Privacy Policy

Last updated: June 8, 2026

This Privacy Policy explains what information Tapestry Calendar (“Tapestry Calendar,” “we,” “us,” or “our”) collects, how we use it, and the choices you have. It applies to the Tapestry Calendar web application at tapestrycal.com and any related domains we operate (including app.tapestrycal.com). By using the service, you agree to this policy.

Information we collect

Account information. When you create an account we store your email address, an optional display name, and — if you sign up with a password — a salted hash of that password (never the password itself). If you sign in with Google, we receive your basic Google profile (name and email).
Calendar sources you connect. When you add a source, we store the information needed to read it: for Google calendars, an access/refresh token obtained through Google’s OAuth flow (stored encrypted); for ICS feeds, the feed URL. We then read the events from those sources.
Content you create. The workspaces, calendars, events, per-event edits, categories, people, tags, rules, color schemes, and sharing settings you create within the app.
Technical information. Basic logs and request metadata (such as IP address and browser type) used to operate the service, keep it secure, and diagnose problems.
Cookies. We use a first-party cookie to keep you signed in.

How we use Google user data

If you connect a Google calendar, we request read access to your Google Calendar data so we can display, merge, re-color, and re-publish your events the way you configure in the app. We access only the calendar data needed to provide these features.

Tapestry Calendar’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Google user data is used only to provide and improve the features described above; it is not sold, not used for advertising, and not used to train generalized AI/ML models. We do not allow humans to read your Google data except with your explicit consent, to comply with applicable law, as needed for security (e.g. investigating abuse), or in aggregated/anonymized form for operations.

You can revoke Tapestry Calendar’s access to your Google account at any time by removing the source in the app or via your Google Account permissions. Revoking access stops further reads and deletes the stored token.

How we use information

To provide, maintain, and operate the service.
To authenticate you and keep your account secure.
To sync, merge, transform, and publish the calendars you configure.
To send you essential account and workspace communications (such as invitations and password resets).
To diagnose problems, prevent abuse, and improve reliability.

How we share information

We do not sell your personal information. We share information only:

With people you choose. Members you invite to a workspace can see the calendars and events in it. Anyone you give a published feed URL to can subscribe to the events in that feed.
With service providers that host and run the app on our behalf (for example, Cloudflare for compute, storage, and content delivery), under obligations to protect the data.
For legal reasons, if required to comply with applicable law or to protect the rights, safety, and security of our users or the service.

Published feeds

Output calendars you publish are made available as iCalendar (.ics) feeds at unguessable URLs. Anyone who has the URL can read the events in that feed without signing in. Treat published feed URLs like a shared secret, and revoke a feed in the app if you no longer want it accessible.

Data retention

We keep your information for as long as your account is active. Cached events from a source are refreshed on sync and removed when you delete the source. When you delete your account, we delete your personal data and connected-source tokens within a reasonable period, except where we must retain limited records to comply with legal obligations.

Security

We protect data in transit with TLS and encrypt sensitive credentials (such as OAuth tokens) at rest. No system is perfectly secure, but we work to safeguard your information using industry-standard practices.

Your choices

Access or update your account details in the app.
Disconnect a calendar source or revoke Google access at any time.
Delete your account, which removes your associated data as described above.
Contact us to request access to or deletion of your personal data.

Children

Tapestry Calendar is not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal information from them.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, take additional steps as required by law.

Contact

Questions about this policy or your data? Email us at privacy@tapestrycal.com.