1. Introduction
At Schedulr, we take your privacy seriously. This Privacy Policy explains how we collect, use, protect, and handle your information when you use our group scheduling application. We are committed to maintaining strict data controls and ensuring your privacy is protected.
2. Data Collection
We collect the following types of information:
- Account Information: Email address, username, and authentication credentials
- Group Data: Group names, descriptions, and membership information
- Usage Data: How you interact with the app, features used, and performance metrics
- Device Information: Device type, iOS version, and app version
- Subscription Data: Subscription status and purchase history (handled by RevenueCat)
- Journey Planning Data: When you request Scheduly journey planning, we may process your journey request, recent travel-planning messages, route preferences, and, if planning starts from an event, the event title, date/time, visible location, and visible notes
- Approximate Location: Approximate device coordinates are processed only if you select "Current location" for journey planning and grant permission
Important: We do NOT collect or store your calendar data. Calendar access is read-only and all calendar data remains on your device.
2.1. Cookies and Tracking
The Schedulr app does not use cookies or tracking technologies. Schedulr is a privacy-first application that does not set, store, or use cookies for any purpose, including user tracking, session management, advertising, or third-party tracking services.
Our marketing website is primarily static and does not set cookies for tracking or use website analytics.
When you send a bug report or feature request from the Support page, the details you enter (including your email address and optional name and device details) are sent to our issue tracker, Linear, so we can respond. The form uses Cloudflare Turnstile to block spam, which may set cookies strictly necessary for that check.
3. How Data is Used
We use your data to:
- Provide and improve our scheduling services
- Sync your groups and availability across devices
- Process AI queries through Scheduly
- Generate user-initiated Scheduly journey plans when requested
- Manage your subscription and provide customer support
- Send you important updates and notifications (with your consent)
- Ensure service security and prevent fraud
We do not sell your data to third parties. We do not use your data for advertising purposes.
Scheduly Journey Planning
Scheduly journey planning is user-initiated. When you ask Scheduly to plan a journey, we may process your journey request, recent travel-planning messages, and route preferences such as fewer transfers or less walking. If planning starts from an event, we may use the event title, date/time, visible location, and visible notes to prepare the plan.
Approximate device coordinates are processed only when you choose "Current location" and grant location permission. Schedulr does not continuously track your location and does not sell location data.
OpenAI is used to extract journey details, handle clarifying questions, perform one current-disruption web search, and prepare the response. Google Maps Platform is used to compute transit and walking route content. Disruption data may be incomplete or may change after the displayed "checked at" time.
Schedulr does not persist raw Google route payloads or final provider-derived route legs. Chat history stores user requests, clarification messages, and only a neutral receipt that a live plan was generated and must be regenerated. Operational logs may include privacy-safe usage metadata such as model names, token counts, route/search counts, latency, and outcome, but not journey text, coordinates, private notes, or raw route content.
4. Third-Party Services
Schedulr uses the following third-party services. Each service has strict data controls and privacy measures:
Supabase
Purpose: Database and backend service for storing user accounts, groups, and scheduling data.
- Row Level Security (RLS) policies are enforced at the database level — users can only access their own data
- All data is encrypted at rest and in transit
- Strict access controls and authentication required for all data access
- EU/US hosting options available for data residency requirements
Apple Calendar
Purpose: Read-only calendar access for checking availability.
- Read-only access only — we cannot modify or create calendar events
- Calendar events are stored securely on Supabase with RLS policies
- All calendar data is encrypted at rest and in transit
- You can revoke calendar access at any time in iOS Settings
OpenAI
Purpose: Powers the Scheduly AI assistant for natural language scheduling queries and user-initiated journey planning.
- For ordinary scheduling queries, only the query text is sent for processing — no user IDs are included
- No user identification is stored with queries
- Queries are automatically deleted after processing per OpenAI's retention policies
- For journey planning, OpenAI may process the travel prompt, recent travel-planning messages, visible event context, route preferences, and a current-disruption web search result
- OpenAI privacy information is available at openai.com/policies/privacy-policy
Google Maps Platform
Purpose: Computes transit and walking route content for user-initiated Scheduly journey planning.
