Privacy policy

Effective July 20, 2026

FindThyme helps groups find a time to meet. To do that, we need a little of your information — this page explains exactly what we collect, why, and what you can do about it. The short version: we collect only what scheduling needs, we never sell it, and other participants only ever see aggregated availability, never yours by name.

Who we are

FindThyme is operated from Germany by the provider named in the imprint. That’s the “controller” in the sense of the EU General Data Protection Regulation (GDPR). You can reach us any time at hello@findthyme.app.

What we collect

• If you create an account: your name and email address, plus the events you create (title, dates, time window, optional location, and settings).
• If you respond to an invite: the name and email you enter when joining, the times you mark as unavailable or available, and any votes you cast. You don’t need an account for this — a random token in a cookie remembers that it’s you.
• If you connect a calendar (optional): the email address of the connected account and access credentials, which we store encrypted. We fetch only free/busy blocks inside the event’s time window — never event titles, descriptions, or attendees.
• Emails we send you: we keep a log of which emails (sign-in links, confirmations, reminders) went to which address and whether they arrived. We only send emails the service needs — there’s no marketing list.
• Technical basics: sign-in sessions record your browser’s user-agent string and timestamps. Our hosting provider keeps short-lived server logs (including IP addresses) to run and protect the service.
• Anonymous usage stats: we count page views with Vercel Web Analytics, which doesn’t use cookies and doesn’t identify you.

What other participants see

Never your individual answers. Other people in your event see aggregated counts — for example “4 of 6 can make it” — plus the participant list the organizer invited. Your marked times, your votes, and your calendar’s free/busy blocks stay yours.

Why we’re allowed to use it

• To run the service for you (Art. 6(1)(b) GDPR): accounts, responses, suggestions, and the emails that hold it together.
• Because you asked us to (Art. 6(1)(a) GDPR): calendar connections happen only when you connect one, and you can disconnect at any time — that deletes the stored credentials and free/busy blocks.
• Legitimate interests (Art. 6(1)(f) GDPR): keeping the service secure and abuse-free, and understanding usage through anonymous, cookie-free statistics.

Cookies

We use two cookies, both strictly necessary — which is why you don’t see a cookie banner here. We don’t use tracking or advertising cookies.

• sch_session keeps you signed in. It expires after 90 days.
• sch_anon remembers your event responses when you participate without an account. It expires after one year.

Your browser’s local storage may also hold small preferences on your device — like your time-format choice or a dismissed banner. These never leave your browser.

Who helps us run FindThyme

A few service providers process data on our behalf, under data-processing agreements:

• Vercel (USA) hosts the app and provides the cookie-free analytics.
• Neon (USA) hosts our database.
• Resend (USA) delivers our emails.

Where these providers process data outside the EU, transfers rely on the EU–U.S. Data Privacy Framework or EU standard contractual clauses. If you connect a calendar, Google, Microsoft, or Apple also process your data under their own privacy policies. We never sell your data, and nobody gets it for advertising.

Google calendar data

FindThyme’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Concretely: we read only free/busy times, use them only to show your conflicts and score suggestions, and never transfer, sell, or use them for ads.

How long we keep things

• Sign-in links work once and expire after 15 minutes.
• Sign-in sessions expire after 90 days.
• Calendar credentials and free/busy blocks are deleted the moment you disconnect a calendar.
• Everything tied to your account is deleted when you delete your account. Event responses you gave as a participant live as long as the event does.

Your rights

Under the GDPR you can ask for access, correction, deletion, restriction, portability, and you can object to processing based on legitimate interests. The fastest routes are built in: Settings lets you export everything we store about you and delete your account, and disconnecting a calendar removes its data. For anything else, email hello@findthyme.app — we’ll answer within a month. You can also complain to a data protection authority; for us that’s the Bavarian Data Protection Authority (BayLDA).

Changes to this policy

If we change what we collect or why, we’ll update this page and its effective date — and for meaningful changes, we’ll tell you by email or in the app first.