Privacy Policy
Last updated: 5 June 2026
What We Collect
When you use Whenn, we collect your name, email address, and calendar availability (free/busy status only). We never access event titles, descriptions, attendees, or any other calendar details beyond free/busy status.
How We Use It
Your data is used solely to find mutually agreeable meeting times. We do not sell, share, or use your data for advertising, profiling, or any purpose other than the scheduling service you have requested. Calendar free/busy data accessed via Google or Microsoft OAuth is never used to train machine learning models and is never transferred to third parties.
Calendar Access and OAuth Scopes
When you connect your calendar or video platform, Whenn requests the minimum permissions necessary to deliver the service:
Google Calendar (host): We request three scopes:
- calendar.freebusy — read-only access to determine when you are free or busy. We never read event titles, descriptions, or attendee details.
- calendar.events — used solely to create one calendar event on your behalf when a meeting is confirmed. This is required by Google's API to generate a Google Meet link. When the event is created, Google sends calendar invites to all attendees on our behalf. We never read, modify, or delete your existing calendar events.
- openid, email, profile — standard authentication scopes used to identify your account.
Microsoft Outlook / Microsoft 365 (host): We request four scopes:
- Calendars.ReadWrite — used to read your free/busy availability via the Microsoft Graph getSchedule endpoint. Write access is required by Microsoft's API for this call.
- OnlineMeetings.ReadWrite — used solely to create a Microsoft Teams meeting link when a meeting is confirmed.
- User.Read — reads basic profile information required for authentication context.
- offline_access — maintains the connection without requiring you to reconnect each time.
We never read, modify, or delete your calendar events or any calendar content beyond free/busy windows.
Microsoft Outlook (participant):
We request Calendars.Read, User.Read, and offline_access — read-only access to determine free/busy availability. No write access is requested for participants.
Zoom:
We request only meeting:write:meeting — used solely to create a Zoom meeting link when a meeting is confirmed. We do not access your existing Zoom meetings, recordings, contacts, or any other Zoom data.
You can revoke access at any time:
Whenn's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Data Protection Mechanisms
We apply the following data protection mechanisms:
- Encryption in transit: All data between your browser, our servers, and third-party APIs is encrypted using TLS 1.2 or higher (HTTPS). Unencrypted connections are not accepted.
- Encryption at rest: All data stored in our database is encrypted at rest using AES-256 encryption.
- OAuth token security: Google and Microsoft OAuth access tokens and refresh tokens are stored in an encrypted database accessible only via authenticated server-side API calls. Tokens are never exposed to client-side code, never logged, and never transmitted outside of direct API calls to Google and Microsoft.
- Access controls: Database access is restricted to server-side application code only, protected by row-level security policies. No direct public database access is permitted.
- Minimal data principle: We request only the minimum OAuth scopes required. Free/busy data retrieved from calendars is used in real-time and is not stored persistently beyond the scheduling session.
- Authentication: Accounts are protected by magic link authentication — no passwords are stored. Session tokens are stored as httpOnly, Secure, SameSite cookies and are rotated on each new login.
Data Retention
We retain different types of data for different periods:
- Calendar free/busy data — never stored persistently. Retrieved in real-time and discarded immediately after availability computation.
- OAuth access tokens — retained only while a calendar connection is active. Deleted immediately upon disconnection or revocation.
- Meeting participation data (availability responses, slot selections) — deleted within 90 days of a meeting being confirmed or expiring.
- Account data (name and email address) — retained for as long as the account is active. Accounts with no activity for 12 months will receive a deletion notice, and will be permanently deleted 30 days later if no action is taken.
- Meeting core data (title, confirmed time, host details) — retained for 90 days after confirmation, then deleted.
You can request immediate deletion of your account and all associated data at any time by contacting privacy@meetwhenn.com. We will action this within 30 days.
Third-Party Services
Whenn uses the following sub-processors. Each is bound by their own privacy policies and data protection terms:
- Supabase — database and authentication infrastructure, hosted on AWS in the EU region
- Vercel — application hosting and serverless functions
- Resend — transactional email delivery
- Google LLC — Google Calendar API, used only when you explicitly connect your Google Calendar
- Microsoft Corporation — Microsoft Graph API, used only when you explicitly connect your Outlook calendar
- Zoom Video Communications — Zoom API, used only when you connect Zoom for meeting link generation
We do not sell data to third parties and do not use advertising or analytics services that receive personal data.
Your Rights (UK GDPR)
Under UK GDPR, you have the right to access, correct, delete, restrict, or port your personal data, and to object to its processing. To exercise any of these rights, contact privacy@meetwhenn.com. We will respond within 30 days.
Cookies
Whenn uses a single session cookie (whenn_session) to maintain your authenticated session. This cookie is httpOnly, Secure (HTTPS only), and expires after 30 days. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.
Contact
Whenn is a UK-based service. For any questions regarding this policy or to exercise your data rights, contact us at privacy@meetwhenn.com.