What we keep, and why.

• Account: your name, email address, username and time zone.
• Scheduling settings: the teams, event types, weekly hours, date overrides, buffers and limits you set up, the email addresses you invite to a team, and the email addresses and domains you block.
• Bookings: for each booking, the invitee’s name, email, time zone and optional notes, the time, the meeting link and the status. We email the invitee when a booking is confirmed, moved or cancelled, and remind them a day and an hour before it, unless the host turns reminders off. We email hosts when the invitee books, moves or cancels.
• Calendar connections: the OAuth tokens (Google, Microsoft) or app-specific password (Apple iCloud) we need to reach your calendar. We encrypt them with AES-GCM before storing them.
• Security records: sign-in sessions, one-time sign-in codes, API keys and the AI assistants you connect. We store only hashes of their secrets, never the secrets themselves.
• Waitlist: the email, name and note you send if you join the waitlist.
• Payments: for paid event types, the price and the Stripe identifiers for the payment. Card details go directly to Stripe. We never see or store them.

When you connect a calendar, we use it for two things only:

• Checking when you are busy, so we offer only free times. We read busy times when someone views your booking page or books. We do not store the titles, attendees or contents of your existing events.
• Creating, updating and deleting events for bookings made through Tempi, including a Google Meet link if the event type uses one. We never touch other events.

Disconnecting a calendar in Tempi deletes its stored credentials immediately. You can also revoke access at any time in your Google, Microsoft or Apple account settings.

Signing in with Google asks for your basic profile (name, email) and, on the same screen, your Google Calendar. You can untick the calendar there and connect it later. The calendar needs the scopes calendar.freebusy and calendar.events.owned. With calendar.freebusy we read when your primary calendar is busy, never what the events are. With calendar.events.owned we create, update and delete the events for bookings made through Tempi on your primary calendar, and nothing else. We use Google user data only to provide the scheduling features described above.

Tempi’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to third parties except as needed to provide the service, to comply with the law, or with your consent. We do not use it for advertising. No person reads it unless you ask us to for support, or it is needed for security or legal reasons.

• In transit: every connection to Tempi uses HTTPS (TLS). Plain HTTP is redirected to HTTPS, and browsers are told to use HTTPS only. Tempi reaches Google, Microsoft, Apple, Stripe and Resend over HTTPS too.
• Calendar credentials: OAuth tokens and app-specific passwords are encrypted with AES-256-GCM before they are stored. The encryption key is kept as a secret, apart from the database.
• Secrets: sign-in codes, session tokens and API keys are stored only as SHA-256 hashes.
• Google Calendar data: we do not store it. Busy times are read when needed and kept in memory for at most a minute. For the events Tempi creates, we keep only their IDs, so we can update or delete them.
• Access: only the Tempi service and its operator can reach production data. No person reads Google user data unless you ask us to for support, or it is needed for security or legal reasons.
• Deletion: disconnecting a calendar deletes its credentials at once. Deleting your account deletes everything linked to it.

Tempi does not use AI or machine learning models, and it does not send your data to any AI service. We do not use Google user data, raw, aggregated or derived, to develop, improve or train AI or machine learning models, ours or anyone else’s. We do not transfer it to anyone who does.

People can use their own AI assistants with Tempi (see below). Those assistants never receive your calendar events. An invitee’s assistant sees only your free times, the same as your public booking page. An assistant you connect to your account sees what you see in the app. You choose to connect it, and you can disconnect it at any time.

AI assistants can read availability and make bookings through Tempi’s API and MCP server. An assistant acting for an invitee sees only what your public booking page shows: your event types and free times, never your calendar events. An assistant acting for you needs an API key you created, or your approval when you connect it. It can do only what you can do in the app, and a read-only connection cannot change anything. To cut off access, delete the key or disconnect the assistant in Settings.

• Cloudflare hosts the app, its database and the usage metrics. Its Workers AI runs the assistant in the demo on the AI assistants page, which reads what you type there.
• Resend sends our emails: sign-in codes, booking confirmations, changes, cancellations and reminders. It receives the recipient’s address and the email’s contents.
• Google, Microsoft and Apple hold your calendars and, if you use them, your sign-in.
• Stripe processes payments for paid event types, through your team’s own Stripe account.
• Photon (by Komoot, on OpenStreetMap data) suggests addresses while you type one for an in-person event type. It receives what you type and a point near your time zone’s main city, never who you are.

Each handles data under its own privacy policy. We share nothing with anyone else.

To learn whether Tempi works for people, we record product events on our own servers. For example: someone signed in, connected a calendar, viewed a booking page or made a booking, and whether it came from the web app, the API or an AI assistant. Events carry an internal account ID when you are signed in, but no names, email addresses or calendar contents. People who book without an account are never identified. The events are stored in Cloudflare Workers Analytics Engine, used only in aggregate (for example, daily and monthly active users), and never shared or sold.

A session cookie keeps you signed in. A short-lived cookie protects the Google or Microsoft sign-in flow. There are no analytics or advertising cookies, and no third-party trackers.

When you book someone with “Remember my name and email on this browser” ticked, your browser keeps them, so your next booking form is filled in. They stay in your browser. Not you? on the form clears them.

We keep your data while your account exists. Cancelled bookings stay in your history until you delete your account. To delete your account and everything linked to it, or to get a copy of your data, contact hello@meettempi.com. We act on requests within 30 days.

If this policy changes in a meaningful way, we update the date above and tell signed-in users in the app. For questions, contact hello@meettempi.com.