Privacy Policy

Last updated: February 22, 2026

Master Calendar ("we", "our", "the app") is a scheduling application operated by Black Cat Security. This policy describes how we collect, use, and protect your information.

Information We Collect

• Booking information: When you book a meeting, we collect your name, email address, and optionally your phone number.
• Calendar data: When an admin connects a Google or Microsoft calendar account, we access calendar free/busy information and event details solely to determine availability and create calendar events for confirmed bookings.
• Contact data: When an admin connects Contacts+, we access contact information to associate bookings with contact records.
• Usage data: We may collect referrer URLs and UTM parameters to understand how visitors reach booking pages.

How We Use Your Information

• To display available time slots and schedule meetings
• To create calendar events on the organizer's connected calendar
• To send booking confirmations (via calendar invitations)
• To prevent double-booking by checking calendar availability

Third-Party Services

We integrate with the following services:

• Google Calendar API: To read calendar availability and create events. Governed by Google's Privacy Policy.
• Microsoft Graph API: To read calendar availability and create events. Governed by Microsoft's Privacy Statement.
• Contacts+ API: To sync contact information. Governed by Contacts+ privacy policy.
• Zoom API: To create video meeting links for bookings.

Google API Services User Data Policy

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only use Google Calendar data to check availability and create booking events. We do not sell, share, or use this data for advertising purposes.

Data Storage and Security

Data is stored on Cloudflare's infrastructure (Workers, D1, KV). OAuth tokens are encrypted at rest using AES-256-GCM. We do not sell or share your personal data with third parties for marketing purposes.

Data Retention

Booking records are retained for as long as the organizer's account is active. You may request deletion of your data by contacting us.

Your Rights

You may request access to, correction of, or deletion of your personal data by contacting us at the email below.

Contact

For questions about this privacy policy, contact:
eric@blackcatsec.com