Privacy Policy for Pinluma

1. Introduction

Pinluma ("we", "our", or "the Application") is a calendar product developed by Expeditise LLC, available as a Windows/macOS desktop widget and as the Pinluma web and mobile apps (collectively, "the Service"). This Privacy Policy explains how we collect, use, store, and protect your information when you use Pinluma.

Desktop vs. cloud custody. On the desktop apps, your data, including provider OAuth tokens, stays on your device. The web and mobile apps require a server-side connection to your calendar provider, so for those products we hold an encrypted copy of your provider refresh token on our servers. Where this policy distinguishes the two, it says "desktop" or "web/cloud" explicitly.

By using Pinluma, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Calendar Data

When you connect your accounts to Pinluma, we access the following information:

• Google Calendar: Event titles, descriptions, start/end times, locations, attendees, and calendar metadata
• Outlook/Microsoft Calendar: Event titles, descriptions, start/end times, locations, attendees, and calendar metadata
• Recent changes (optional): If you add the Recent changes card, we keep a record of changes to your events and the last version we saw of each event, including its guest list, so we can show you what changed.
• Account Information: Your email address from connected accounts (used solely for authentication)

2.2 AI Feature Data (Optional)

If you enable AI features and provide your own OpenAI API key:

• Event Text: Natural language text you input for event creation
• Images: Images you paste or drop for AI processing (converted to text)
• Calendar Context: Limited calendar data sent to OpenAI for smart scheduling (event titles and times only, never confidential details)
• API Key: Your OpenAI API key (encrypted and stored locally in Windows Credential Manager)

2.3 Calendar Sharing Data (Optional)

Pinluma has two ways to share. Neither is on until you use it.

Sharing a calendar with another Pinluma user. When you share a calendar with a person, we keep a sharing record in our cloud: which calendar, who you shared it with, the level you chose, when you shared it, and the end date if you set one. The person sees only what the level allows, read from the synced copy of your events we already hold for the web and mobile apps:

• Busy only: The times you are busy, shown as "Busy" blocks. No titles, places, notes, guests or meeting links.
• Details: Titles, times and places, plus notes on events you created yourself. Events you marked private in Google or Outlook, invitations you have not answered, and events added from Gmail show as "Busy". Guest lists and meeting join links are never shared.

Only events from the moment you share onward are visible, never your history, and events you marked free or declined are never shared. The person must accept before they see anything. You can change the level, set or change an end date, or stop sharing at any time, and their access ends as soon as you do. They see your sign-in email as the name of the share. We use the email address you type only to deliver the invitation and to match it to that person's verified Pinluma sign-in.

Availability links. If you publish an availability link, we store:

• Availability Slots: Only free/busy time blocks (no event details like titles or descriptions)
• Time Zone: Your preferred time zone for display purposes
• Share Settings: Optional access controls (PIN/password) you configure

2.4 Application Settings

We store local preferences including:

• Widget position and size on your desktop
• Selected theme and opacity settings
• Refresh interval preferences
• Which calendars you've chosen to display

3. How We Use Your Information

Your information is used exclusively for the following purposes:

• Display Calendar Events: To show your upcoming events in the desktop widget
• Sync with Calendar Services: To retrieve and update your calendar information from Google Calendar and Outlook in real-time
• AI Event Creation: To process natural language and generate calendar events (using your own OpenAI API key)
• Calendar Sharing: To show a person you chose your calendar at the level you chose, and to share free/busy availability via secure links (link data stored temporarily on Cloudflare)
• Meeting Requests: To send and receive meeting invitations via email
• Offline Access: To cache events locally so you can view them without an internet connection
• Personalization: To remember your preferences and settings for the best user experience

We do NOT:

• Sell, rent, or share your data with third parties
• Use your data for advertising or marketing purposes
• Analyze your calendar content for any purpose other than displaying it to you
• Store your data on remote servers (all data is stored locally on your device)

4. How We Store and Protect Your Information

4.1 Local Storage (Desktop apps)

On the desktop apps, all your data is stored locally on your computer in the following locations:

• Event Cache: SQLite database at %AppData%\Pinluma\calendar_cache.db
• Settings: JSON file at %AppData%\Pinluma\settings.json
• OAuth Tokens: Windows Credential Manager (DPAPI encrypted)

4.2 Server-Side Custody (Web & mobile apps)

The web and mobile apps connect to your calendar provider on the server so your calendar can sync even when your device is offline. To do this we store, in our cloud (Amazon Web Services), only what is necessary:

• Account & identity: Your sign-in is managed by Amazon Cognito (email/password with optional multi-factor authentication, or Google/Microsoft social sign-in). Signing in is separate from granting calendar access.
• Provider refresh tokens: When you click "Connect" for Google or Outlook, we receive a refresh token for your calendar. We store it as an envelope-encrypted attribute in Amazon DynamoDB, encrypted with a dedicated AWS KMS key. Tokens are decrypted only in memory, only to sync your calendar on your behalf.
• Calendar data: Events and tasks needed to render your calendar are stored per-user, partitioned and access-scoped to your account only (no cross-account access). If you use the Recent changes card, a 15-day record of changes to your events is kept under the same per-user isolation.
• Tenant isolation: Every read and write is scoped to your user partition; we do not run bulk scans across users.

