Privacy Policy

Who is responsible for your data

Timeless Web Services is the data controller for Simple Timetable under the UK GDPR, the Data Protection Act 2018 and, for people in the European Economic Area, the EU GDPR. “We”, “us” and “our” mean Timeless Web Services. Contact us about anything in this policy at [email protected].

This website

This site doesn't use tracking or advertising cookies. It only remembers your light or dark choice, in your own browser.

What the app stores

• Your account: email address, name, role, a securely hashed password (we can't see your password), and when you accepted this policy and the Terms.
• Your planner: the events, to-dos, categories, settings and checklist ticks you create.
• Sign-in data: a session cookie that keeps you signed in, and the time you were last active.
• Your subscription (if you pay): whether it's active, its renewal date and its status. Your card details go straight to Stripe and never reach us.
• Google Calendar (only if you connect it): your Google account's email address, the list of calendars you own, the events in the one calendar you choose (from 30 days ago onward), and access tokens, which are stored encrypted.

How it's used, and our legal basis

• To provide the service (contract): show your timetable and to-dos, sync with Google Calendar when you ask, send sign-up codes, invitations and account emails, and manage your subscription.
• To keep it secure (legitimate interests): block bots, limit sign-in attempts, and investigate abuse.
• To meet legal duties (legal obligation): for example, payment records Stripe must keep.

Admins can see basic account details (name, email, role, last active) and totals, not the contents of your planner.

How we protect your data

• Encrypted in transit: every connection to the website, the app, our database and the services below uses HTTPS/TLS.
• Encrypted secrets: Google access and refresh tokens are encrypted with AES-256-GCM before they're stored, with a key kept separately from the database.
• Passwords and sign-in: passwords are stored only as salted scrypt hashes. Session cookies are HTTP-only, secure and same-site, and only a SHA-256 hash of each is stored, as are emailed links and codes, which expire and work once.
• Abuse protection: Google reCAPTCHA on sign-in forms, rate limits, and a temporary lock after repeated wrong passwords.
• Least privilege: the app asks Google only for the narrowest access it needs (listed below). Every database query is scoped to your own account. Production access is limited to the people who run the service and protected by strong authentication.
• Where it's kept: our database is hosted by Railway in its EU West region (Amsterdam, Netherlands). Only what's needed is kept, and only for as long as described below.
• If something goes wrong: we would tell the relevant authority and affected users of any breach that puts your data at risk, as the law requires.

Google user data

Connecting Google Calendar is optional. Simple Timetable's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. It requests only these permissions:

• calendar.events.owned (see, create, change and delete events on calendars you own): to copy events between Simple Timetable and the one calendar you choose, both ways.
• calendar.calendarlist.readonly (see the list of your calendars): so you can choose which calendar to sync.
• openid and email: to show which Google account is connected.

Google data is used only to provide and improve the sync features you can see in the app. It is never sold, never used for advertising, and never shared except with the service providers below that run Simple Timetable, or where the law requires. No person reads it unless you ask us for help and agree, it's needed for security, or the law requires it. We do not use Google user data, including data from Google Workspace APIs, to develop, improve or train generalised or non-personalised AI or machine-learning models.

Disconnect at any time in Settings → Google Calendar, or revoke access from your Google Account. Disconnecting revokes our access and deletes the stored tokens straight away. Events already copied into your planner stay until you delete them or your account.

Services we rely on

• Vercel, to host the website and app
• Railway, to host our database in the EU West region (Amsterdam, Netherlands)
• Stripe, to take payments and manage subscriptions (it receives your email address and payment details)
• Google reCAPTCHA, to block bots on the sign-in pages
• Amazon SES or Resend, to send account emails
• Google Calendar, only if you connect it

Some of these providers are based in, or may process data in, the United States. Where your data leaves the UK or EEA, it's protected by an adequacy decision (such as the UK–US data bridge or EU–US Data Privacy Framework) or by the UK International Data Transfer Agreement or EU Standard Contractual Clauses.

Keeping and deleting data

• Your data is kept while your account exists.
• Delete your account in Settings → Account. Your account and everything in it are deleted permanently and immediately, any subscription is cancelled, and Google access is revoked. This can't be undone.
• Pause your account in Settings → Account if you're not sure. You're signed out, and everything is permanently deleted after 30 days unless you sign in and keep your account before then.
• Expired sign-in sessions are cleaned up automatically, and expired links and codes stop working. Stripe keeps payment records for as long as the law requires.

Your rights

You have the right to:

• get a copy of your data: use Download my data in Settings → Account for a machine-readable copy;
• correct it: most of it you can edit in the app;
• have it deleted, as described above;
• restrict or object to how we use it;
• withdraw consent, for example by disconnecting Google.

You can do most of this yourself in the app. For anything else, email [email protected]. We reply within one month. If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

Children

Simple Timetable isn't meant for children under 13, and we don't knowingly collect their data.

Changes and contact

We'll update the date above when this policy changes, and tell you in the app or by email about important changes. Questions about your data? Email [email protected].