Privacy Policy

1. Information We Collect

We may collect the following information when you use our website or services:

• Name
• Email address
• Phone number
• Scheduling or booking details
• Messages or information submitted through forms
• Basic device and browser analytics

2. How We Use Information

We use collected information to:

• Schedule and coordinate appointments or meetings
• Communicate with users and clients
• Improve website performance and user experience
• Provide customer support
• Maintain service security and reliability

3. Sharing of Information

We do not sell your personal information.

We share information only with the third-party processors listed below, and only to the extent necessary to operate the Service. Each processor handles your data under their own privacy policy and a data processing agreement with us.

• Vercel — application hosting
• Neon — managed PostgreSQL database
• Cloudflare R2 — encrypted file storage
• Resend — transactional and inbound email
• Google — OAuth sign-in and Google Calendar API (see "Google User Data" section below)
• Anthropic — AI processing for document understanding and summarization
• PostHog — anonymous product analytics
• Inngest — background job orchestration

We may also disclose information when required by law, to protect rights or safety, or in connection with a merger, acquisition, or asset sale (in which case we will provide notice before your data is transferred and becomes subject to a different privacy policy).

4. Google User Data

When you choose to connect a Google account to Swaybar, we request only the OAuth scopes we actually need to deliver visible features. We currently request:

• https://www.googleapis.com/auth/calendar.readonly — to read your existing calendar events so we can prevent double-booking and surface conflicts in the scheduling UI
• https://www.googleapis.com/auth/calendar.events — to create, update, and delete Swaybar shift and time-off events on a dedicated calendar, so your team sees their schedule in the calendar app they already use
• openid email profile — basic identity for sign-in

Limited Use disclosure. Swaybar's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide the calendar coordination features described above, which are prominent in the Swaybar user interface.
• We do not transfer Google user data to third parties except as necessary to operate those features for you, to comply with applicable law, or as part of a merger or acquisition with explicit advance notice and the opportunity to opt out.
• We do not use Google user data for advertising, including retargeting, personalization, or interest-based advertising.
• We do not allow humans to read Google user data, except (a) with your specific consent for a support case you have opened, (b) when necessary for security investigations, (c) to comply with applicable law, or (d) when the data has been aggregated and anonymized for internal operations.
• We do not sell Google user data to third parties or data brokers, and we do not use it for credit-worthiness or lending purposes.

You can revoke Swaybar's access to your Google account at any time at myaccount.google.com/permissions. Revoking access stops all future syncing; events already written to your calendar remain unless you delete them.

5. Data Retention

We retain personal information for as long as your account is active or as needed to provide the Service. Specifically:

• Account profile data is retained until you delete your account.
• Operational data (schedules, time entries, documents) is retained for the life of your account or as required for compliance and audit purposes.
• Soft-deleted items (documents, contacts, schedule entries) are retained for 90 days, then permanently purged by an automated cleanup job.
• Google Calendar access tokens are stored encrypted and deleted within 7 days of you disconnecting your Google account or closing your Swaybar account.
• Backups are retained for 30 days. Data deleted from the active system may persist in encrypted backups during that window before being overwritten.
• We may retain limited records (e.g., audit logs, signed-document evidence, billing receipts) longer where required by law or to defend legal claims.

6. Cookies and Analytics

Our website may use cookies or similar technologies to improve functionality and understand visitor behavior.

You can disable cookies through your browser settings.

7. Data Security

We take reasonable measures to protect your information from unauthorized access, misuse, or disclosure.

However, no online system can guarantee complete security.

8. Third-Party Links

Our website may contain links to third-party websites or tools. We are not responsible for the privacy practices of those external services.

9. Your Rights

You may request to:

• Access your personal data
• Correct inaccurate information
• Request deletion of your information
• Opt out of future communications

To make a request, contact us using the information below.

10. Children's Privacy

Our services are not directed toward children under 13, and we do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy periodically. Updated versions will be posted on this page with a revised effective date.