This policy explains what personal data the operator of I Know My Time ("application", "service", "we") processes when you use the application, why, and what rights you have under the EU General Data Protection Regulation (GDPR). The application is operated from the European Union. This policy forms part of your agreement with us together with the Terms of Use.
The application reads your Google Calendar with the read-only access you grant it: your list of calendars, your events, and the colour/label palettes of your calendars. Concretely: your calendar data never passes through our systems at all. Your browser requests it directly from Google, keeps it in memory for as long as the page is open, and computes the charts and tables there; closing or reloading the page discards it, and a new visit fetches it again. We store no copy of it — not temporary, not permanent. The application cannot change anything in your calendar and cannot access other Google services' data (such as Gmail) beyond what this policy describes. You can revoke the application's access at any time in your Google Account permissions.
I Know My Time's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain words: we use your Google data only to provide and improve the features you see in the application, we never sell it, we never transfer it except where you ask us to (your own Google Drive) or where the law requires it, and no human reads it. We also do not use your Google data to develop, improve, or train generalized artificial-intelligence or machine-learning models, ours or anyone else's.
We store your account and your settings: your Google Account e-mail address and account identifier (to keep your sign-in working) and your application preferences — for example saved filters, your currency, and similar settings. Saved filters can include details you picked from your calendar, such as keywords or organizer e-mail addresses. We also keep a record of your acceptance of the Terms of Use and of your marketing e-mail choice (version and timestamps), so we can honour and prove your choices.
We process this data to perform our agreement with you (Article 6(1)(b) GDPR) and, for the records of your choices, to comply with our legal obligations and protect our legitimate interests (Article 6(1)(c) and (f) GDPR). Sign-in state is kept in your browser (cookies and similar browser storage), as this is essential for the application to work. We run no server of our own: the application is delivered as static files and talks to Google's services directly, so we keep no access logs. Google's infrastructure (Firebase Hosting, Authentication, and the settings database) necessarily processes technical connection data such as IP addresses to deliver and secure the service on our behalf, under Google's own terms and retention.
Your events can mention other people — organizers, guests, their names and e-mail addresses. That data is read and analysed in your browser only and, like the rest of your calendar, never reaches our systems. The one exception is what you deliberately put into a saved filter (for example choosing to see only meetings invited by a particular organizer): that choice, including the e-mail address it refers to, is stored with your settings so the filter can be reused.
We process it to deliver the feature you asked for, on the basis of our and your legitimate interest in analysing your own working time (Article 6(1)(f) GDPR). We never contact those people, never build profiles of them, and never share the data. Informing each of them individually would be impossible and disproportionate — we know only what is in your calendar — which is the situation Article 14(5)(b) GDPR is written for; this section serves as that information. If someone believes their data is held here, they can reach us through the contact form. Note that you remain responsible for the calendar itself: how you record other people's data there is governed by your own arrangement with Google.
If you use the export feature, the application asks for Google Drive access limited to files the application itself creates. It creates an "I Know My Time" folder in your Drive and saves your export files there; we remember only that folder's identifier so exports can reuse it. The files belong to you and live only in your Drive; we cannot see or touch any other files in your Drive, and we do not keep copies of your exports.
We may use your e-mail address for service messages (for example a notice that the terms or this policy changed) — these are part of the service, are needed to perform our agreement with you (Article 6(1)(b) GDPR), and are not marketing. Separately, you may occasionally receive product news (new features, tips & tricks). We send those on the basis of our legitimate interest in telling our own users about our own product (Article 6(1)(f) GDPR), within the EU rules on electronic mail to existing customers (Article 13(2) of the ePrivacy Directive 2002/58/EC). You can refuse them when you first sign in, any time in the application settings, or via the unsubscribe link in every such e-mail; we store your choice with a timestamp.
You have the right to object at any time to the processing of your personal data for direct marketing, including any profiling related to it. If you do, we stop immediately and for good (Article 21(2) and (3) GDPR). The switch in the application settings is the quickest way to exercise it; the contact form works too.
Essential cookies and browser storage keep you signed in — the application cannot work without them. Everything beyond that runs only with your consent (Article 6(1)(a) GDPR), collected and recorded by the cookie banner (Cookiebot). With that consent we use Google Analytics to understand how the application is used and to improve it. We do not use it to learn your name or address, but identifiers such as the analytics cookie ID and your IP address still count as personal data, so we treat them that way. You can withdraw your consent at any time. Cookiebot keeps your choice in a cookie in your own browser, so clearing this site's cookies (or that one cookie) makes the banner ask again and lets you decide differently. Withdrawing does not affect what was processed while the consent was in place. You can also read how Google uses this data.
The application runs on Google Cloud Platform (including Firebase hosting, database, and sign-in), which processes data on our behalf under Google's security and compliance commitments. Our processors are Google (Firebase Hosting, Authentication, the Realtime Database that holds your settings, Google Analytics, and Google Forms behind our contact form) and Cookiebot for the cookie banner. That is the whole list. We do not sell your data and we share it with no one else — only these processors, and only to deliver the application's functionality.
Where processing involves transfers outside the EU, they rely on Google's certification under the EU–U.S. Data Privacy Framework and, in addition, on the EU standard contractual clauses in Google's data processing terms.
Everything travels over encrypted connections (HTTPS) and is stored encrypted at rest by Google's infrastructure. Your settings live in a database whose rules allow each account to read and write only its own data, and reject any field the application does not recognise. Sign-in is handled by Google — we never see or store your password — and the access token that lets the application read your calendar stays in your browser and expires on its own. Because your calendar data never leaves your browser (section 2), the amount of data that could be exposed on our side is deliberately small. If a breach ever did put your rights at risk, we will notify the supervisory authority and you as the law requires.
Your account, your settings, and the records of the choices you made (terms acceptance, marketing preference) are kept until you delete your account. They are stored together under your account, so deleting it in the application settings removes all of them at once, immediately and permanently — including those consent records. We keep nothing back afterwards. Data held by our processors — Google's technical connection data, analytics, the cookie-consent log — follows the retention configured in those services; their own policies, linked above, describe it.
Under the GDPR you have the right to access, rectify, and erase your personal data, to restrict or object to its processing, and to data portability. Where we process something on the basis of your consent — the analytics cookies — you can withdraw it at any time, and doing so does not affect what happened before. You can delete your account and all stored settings yourself at any time in the application settings; you can change your marketing choice there too. We make no automated decisions that produce legal effects for you or similarly significantly affect you, and we do not profile you. For any other request, contact us via the contact form — we may ask you to prove your identity first. You also have the right to lodge a complaint with your local data protection supervisory authority. One limit is worth naming: the technical connection data handled inside Google's infrastructure (section 3) is not ours to search or delete per user, so an erasure request to us cannot reach it.
The application is not intended for children. You may use it only if you are at least 16 years old; we do not knowingly process the data of anyone younger. If you believe a child has created an account, tell us through the contact form and we will delete it.
When this policy changes, we publish the new version here with a new effective date and keep previous versions in the history below. Material changes are also announced in the application, where we ask you to confirm them on your next sign-in.
Please contact us via the contact form to discuss any questions or concerns. We will do our best to resolve your issue the best way we can.