- Google Maps Platform receives the journey origin, destination, timing, route preference, and approximate coordinates only when you choose "Current location" and grant permission
- Schedulr does not persist raw Google route payloads or final provider-derived route legs
- Google privacy information is available at policies.google.com/privacy
Linear
Purpose: Stores bug reports and feature requests sent from the Support page.
- Details you enter on the support form, including your email address, are stored in Linear
- Submissions are used to investigate issues, reply to you, and plan product improvements
- Linear privacy information is available at linear.app/privacy
Cloudflare Turnstile
Purpose: Protects the support form from spam and automated abuse.
- Cloudflare processes technical signals such as your IP address and browser characteristics to verify the request
- Turnstile is not used for advertising or cross-site tracking
- Cloudflare privacy information is available at cloudflare.com/privacypolicy
RevenueCat
Purpose: Subscription management and payment processing.
- Only subscription-related data is shared (subscription status, purchase history)
- Data is anonymized where possible
- Payment processing is handled securely through Apple's App Store
5. Security Measures
We implement multiple layers of security to protect your data:
- Row Level Security (RLS): Database-level policies ensure users can only access their own data
- End-to-End Encryption: Sensitive data is encrypted in transit using TLS/SSL protocols
- Strict Access Controls: Authentication and authorization required for all data access
- Regular Security Audits: We conduct regular security reviews and compliance checks
- Data Minimization: We only collect and store the minimum data necessary for functionality
6. User Data Controls
You have complete control over your data. We respect the following rights:
- Right to Access: You can access all your data through the app or by contacting us
- Right to Deletion: You can request deletion of your account and all associated data
- Right to Data Portability: You can export your data in a machine-readable format
- Right to Opt-Out: You can opt out of non-essential data sharing
- Data Ownership: You own your data completely — we are just the custodian
To exercise these rights, contact us at support@schedulr.co.uk. We will respond within 30 days.
7. GDPR Compliance
Schedulr is fully compliant with the General Data Protection Regulation (GDPR):
- We process your data lawfully, fairly, and transparently
- We only collect data for specified, explicit, and legitimate purposes
- We limit data collection to what is necessary
- We keep your data accurate and up to date
- We store data only as long as necessary
- We ensure appropriate security of your data
- You have the right to access, rectify, erase, restrict, and port your data
8. Data Retention Policies
We retain your data only as long as necessary:
- Account Data: Retained until you delete your account
- Group Data: Retained until you leave the group or it's deleted
- Usage Data: Retained for 12 months
- Subscription Data: Retained as required by law (typically 7 years for tax purposes)
- AI Queries: Processed and immediately deleted (OpenAI may retain for 30 days for abuse prevention)
- Journey Planning Chat: Chat history may retain user requests and clarification messages according to the AI conversation retention period, but stores only a neutral receipt for generated live plans
- Route Data: Raw Google route payloads and final provider-derived route legs are not persisted by Schedulr
8.1. Automated Database Cleanup
To maintain database performance, Schedulr includes an automated cleanup system that periodically removes old data:
- Calendar Events: Events older than 90 days are automatically deleted from our database (your Apple Calendar is not affected)
- AI Usage Records: Monthly records older than 6 months are deleted
- AI Conversations: Conversations inactive for 6 months are deleted
If you have concerns about data retention or wish to export your data, contact us at support@schedulr.co.uk.
9. Children's Privacy
Schedulr is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.
10. Changes to Privacy Policy
We may update this Privacy Policy from time to time. Material changes will be communicated to users via email or in-app notification. The "Last updated" date at the top indicates when changes were made.
11. Contact Information
If you have questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:
Email: support@schedulr.co.uk
For data protection inquiries, please include "Privacy Request" in your subject line.