Privacy Policy
Last updated: 21 July 2026 · Effective: 21 July 2026
1. Who we are
This service ("CalJoin", "we", "us") is operated by Miguel Silva & Rodrigues Silva, Lda, private limited company, registered at Av. Diogo Cão N8 - 7C, 2670-327 Loures, Portugal, VAT number PT516507648. We are the data controller for the personal data described here.
Data protection contact: privacy.caljoin@mirosil.com.
2. What data we process
| Category | Examples | Why |
|---|---|---|
| Account data | Email address, display name from your calendar provider | To create and secure your account (your identity is your connected calendar) |
| Calendar connection | Provider (Google/Microsoft), account identifier, OAuth access & refresh tokens (encrypted at rest) | To read your calendars on your behalf with read-only access |
| Calendar content | Calendar names, event start/end times and busy/free status; event titles are processed only where you explicitly choose to reveal details | To build your unified view and your availability feed |
| Feed configuration | Your links, labels, included calendars, settings | To generate the availability links you create |
| Technical/usage | IP address (may be hashed), device/browser type, feature interactions | Security, abuse prevention, and — with consent — product analytics |
We do not request access to your email, files, or contacts. CalJoin asks only for read-only calendar scopes.
3. Legal bases (GDPR Art. 6)
- Contract — to provide the service you sign up for (connecting calendars, generating links).
- Legitimate interests — to keep the service secure and prevent abuse, balanced against your rights.
- Consent — for optional analytics cookies and any marketing email. You may withdraw consent at any time.
- Legal obligation — where we must retain records (e.g. tax) when paid plans launch.
4. How your shared links work
Availability links publish busy time only by default — never event titles, locations, or notes. If you explicitly set a calendar to show full details for a given link, the events you selected will be visible to anyone who has that link. You can reset a link at any time to stop the previous link from working.
5. Sub-processors
We share data only with providers that help us run the service, under data-processing agreements:
| Provider | Purpose | Location |
|---|---|---|
| Google LLC / Microsoft Corp. | Calendar data you connect (read-only) | Per provider; subject to their terms |
| Railway | Application hosting & database | Amsterdam, Netherlands (EU) |
| Resend | Transactional & waitlist email | EU |
| Plausible Analytics | Privacy-friendly analytics (consent-based) | EU |
| Payment Provider — when Pro launches | Billing, invoicing, VAT | EU/International |
A current list is available on request at privacy.caljoin@mirosil.com.
6. Google & Microsoft API data
CalJoin's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Microsoft Graph data only to provide the features you request. We do not use this data for advertising, do not sell it, and do not allow humans to read it except where required for security, to comply with law, or with your explicit consent.
7. International transfers
Where data is transferred outside the EEA (for example via Google or Microsoft), it is protected by appropriate safeguards such as Standard Contractual Clauses. Our own application and database are hosted in Amsterdam, Netherlands (EU).
8. Retention
We keep your data while your account is active. Cached calendar events are retained only as long as needed to serve your view and feeds. If you disconnect a calendar or delete your account, the associated tokens and cached events are deleted, typically within 30 days, except where we must retain limited records to meet legal obligations.
9. Your rights
Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to certain processing. You can withdraw consent at any time and lodge a complaint with your supervisory authority (CNPD — Comissão Nacional de Proteção de Dados, Portugal). To exercise any right, email privacy.caljoin@mirosil.com; we respond within one month.
10. Security
We use encryption in transit (TLS) and encrypt OAuth tokens at rest. Access is restricted on a need-to-know basis. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authority of a qualifying breach as required by law.
11. Children
CalJoin is not directed to children under 16 and we do not knowingly process their data.
12. Changes
We may update this policy; material changes will be notified by email or in-app. The "last updated" date above reflects the current version.
Contact: privacy.caljoin@mirosil.com · Miguel Silva & Rodrigues Silva, Lda, Av. Diogo Cão N8 - 7C, 2670-327 Loures, Portugal.