Privacy Policy

Last updated: 27 July 2026

Kalaroo (“we”, “us”) helps you share when you’re free and make plans with friends. This policy explains what we collect, why, and the choices you have. Kalaroo is operated from Canada, and our database is hosted in Canada (Supabase, ca-central-1).

Information we collect

• Account details — your email address, display name, handle, and optional profile fields (avatar, birthday) you choose to add.
• Scheduling data — the availability blocks, bookings, and notes you create.
• Social graph — the friends you connect with and the groups you create.
• Connected calendar data (only if you connect a calendar) — if you connect Google, Outlook, or Apple Calendar, we import your busy times. See the dedicated section below.
• Technical data — basic information your browser sends (e.g. device/browser type) and authentication data needed to keep you signed in.

How we use your information

• To run the core service: showing your availability to the friends you choose, coordinating bookings, and managing your account.
• To send account-related email (sign-in confirmation, password reset).
• To keep the service secure and prevent abuse.

We do not sell your personal information, and we do not use it for advertising.

Connected calendars

Connecting a calendar is entirely optional. When you connect one, Kalaroo imports only your busy times — the time ranges you already have events — so it can mark you as unavailable then. Event titles and details are stored privately and are never shown to your friends: friends see only that you are busy, not what you are doing. Access is read-only in every case — Kalaroo never creates, edits, or deletes events in your calendar.

• Google Calendar. We request read-only access (the calendar.events.readonly scope). Kalaroo’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: we do not transfer this data to third parties except as needed to provide the feature, do not use it for advertising, and do not allow humans to read it except with your consent, for security, or as required by law.
• Outlook / Microsoft. We request read-only calendar access (the Microsoft Graph Calendars.Read permission). Microsoft acts as the data source for your calendar events, which we use only to import your busy times.
• Apple Calendar (iCloud). Apple does not offer a calendar sign-in service, so connecting iCloud uses your Apple ID together with an app-specific password that you generate on your Apple ID account page. Kalaroo uses these read-only, over Apple’s CalDAV service, solely to import your busy times. The app-specific password is stored encrypted and is used for nothing else. You can revoke it at any time from your Apple ID account page — and you should if you disconnect.

You can disconnect any calendar at any time in Settings, which deletes the stored credentials (OAuth tokens for Google and Outlook; the app-specific password for Apple) for that provider.

How your information is stored and shared

• Service providers. We use Supabase (database and authentication, hosted in Canada) and Vercel (application hosting). If you connect a calendar, the corresponding provider — Google, Microsoft, or Apple — is involved as the source of that calendar’s data.
• Other users. Your display name, handle, and avatar are visible to people you’re connected with. Your availability is visible only to friends you’ve accepted.
• Legal. We may disclose information if required by law or to protect the safety of our users.

Security

Access to your data is enforced at the database level (row-level security), so you and your connections can only reach data you’re permitted to. Credentials for connected calendars — OAuth tokens for Google and Outlook, and the app-specific password for Apple — are stored encrypted, never in plain text.

Data retention and deletion

We keep your information for as long as your account is active. You can permanently delete your account at any time from Settings — this removes your profile, availability, bookings, friendships, groups, and any connected-calendar credentials (OAuth tokens and app-specific passwords).

Your rights

Consistent with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), you may access, correct, or delete your personal information, and withdraw consent for optional features (such as calendar sync). To make a request, contact us below.

Age

Kalaroo is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above.

Contact

Questions or requests: privacy@availsocial.com