Early Access Privacy Notice

Secundant is an experimental, non-commercial scheduling service offered independently under the Secundant name and is not currently operated by a registered company. The Early Access operator is responsible for the account and service-operation processing described here. Contact privacy@secundant.app for privacy questions or requests.

Secundant may handle account name, email address, profile image, password credential hash, email-verification and password-reset records, sessions, security and rate-limit records, Event titles and descriptions, offered time windows, timezones, participant names and email addresses, booking selections, availability responses, final group meeting selections, and calendar synchronization status.

Secundant does not receive your Google password. Application passwords are processed as one-way password hashes rather than stored as readable passwords.

Information comes directly from account holders and participants, from Event owners who invite participants or describe meetings, from Google when a user chooses Google sign-in or Calendar access, and from ordinary technical requests needed to operate and secure the service.

Information is used to create and secure accounts, provide requested scheduling features, identify Event owners and participants, deliver transactional messages, perform user-initiated calendar actions, prevent abuse, diagnose failures, comply with legal obligations, and maintain Early Access. Where applicable, these activities rely on providing the requested service, legitimate interests in security and operation, compliance with law, or a user's specific choice to connect an optional provider.

Account holders decide why they create an Event, whom they invite, and what meeting information they request. Secundant processes participant information to provide that scheduling workflow. Participants should contact the Event owner about the purpose of a particular meeting and may also contact Secundant about information stored by the service.

Google connection is optional. If selected, Google may provide basic account identity and approved Calendar permissions. OAuth tokens and detailed token-health diagnostics remain server-side. Secundant uses Google data only to provide visible, user-requested sign-in and Calendar features and follows the Google API Services User Data Policy, including its Limited Use requirements. Google data is not used for advertising or to train generalized AI or machine-learning models.

Public Event URLs are designed to be shared with intended participants. Guest confirmation links can act as bearer links, so anyone with the link may be able to recover the associated confirmation. Avoid placing sensitive information in Event content and share links carefully.

Secundant uses necessary cookies for authentication, security, CSRF protection, and temporary Google-account linking. Account sessions can remain valid for up to 30 days. Browser local storage may remember theme, recently used timezones, and minimal guest recovery data consisting of a version, Event slug, and booking id. Secundant does not currently use advertising cookies or sell behavioral profiles.

Transactional emails may include verification and password-reset links, booking confirmations, owner notifications, availability receipts, and final group meeting confirmations. They are used for account security and the requested scheduling workflow, not third-party advertising.

Secundant uses service providers to operate Early Access, including Netlify for hosting, Neon for the application database, Resend for transactional email, and Google for optional identity and Calendar services. These providers process limited information needed for their functions and may process it in countries other than yours under their own terms and applicable transfer safeguards. Secundant does not sell personal information.

Account, Event, booking, and availability information is retained while needed to provide Early Access or until it is manually deleted. Authentication sessions expire after at most 30 days; email-verification links expire after 24 hours and password-reset links after 30 minutes. Expired technical records may remain until routine or manual cleanup. Provider logs and backups may follow their own limited retention schedules.

Automated inactive-account deletion is not yet implemented. Requests to access, correct, export, or delete information are handled manually through privacy@secundant.app. Some information may be retained where necessary for security, legal obligations, or backup recovery before later deletion.

Depending on where you live, you may have rights to receive information about processing, access or correct your information, request deletion or restriction, object to certain processing, receive portable data, withdraw an optional connection, or complain to a data-protection authority. Google access can also be disconnected in Secundant Settings or revoked through your Google Account.

Secundant uses access controls, hashed credentials and recovery secrets, server-side OAuth token storage, secure production cookies, rate limits, and purpose-limited logs. No online service can guarantee absolute security. Early Access should not be used for regulated or highly sensitive information.

Early Access is intended for adults and is not directed to children under 18. Do not create accounts for children or intentionally submit children's personal information.

This notice will be updated when Secundant's data practices materially change. The date above identifies the current version, and material changes will be communicated to Early Access users when practical. Contact privacy@secundant.app with questions, rights requests, or complaints. See the Early Access Terms for service rules.