You can disconnect a provider at any time, which deletes the stored refresh token and revokes our server-side access. See Section 7 for retention and deletion.

4.3 Security Measures

We implement industry-standard security practices:

• Encrypted Storage: On desktop, OAuth tokens are encrypted using Windows DPAPI (Data Protection API). In the web/cloud, provider refresh tokens are envelope-encrypted with AWS KMS and DynamoDB is encrypted at rest.
• Scope minimization: The desktop apps request only read access where possible. The web/mobile apps request read/write calendar scopes (e.g. Google Calendar and Microsoft Calendars.ReadWrite) plus offline_access so you can create, edit, and delete events. We request no more than the features you use require.
• HTTPS Communication: All communication with Google and Microsoft servers uses secure HTTPS connections
• No Third-Party Services: We don't use external analytics or crash reporting services
• Optional AI Processing: AI features require your own OpenAI API key - we never send data to AI services without your explicit consent and API key

4.4 Calendar Sharing

When you share a calendar with another Pinluma user:

• Your copy stays yours: Nothing is copied into the other person's account. Their app reads the events the sharing record allows, from the synced copy we hold for you, on every request. A change you make, a level change, an end date passing, or stopping the share takes effect at once.
• Per-person, per-calendar levels: Each person has their own level on each calendar, Busy only unless you choose Details. Private events stay busy even at Details.
• Nobody can push a calendar on you: A share waits in your inbox until you accept it, and you can leave it at any time. Declining blocks repeat invitations from that person for 30 days.
• Verified identities: Invitations are matched to the recipient's verified sign-in email on our side. We never tell the sender whether an address has a Pinluma account.
• Kept out of everything else: Shared events never go to the AI features, never trigger reminders on the other person's devices, and are never included in availability links or meeting polls they publish.

When you publish an availability link:

• Cloudflare Infrastructure: Free/busy data is temporarily stored on Cloudflare Workers and KV for public link access
• Privacy-First: Only time blocks are shared, never event titles, descriptions, or attendee information
• User Control: You can regenerate or revoke share links at any time
• Optional Protection: Add PIN/password protection to restrict access to your availability

5. AI Features and OpenAI API

Pinluma offers optional AI-powered features that require your own OpenAI API key:

5.1 How AI Features Work

• You provide and manage your own OpenAI API key
• AI processing happens via OpenAI's servers (not ours)
• You control what data is sent for AI processing
• Minimal calendar context is shared (event titles/times only, never confidential meeting content)

5.2 Data Sent to OpenAI

When you use AI features, the following may be sent to OpenAI:

• Text you type for natural language event creation
• Images you paste or drop (converted to text via OCR)
• Limited calendar context for smart scheduling (dates, times, event titles only)

5.3 Your Responsibilities

• OpenAI's privacy policy applies to data processed through their API (OpenAI Privacy Policy)
• API usage costs are your responsibility
• You can disable AI features at any time in settings

6. Google and Microsoft API Services

6.1 Google Calendar API

Pinluma's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google Limited Use disclosure. This applies to Google user data accessed by our web/cloud service as well as the desktop apps. Specifically:

• We use Google Calendar (and, where enabled, Google Tasks) data only to provide and improve the user-facing calendar features you request.
• We do not transfer Google user data to others except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger/acquisition with your consent.
• We do not use Google user data for serving advertisements, and we do not use it to train generalized/third-party AI/ML models.
• We do not allow humans to read your Google user data unless we have your affirmative consent for specific messages, it is necessary for security (e.g. investigating abuse), to comply with applicable law, or the data is aggregated and used for internal operations in line with applicable privacy requirements.
• Refresh tokens for server-side calendar access are stored envelope-encrypted (AWS KMS) and are deleted when you disconnect the provider or delete your account.

6.2 Microsoft Graph API

When connecting Outlook/Microsoft Calendar, we comply with Microsoft's data handling requirements and the Microsoft Privacy Statement.

For both services:

• We only access the minimum data necessary to provide calendar display functionality
• We do not transfer your Google data to third parties
• We do not use your data for serving advertisements
• We do not allow humans to read your data unless required for security purposes or with your explicit consent