Privacy Statement

Effective date: 12 October 2026

Who we are and how to contact us

FINDaTIME is a scheduling poll service at https://findatime.group (the "Service"). It is a service by FINDaTIME.group ("we", "us"). Questions, requests and complaints about personal data go to help@findatime.group.

What we collect

Poll creators (people who sign in with Google):

Your name, email address and Google account identifier, received from Google when you sign in.
The polls you create: title, description, meeting length, timezone, proposed time slots, and the names and email addresses of the participants you add.
If you connect Google Calendar: an encrypted refresh token for that grant (see "How we use Google user data" below). We do not store Google access tokens.
A record of when you sent invitation emails, used to enforce the daily sending limit.
When you schedule a poll: the chosen slot, the Google Calendar event id and link, and the time it was scheduled.

Participants (people who vote through a link):

The name and email address the poll creator entered for you.
The votes you submit.
A private voting token that identifies you within one poll, and the time an invitation email was last sent to you.
Participants do not sign in and we collect no Google data from them.

Automatically:

A session cookie that keeps a poll creator signed in (see "Cookies").
Server request logs: method, path, response status and duration of API requests. The web server in front of the application keeps standard access logs, which include IP addresses.
If advertising is switched on, Google AdSense collects data as described under "Advertising". We use no analytics trackers.

How we use Google user data

Signing in uses Google through Firebase Authentication. It identifies you and gives us your name, email address and account identifier. It grants nothing else.

Calendar access is a separate, optional grant that you make once, when you first use a calendar feature. It asks for these permissions and we use each only as follows:

Confirm your identity (openid, email). Used to check that the Google account granting calendar access is the same account you signed in with. Nothing is stored from this beyond the email address we already hold.
See your free/busy information (calendar.freebusy). While you create a poll, and only when you ask, we query the busy periods of your primary calendar for the dates you selected, to show which proposed slots clash with existing commitments. We receive only the start and end times of busy periods, never event titles, descriptions, guests or locations. Busy periods are shown to you on screen and are not stored.
Create and manage events you own (calendar.events.owned). When you choose the winning slot and ask us to schedule it, we create one event for that meeting on your primary calendar, with a Google Meet link, and add the poll's participants as attendees. We do not read, change or delete your other events.

We keep the refresh token from the calendar grant, encrypted (AES-256-GCM) with a key held only on the server, so calendar features keep working after the first hour. Short-lived access tokens are minted when needed and never stored. If you disconnect your calendar in the Service, we delete the token and ask Google to revoke the grant. You can also revoke it yourself at myaccount.google.com/permissions.

Limited Use. FINDaTIME's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not sell Google user data, do not use it for advertising or to decide which advertisements you see, do not use it to develop or train artificial intelligence or machine learning models, and do not allow people to read it except with your consent, for security purposes, or to comply with the law. Google user data from sign-in and calendar access is never shared with Google AdSense or any other advertising system.

Invitation emails

When a poll creator asks us to, we email each participant a private voting link. The email is sent through a third-party email sender operated by the same operator as this Service. It carries the creator's name and email address (as the sender name and reply-to address), the poll title and description, and the participant's name and email address. The number of invitation emails one creator may send per day is capped, and repeat emails to the same participant are rate-limited.

Calendar events

Scheduling a poll creates a Google Calendar event on the creator's calendar with every participant of that poll as an attendee, and Google sends them calendar invitations. As with any calendar invitation, attendees can see each other's email addresses in that event. The poll creator is responsible for only adding participants who may be invited together.

Cookies

Session cookie (findatime.sid): set when a poll creator signs in, keeps them signed in for up to 30 days, and is marked HttpOnly and Secure. The session itself is stored in our database. It is essential to the Service and is not used for tracking. Participants who only vote do not receive it.
Advertising cookies: if advertising is switched on, Google AdSense and its partners may set cookies and read device identifiers on pages that show advertisements, as described under "Advertising".

