Whensdays
Privacy Policy
Effective July 9, 2026. Whensdays is a scheduling app at whensdays.com, operated by Whensdays LLC ("we", "us"). This page explains what we collect and how it's used.
What we collect
- Account info: your name, optional handle and photo, and your email address (managed by our sign-in provider, Clerk). Guests who join by link provide only a display name.
- Scheduling data you create: events, RSVPs, availability answers, comments, and group memberships - shared with the people on those events and groups.
- Usage analytics: product analytics via PostHog (page views, feature usage, errors). Session replays mask all text and inputs. We use this only to improve the product.
Google Calendar data
If you choose to connect Google Calendar, we request read-only access (the calendar.readonly scope) and use it solely to:
- show your upcoming events back to you inside Whensdays, and
- overlay your busy times on your own availability grid and flag conflicts on time polls.
We never modify your calendar, never share its contents with other users (others see only busy/free effects on your availability, not event details), and never use it for advertising. OAuth tokens are encrypted at rest (AES-256-GCM). Disconnecting your calendar in the app deletes the stored tokens immediately.
Apple Calendar (CalDAV): if you connect Apple Calendar, you provide an app-specific password (never your main Apple password). We store it AES-256-GCM encrypted, use it read-only against Apple's calendar servers for the same two purposes above, and delete it immediately when you disconnect. Published calendar links (the fallback option) are stored as the URL you pasted.
Whensdays' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
We send transactional email only (invites, reminders, activity digests, cancellations) via our email provider. Every email includes a one-click mute link, and digests keep volume low. We do not send marketing email or share your address.
What we don't do
- We do not sell your data.
- We do not run ads on your events, polls, or emails. The GIF picker is powered by Klipy and may include sponsored GIFs; GIF searches are proxied through our server, so Klipy receives only your search words - never your identity, IP address, or any personal data.
- Analytics use cookies (PostHog). In the EU/UK we ask before setting any - decline and no analytics load at all. Elsewhere they're on by default and disclosed here.
- We do not share your data with third parties beyond the processors above (Clerk for auth, PostHog for analytics, our email provider, and our hosting providers).
Data retention & deletion
Your data is kept while your account is active. To delete your account and its data, or for any privacy question, email [email protected] and we'll complete it within 30 days.
Changes
If this policy changes materially, we'll note it here with a new effective date.