictly necessary for security, debugging, or to comply with a valid legal request. All such access is logged and audited.

4. How We Use Your Information

We use collected information to:

• Provide and improve the core features of the Service.
• Personalize your experience.
• Communicate with you regarding support, updates, or legal matters.
• Comply with legal obligations and ensure security.

5. Data Sharing & Disclosure

We do not sell or rent your Google user data to third parties. Your Google Calendar data is only used internally to provide the Service and to improve your experience.

We may share your data only in the following cases:

• With our service providers who perform functions on our behalf, such as hosting, analytics, or security, and who are bound by confidentiality obligations.
• To comply with legal obligations, enforce our terms, or protect rights, property, or safety.

We do not share your Google Calendar events with advertisers or other external parties.

6. Data Security

We implement commercially reasonable measures to protect your information, including encrypting Google user data in transit (TLS 1.3) and at rest (AES-256). However, no method of electronic storage is 100% secure.

7. Retention of Data

We retain personal information only as long as necessary to provide the Service or comply with legal obligations. You may disconnect Google access at any time via

or by using the "Disconnect" option in Thirty settings.

8. Children's Privacy

Thirty is not directed to children under 13, and we do not knowingly collect personal information from them.

9. Your Rights

Depending on your location, you may have rights to access, correct, download, or delete your personal data. You can exercise these rights by contacting us at

10. International Data Transfers

Your data may be processed in countries other than your own. We take appropriate measures to protect your information in accordance with applicable data protection laws.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through email or in-app notification, and where required, we will seek your consent.

12. Contact Us

If you have questions about this Privacy Policy, contact Thirty at