Privacy

What we keep

• The names people type on a plan, and the days they pick.
• The sentence an organizer typed about their plan. Only they see it.
• On a phone with no account, the organizer's own name and how they listed names, so they don't type them again.
• Emails that organizers add to a plan or to their saved people. We keep them encrypted.
• If you sign in: an id from Apple, Google or Microsoft, your email and your name, so you can sign in again. With an email and a password instead: your email, your name and your password scrambled so no one can read it back, not even us.
• Whether each invite email was sent and delivered.
• One-way hashes of addresses that asked not to get our emails or that bounced. A hash can't be turned back into the address.
• If you turn on notifications: your browser's push address, encrypted.
• Which days look busy on your calendar, for 15 minutes, when your calendar is checked on a plan. With a calendar kept on your account (Google, Outlook or Apple) or a calendar link, also the calendars' names and your events' names and times on the plan's days, so you can see what's on a day.
• Two cookies. One tells us it's the same phone next time, and holds a random number, not who you are. The other remembers how close you zoomed the calendar, and nothing else.
• If you ask for a code to open a private plan: the email you typed, encrypted, until an hour after the code stops working.
• A plan's time, place and notes, if the organizer adds them. Everyone who can see the plan sees them, and they go into its date email and calendar entries.
• If you answer "How's it going?": whether you love it, and anything you write about making it better. Not who you are.
• If a page shows you an error, or something breaks: which page, what it said, and which phone or account it happened on, so we can fix it.
• If you pay: Stripe takes the payment, and we never see your card. We keep that you paid, how much, when, and Stripe's reference for it.

Plan names are written by fixed rules on our own server. Nothing you type is sent to an outside AI service.

When you type in a plan's Address box, what you type is sent from our server to Photon, a free place search run by komoot on OpenStreetMap, to suggest places. It goes without your name, email or IP address, and nothing is kept unless you save the address on the plan.

We look at what we keep only to run This Date Works, fix problems and stop abuse.

What we never do

• We never collect your location.
• We never use analytics or ad tools, show ads or sell data.
• We never read your address book. On Android, the contact picker hands us only the people you pick.
• We never read your chats.

Your calendar

Checking a calendar is optional. It only puts stripes on days that look busy. You still pick your days.

• We use only the times your calendar marks as busy, for this plan's days. With a calendar kept on your account, you also see your calendars and your events' names, on your own screen.
• We keep which days look busy for 15 minutes. With a kept calendar or a calendar link we also keep the calendars' names and your events' names and times for those 15 minutes, encrypted. Never where or with whom.
• Only you see it. Not the organizer, not the group.
• We never change your events or your other calendars. Google, Microsoft and Apple let us read your calendars, and we keep only the calendars' names and your events' names and times, never where, who or notes. Signed in, we keep your Apple special password locked with a key used for nothing else, until you turn it off. Signed out, we use it once and never store it.
• Signed in, we keep Google, Outlook or Apple access encrypted until you turn it off, which deletes our copy at once and cancels it with Google. We use it only to show your busy days on plans you answer, and to put the dates plans set in your calendar.
• Google data follows Google's API Services User Data Policy, including Limited Use: never used for ads, never sold, never used to train AI.
• A calendar link shows that calendar to anyone who has it. Signed in, we keep it locked like a password until you remove it; signed out, we use it once. We only ever read it.
• Signed in, when a plan you're on has its date set, we add it to a calendar of our own, This Date Works, in the Google, Outlook or Apple account you choose in Your account. We move it if the date changes and take it away if the date is cleared or the plan deleted, and keep only where we put it. Choose Don't add them to stop.

Google user data

This is what we do with data we get from Google when you connect Google Calendar or sign in with Google.

• How we use it: we read your calendar list, and the times and names of your events on a plan's days, to show you which days look busy and what's on them. Only you see them. If you choose, we add the dates plans set to a This Date Works calendar we make in your Google account, and we change only the events we made. Signing in with Google gives us your name and email, to sign you in.
• Who we share it with: nobody. We never sell, rent or trade Google user data, and we never show it to the organizer or anyone else on a plan. It stays on the servers that run This Date Works, and we'd hand it over only if the law made us.
• How we protect it: it only travels over encrypted connections (HTTPS). Your Google access is stored encrypted (AES-256-GCM) with a key used for nothing else, and your events' names and times are kept encrypted for 15 minutes, then deleted. Turning Google off deletes our copy at once and cancels our access with Google.
• No AI: we never use or keep Google user data, including data from Google Workspace APIs, to develop, improve or train generalized AI or machine learning models, and we never send it to any AI service.
• This Date Works' use and transfer to any other app of information received from Google APIs, including Google Workspace APIs, will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Emails we send

We send four kinds of email, and nothing else:

• A code you ask for, to open a private plan.
• An invite, after an organizer checks it and taps Looks good.
• A reminder, when an organizer taps Remind people for me.
• An It's on! email when an organizer sets the date, to people who got the invite.

No newsletters, no ads and no tracking. Every invite, reminder and It's on! email has a link to stop emails.

Notifications

Notifications stay off until you turn them on for a plan. We send only these: the date is set, a reminder from the organizer, and, for organizers, everyone has answered. Turn them off on the plan's page or in your browser.

If you got an invite email

An organizer added your email to a plan, and we emailed you their invite.

• We have your address because that organizer typed it or picked it from their contacts.
• We use it only for that organizer's plans: the invite, reminders and It's on! emails. Never for marketing.
• If the organizer is signed in, your name and email are saved in their list for next time. Only they can see it.
• On a plan, we keep your address until 365 days after the plan's last day. A saved list keeps it until the organizer deletes it or their account, or 2 years pass without using it.
• To stop emails, tap the link at the bottom of any email. You can stop emails from that organizer, or from us.
• To have your address removed from saved lists, write to privacy@thisdateworks.com.
• If an email looks like spam, tap Report abuse at the bottom of it. You can also write to privacy@thisdateworks.com, or complain to the data protection authority where you live.

How long we keep things

• Plans, names, days, name emails and invite statuses: 365 days after the last day or the set date.
• The sentence you typed when you made a plan: with the plan. Only you see it.
• On a phone with no account, the name you gave when you made a plan and how you listed names: on that phone until we delete its record (400 days unused).
• The calendar zoom you chose: in a cookie on your phone for a year.
• Deleted plans: 30 days.
• Unsent plans: 7 days after the last change. Sent ones: 30 days.
• Saved people and groups: until you delete them or your account, or 2 years unused.
• Email send records: 31 days, with the address removed as soon as the email is sent or we give up.
• Choices not to get emails, complaints, abuse reports and email holds on organizers: kept as one-way hashes for as long as they're needed, even after an account is deleted.
• Addresses that bounced: 365 days, as a hash.
• Busy days, and your calendars' names and events' names and times: 15 minutes.
• Code requests: 1 hour after they stop working.
• Kept Google, Outlook or Apple access and calendar links: until turned off or removed, 365 days unused or 30 days broken.
• Notification sign-ups: until turned off, refused by the push service, or the phone's record is deleted.
• Phones we haven't seen: 400 days.
• Accounts: until deleted.
• Access logs and backups: 14 days.
• Error records: 30 days.
• Purchase records: kept for taxes and refunds, even after an account is deleted.

Contact

Write to privacy@thisdateworks.com about privacy, or support@thisdateworks.com about anything else.