Advertising

We may show advertisements served by Google AdSense on the voting page, the poll creation page and the dashboard. Google, as a third-party vendor, uses cookies and similar technologies to serve ads based on your visits to this and other websites. If you are in the European Economic Area, the United Kingdom or Switzerland, personalised ads are shown only with your consent, which Google's consent message asks for and which you can change at any time through the "Privacy and cookie settings" link in the page footer.

You can opt out of personalised advertising at Google's Ads Settings.
How Google uses data from sites that use its services is described at policies.google.com/technologies/partner-sites.
No poll data, no participant data and no Google user data from sign-in or calendar access is given to the advertising system. Advertisements are never shown on this page, the Terms page or the sign-in page.

Browser extension

The FINDaTIME extension for Chrome adds a side panel in which a signed-in poll creator can see their polls and results, schedule a time, change a poll's deadline or location, delete a poll and start a new one. It is another way of using the Service, so the rest of this statement applies to it. In addition:

What it accesses. Only your own FINDaTIME account at https://findatime.group, through the sign-in you already have in the same browser. It relies on the session cookie described under "Cookies" and has no sign-in of its own. Signing in, voting, connecting Google Calendar and sending invitations stay on the website, which the extension opens in a normal tab.
Where it sends data. The extension exchanges data with https://findatime.group and with no other server. What it sends is what the website sends for the same action, such as the details of a new poll or a changed deadline.
What it stores on your device. A poll you have started but not yet created is saved as a draft in the browser's local extension storage, so that closing the panel does not lose it. The draft holds what you entered in the form, including the title, description, dates, time slots, location, and the names and email addresses of the participants. It is kept on your device only and is removed when you create the poll or discard the draft. The extension stores nothing else.
What it does not do. It does not read the pages you visit, your browsing history or your open tabs. It shows no advertisements and contains no analytics trackers, and it runs only the code in the installed package.

Limited Use. The extension's use of the data it handles adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. That data is used only to provide the features described above. It is not sold, not used for advertising, and not passed to anyone other than as described under "Third parties".

Third parties

We do not sell or rent personal information. It is shared only with:

Google (Firebase Authentication, Google Calendar API, Google Meet): to sign you in and to perform the calendar actions you request.
Our email sender: a separate service run by the same operator that delivers invitation emails through Gmail, receiving the sender and recipient details and the message text.
Amazon Web Services: hosts the server and database that run the Service, in the European Union (Paris region).
Google AdSense: serves advertisements, if switched on, as described above.
Anyone we are required by law to share it with.

Within a poll, the creator sees participants' names, email addresses and votes. A participant voting through their link sees only the poll, their own votes and aggregate vote counts; they do not see other participants' names, email addresses or voting links.

Retention and deletion

Poll data is kept for as long as the poll exists. Creators can delete any of their polls from the dashboard at any time; deleting a poll permanently deletes its time slots, participants and votes.
The record of invitation emails sent (date and sending account only) is kept for the lifetime of the account.
Session records expire 30 days after sign-in and are deleted when you sign out.
There is no self-service account deletion. To delete your account and all associated data, email help@findatime.group from the address you signed in with.
If you were added to a poll as a participant and want your name, email address and votes removed, email help@findatime.group with the poll title or your voting link so we can find the record. You never signed in, so we may ask you to confirm from the email address the poll holds.
We aim to complete deletion requests within 30 days. Deleted data may persist in database backups for a further period until those backups are overwritten.

Security

All traffic to the Service is encrypted with HTTPS. Google Calendar refresh tokens are encrypted at rest and never sent to the browser. Session cookies are HttpOnly and Secure. Poll details and results are available only to the signed-in creator of the poll; voting pages are reachable only through each participant's private token. Database backups are taken manually by the operator. No system is perfectly secure and we hold no security certification; if you believe data has been exposed, contact us at the address above.

Children

The Service is not directed at children under 13 and we do not knowingly collect their information. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes

We will post any changes to this statement on this page and update the effective date above. Continued use of the Service after a change means you accept the updated statement.