Privacy Policy

Last updated: 3/15/2026

Calmbook is an appointment scheduling tool for coaches. This policy explains what data we collect, how we use it, and the choices you have.

Information we collect

  • Account details such as email and password (handled via Supabase Auth).
  • Coach profile details (name, slug, timezone, phone number, settings).
  • Client booking details (name, email, phone number, timezone, session times).
  • Availability settings (recurring templates and overrides).
  • Message logs for WhatsApp notifications (delivery status and metadata).
  • Google OAuth refresh tokens if you connect Google Calendar.
  • Google Calendar event IDs and meeting links created during sync.

How we use your information

  • Provide scheduling, approvals, reminders, and booking workflows.
  • Sync approved sessions to your calendar.
  • Support account access, security, and customer support.
  • If you connect Google Calendar, we use Google user data only to create, update, or delete calendar events you request.

Data sharing and processors

We use trusted service providers to operate Calmbook. These include Supabase (auth and data storage), Twilio (WhatsApp delivery), Google (calendar OAuth and syncing), and Lemon Squeezy (billing).

Sharing, transfer, or disclosure of Google user data

We share or transfer Google user data only as needed to provide calendar syncing:

  • Google APIs to create, update, or delete calendar events you request.
  • Supabase (our database host) to store tokens and event IDs required for sync.

We do not sell Google user data or share it with third parties for advertising. We may disclose Google user data if required by law or to protect our rights. You can revoke access at any time in your Google account settings, and we will stop syncing after access is revoked.

Data protection and security

We use technical safeguards appropriate to the data we handle, including HTTPS/TLS for API communications with Google and Twilio, and server-side environment variables to store API secrets. Access to Google user data is limited to the calendar sync features you enable.

Google API Limited Use

Calmbook uses Google user data only to provide user-facing calendar sync features and complies with the Google API Services User Data Policy, including the Limited Use requirements.

Cookies and sessions

We use cookies and session tokens to keep you signed in and protect restricted routes.