Privacy Policy

Sharing, Transfer, and Disclosure of Google User Data

We do not sell, rent, or share Google user data with third parties for advertising, marketing, or any other commercial purpose. We do not use Google user data to train generalized or large language models.

Google user data is only transferred to the following infrastructure sub-processors strictly as needed to operate the service:

• Supabase, Inc. — encrypted database and authentication storage (hosted on AWS, US region).
• Vercel Inc. — application hosting and edge compute for the Yvori web and API layer.

We may also disclose Google user data if required by law, valid legal process, or to protect the rights, property, or safety of Yvori, our users, or the public. We will not disclose Google user data to any other party except with your explicit consent.

Data Protection for Sensitive Data

We treat Google user data (including OAuth access and refresh tokens, and calendar event content) as sensitive and protect it with the following safeguards:

• OAuth refresh tokens are encrypted at rest using AES-256 in our database.
• All data is transmitted over TLS 1.2+ (HTTPS) between your device, Google, and our servers.
• Access to production systems storing Google user data is restricted to authorized personnel, protected by multi-factor authentication, and logged for audit.
• Row-level security (RLS) policies at the database layer ensure that each user's Google user data is isolated and only accessible to that user's authenticated session.
• We follow the principle of least privilege: we only request the minimum OAuth scopes necessary for the calendar sync feature.

Retention and Deletion of Google User Data

We retain Google user data only as long as necessary to provide the calendar sync feature:

• While your account is active and calendar sync is connected: we retain OAuth tokens and a cache of synced event metadata to keep your calendar in sync.
• When you disconnect Google Calendar in Yvori: we revoke the OAuth token with Google and delete all associated tokens and cached event data from our systems within 30 days.
• When you delete your Yvori account: all Google user data (tokens and cached events) is deleted within 30 days. Backups are purged on a rolling 35-day cycle.

You can revoke Yvori's access to your Google account at any time by:

1. Disconnecting the integration inside Yvori: Settings → Integrations → Google Calendar → Disconnect, or
2. Revoking access directly from your Google Account at myaccount.google.com/permissions, or
3. Emailing us at saad@maxmin.agency to request deletion.