Privacy Policy

Who we are

KalendarKid (kalendarkid.com) is operated by Outcome.work. You can reach us at kidsync-support@kalendarkid.com.

What we collect and why

• Google account information (name, email, profile photo) — used to identify your account and display your name in the app.
• Google Calendar access — we request two granular scopes: calendar.events (create and view events) and calendar.calendarlist.readonly (see your list of calendars). We use them to list your calendars (so you can choose which one to add events to), create events you have approved, check for duplicates before creating them, and verify events KalendarKid created. We never modify or delete events KalendarKid did not create, and we cannot delete or share your calendars.
• Gmail access (optional, opt-in from Settings) — if you turn on inbox-watching, we request one additional, read-only scope: gmail.readonly. This is a separate Google sign-in from Calendar access, granted and revoked independently. We use it to detect schedule-relevant email (from coaches, schools, and camps) and extract calendar events from it automatically, the same way we process an email you forward manually. See details below.
• Uploaded files (PDFs and images) — used to extract calendar events. Files are stored temporarily and deleted automatically after 7 days (or sooner if our storage limit is reached). We do not use your files to train AI models.
• Extracted event data — the structured event list we extract from your documents is stored in our database so you can view your upload history. This data persists beyond the 7-day file window.

Google user data — access, use, sharing, and retention

• What we access: your Google profile (name, email, photo), the names and IDs of your calendars, and — on calendars you choose — event titles, dates, and times, read only to detect duplicates and verify events KalendarKid created.
• How we use it:solely to provide KalendarKid's user-facing features — signing you in, letting you pick a target calendar, creating the events you approve, warning you about duplicates, and alerting you if a KalendarKid-created event changes. We do not use Google user data for advertising or any unrelated purpose.
• What we share: Google user data is never sold and never shared with third parties, with one class of exception: infrastructure processors (Supabase for our database, Vercel for hosting) that store or transmit it on our behalf under their data processing agreements. Your calendar data (event and calendar list contents) is never sent to Anthropic or any other AI service— it is only read directly via the Google Calendar API for duplicate-checking and verification. The one exception is an AI assistant you choose to connect, such as ChatGPT or Claude: once you connect it and approve access on KalendarKid's consent screen, it can read your calendar events when you ask it about your schedule. It can only read, never change, and you can disconnect every assistant anytime by turning off AI agent access in Settings. (Gmail message content is handled differently — see the Gmail section below.)
• How it's protected: all data is encrypted in transit (TLS) and at rest (our database and file storage provider, Supabase, encrypts data at rest). Google OAuth tokens are stored server-side only and are never exposed to the browser or to third parties.
• Retention and deletion:Google user data is kept only while your account exists. Revoke KalendarKid's access at any time via Google Account Permissions — this immediately invalidates our tokens. To delete your account and all associated data (profile, tokens, event records), email kidsync-support@kalendarkid.com and we will complete deletion within 30 days.

Gmail user data — access, use, sharing, and retention

Inbox-watching is a separate, optional feature you turn on from Settings — it is off by default and uses its own Google sign-in (a distinct grant from Calendar access), so it never affects your Calendar connection.

• What we access: read-only access to your Gmail inbox (gmail.readonly). For each new message, we first check lightweight metadata only — the sender, subject line, and whether it carries a bulk-mail header — to judge whether it might contain a schedule. We only read the full message body and any attachment for messages we classify, with high confidence, as likely to contain one.
• How we use it:solely to detect schedule-relevant email (from coaches, schools, camps, and similar senders) and extract calendar events from it — the same pipeline used for an email you forward to us manually. We do not read, use, or store email that isn't classified as schedule-relevant, and we never use Gmail content for advertising or any unrelated purpose.
• AI processing: unlike calendar data, the content of a message we classify as schedule-relevant issent to our AI extraction provider (see AI processing below) in order to pull out event details — that is the purpose of the feature. Messages that don't pass classification are never sent to AI.
• What we share: never sold, never shared for advertising. Shared only with the same infrastructure processors (Supabase, Vercel) and AI extraction provider used for the rest of the product, under their data processing agreements.
• Retention:a qualifying message's body (or attachment) is stored the same way as a manually forwarded file — automatically deleted 7 days after processing. The extracted event data persists in your upload history until you delete your account, same as any other import.
• Turning it off: disable inbox-watching any time from Settings, or revoke access directly via Google Account Permissions. Either immediately stops new messages from being read.

Limited Use compliance

KalendarKid's use of information received from Google APIs, including the Gmail API, adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Google user data is not used to develop, improve, or train generalized AI or machine-learning models.

File retention

Uploaded files (PDFs and images), forwarded emails, and qualifying watched-inbox messages are all stored the same way and automatically deleted 7 days after upload, or sooner if total stored files exceed our capacity threshold. Extracted event records (the text data we pull from your documents or email) are kept until you delete your account.

AI processing

We use third-party AI services to read your uploaded documents and extract calendar event information. Documents are sent to the AI provider for processing and are subject to that provider's privacy policy. We currently use AI services from Anthropic and Microsoft Azure; the active provider may change over time as we optimize for quality and reliability. We will keep this list current. Neither provider uses API inputs to train their models, and your documents are processed transiently — they are not stored by the AI provider after the response is returned.

AI assistants you connect

You can connect KalendarKid to an AI assistant, such as ChatGPT or Claude, and ask it about your family's schedule. Nothing is shared until you connect the assistant and approve access on KalendarKid's consent screen.

• What the assistant can see:only when you ask it something, and only what's needed to answer — your Google Calendar events for the dates asked about (title, time, location, description, the organizer's name and email, and your own RSVP); events KalendarKid created that you approved; schedules waiting for your review; and where an event came from (for example, the sender's email address on a forwarded message).
• Names in your events:event details are shared as they appear in your calendar and schedules. KalendarKid doesn't know who the people named in them are; names you or a sender wrote into an event, which may include family members, are shared along with it.
• What it never sees:other invitees' names or email addresses, the raw text of your emails or uploaded files, or your Google account credentials.
• What it can do: read only. It cannot create, change, or delete events or approve schedules.
• Data held by the assistant:once sent, it is handled under the assistant provider's own privacy policy (for ChatGPT, OpenAI's). KalendarKid does not control how long they keep it.
• What we keep: a log of which tool was called, when, and whether it succeeded — never your question or the data returned — kept until you delete your account. Assistant access tokens expire after 1 hour and refresh tokens after 90 days.
• Disconnecting: turn off AI agent access in Settings. This immediately revokes every connected assistant. You can also disconnect KalendarKid in the assistant itself.

Data sharing

We do not sell your data. We share data only with the service providers necessary to operate KalendarKid: Supabase (database and file storage), Vercel (hosting), AI processing services (currently Anthropic and/or Microsoft Azure), and Google (authentication and calendar). If you connect an AI assistant, we also share data with it as described in "AI assistants you connect" above. Each provider is bound by their own privacy policies and data processing agreements.

Children's data

KalendarKid is intended for use by parents and guardians (adults). Documents you upload may contain information about your children. We treat all uploaded content as sensitive and apply the retention and security practices described in this policy. If you connect an AI assistant, event details are shared with it as written when you ask about your schedule, including any names they contain (see "AI assistants you connect"). KalendarKid is not directed at children under 13.

Your rights

You can revoke KalendarKid's access to your Google account at any time via Google Account Permissions. To delete your KalendarKid account and all associated data, email us at kidsync-support@kalendarkid.com.

Changes to this policy

We'll update the "Last updated" date above if this policy changes. Material changes will be communicated via the app.