Privacy Policy

1. Who we are

Calino (“Calino,” “we,” “us,” or “our”) is operated by K2 Labs (FZE), a Free Zone Establishment registered in the Sharjah Research, Technology, and Innovation Park (SRTIP), United Arab Emirates, with its registered address at SRTIP, Block B, B14-149, Sharjah, United Arab Emirates.

This Privacy Policy explains what information Calino collects, how we use it, who we share it with, and the choices you have. It applies to calino.app and the Calino application (collectively, the “Service”).

If you have questions about this policy or want to exercise any of the rights described below, contact us at appcalino@gmail.com.

2. Information we collect

2.1 Account information

When you create a Calino account, we collect:

• Your email address (used for passwordless sign-in via a one-time code).
• A display name and time zone, which you can set in your profile.
• Display preferences (theme, date/time format).

We do not collect or store a password — sign-in uses a one-time code sent to your email.

2.2 Calendar and conferencing account information

When you connect a Google, Microsoft, or Zoom account, we collect and store:

• The connected account's email address, display name, and a stable account identifier issued by that provider.
• For Microsoft accounts, whether the account is a work/school account or a personal (consumer) account — used only to determine which conferencing features we can offer, never as a security boundary.
• OAuth access and refresh tokens, which we store encrypted (see Section 6) and use solely to act on your behalf with that provider's API.

We request only the following permissions (“scopes”) from each provider, and nothing broader:

• Google: read your calendar list and read/write calendar events; create and restrict access on Google Meet video spaces created for your bookings; your basic profile (name, email) to identify the connected account.
• Microsoft: read/write your calendars; create Microsoft Teams meetings via Microsoft's Online Meetings API; your basic profile (name, email) to identify the connected account.
• Zoom: create, update, and delete Zoom meetings owned by your own connected account; read your basic Zoom profile to identify the connected account. We never request account-wide or admin-level Zoom permissions.

We never request permission to manage your calendars themselves (create/delete/share calendars), read your contacts or mail, or act on behalf of anyone other than the account holder who explicitly connects it.

What our calendar read access is used for. For Google, this is the calendar.readonly scope. We use it to retrieve the calendars and events on the account you connect, so Calino can display your synchronized schedule back to you, compute your real-time availability, and detect scheduling conflicts before a booking link offers a time slot. We never use this access to browse calendars you haven't chosen to sync, and we don't use it for anything beyond showing you your own schedule and checking it for conflicts.

What our calendar event access is used for. For Google, this is the calendar.events scope. We use it to create, update, reschedule, and delete calendar events on your behalf, specifically: creating the event when you build one manually or a guest books a slot on your link, updating or moving it when a booking is rescheduled, and removing it when a booking is cancelled or deleted. This also covers managing the event's invitations, adding or removing the guest (and any other invitee) as a calendar attendee so the provider's own invitation and RSVP notifications reach them, and creating the Google Meet video link attached to the event when a booking or a manually created event requests Google Meet as its location. Microsoft and Zoom event access (Section 2.2 above) is used the same way for bookings and manual events that use those providers.

Google user data and the Google API Services User Data Policy. Calino's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The calendar and profile data we receive from your Google account is used only to provide and improve the user-facing scheduling features you've asked for; we do not use it to serve advertising; we do not allow humans to read it except with your affirmative consent, when necessary for security or legal compliance, or in an aggregated and anonymized form; and we do not transfer it to third parties except as described in Section 5.

2.3 Calendar and event data

Once you connect a calendar, we synchronize and store the calendars and events on that account that you choose to sync, including event titles, descriptions, times, locations, and attendee information, so that Calino can display your schedule and check it for conflicts when building booking links.

2.4 Booking information

From hosts: the booking links/types you create, your availability rules, and the calendars you choose to check for conflicts.

From guests: when someone books a meeting through your booking page, we collect the name, email address, and any notes they provide, along with the requested meeting time. A guest does not need a Calino account to book a meeting. Guests are responsible for not including sensitive information in free-text notes.

To protect booking pages against automated abuse, we temporarily record a one-way cryptographic hash of the visitor's IP address together with the booking link involved. We do not store the IP address itself, and this hashed value is used solely to rate-limit repeated booking attempts.

Guests and hosts can cancel or reschedule a booking using a secure, unique link sent by email or embedded in the calendar event — these links do not require an account or sign-in, and do not expire on a fixed schedule; they remain usable for as long as the booking itself can still be cancelled or rescheduled.

2.5 Support messages

If you contact us through the support form or by email, we receive the name, email address, topic and message you send. We use them only to respond to you and to improve support. They are delivered by email to our support inbox and kept there; they are not stored in the Calino database. Please do not include passwords or sign-in codes in a message.

2.6 Information we do not collect

We do not collect payment or billing information (Calino does not currently process payments), government identification numbers, or any special category of personal data, and we do not knowingly direct the Service at children.

3. Cookies and tracking

Calino uses a single, strictly necessary cookie set by our authentication provider to keep you signed in. The only other browser storage we use is a local, non-personal theme preference saved on your own device. We do not use advertising cookies, third-party analytics or tracking scripts, or any cross-site tracking technology. If this changes in the future, we will update this policy accordingly.

4. How we use your information

We use the information described above to:

• Provide the Service: authenticate you, sync your connected calendars, compute availability, create and manage bookings, and create video-conferencing links for your meetings.
• Send transactional email: booking confirmations, cancellation/reschedule notices, a video-meeting-link-ready notice, and reconnect alerts.
• Maintain the security and reliability of the Service, including rate-limiting abusive booking attempts.

We do not use your calendar content, booking details, or guest information for advertising, and we do not sell personal information.

5. Who we share information with

We share information only as needed to provide the Service:

• Meeting guests and other invitees: when a booking is made, the resulting calendar event (its time, title, location, and any video-conferencing link) is shared with the attendees on that event, including the guest who booked and anyone else added as an invitee, the same way any calendar invitation is shared. This happens through the connected calendar provider's own invitation system, not a separate Calino mailing.
• Google, Microsoft, and Zoom — to the extent you connect those accounts, to read/write calendar events and create video meetings using the access you've explicitly granted.
• Supabase — our database and authentication provider. Stores your account, calendar, booking, and encrypted-token data, and delivers sign-in one-time-code emails.
• Railway — our application hosting provider.
• Resend — our transactional email provider.

Each of these providers processes data only as our service provider. We do not sell your personal information, and we do not share it with third parties for their own marketing purposes. We may disclose information if required by law, or to protect the rights, property, or safety of Calino, our users, or the public.

6. How we protect your information

• OAuth access and refresh tokens are encrypted using AES-256-GCM authenticated encryption before being stored; they are never stored or transmitted in plain text, and never exposed to the browser.
• Every table containing your data is protected by database-level row-level security, with a narrow set of internal system tables restricted entirely to server-side access.
• Access to your raw connection tokens is restricted to the server-side processes that need them.
• Data in transit is encrypted (HTTPS/TLS).
• Our database provider encrypts stored data at rest as a standard part of its managed infrastructure.

No system is perfectly secure, and we cannot guarantee absolute security.

7. Data retention

• Booking records are retained for as long as your account remains active, unless you request deletion (Section 9).
• Calendar events older than roughly 90 days are automatically removed once no longer needed for sync and conflict-checking, except for active recurring series.
• Background job records are removed after 30 days.
• Disconnecting a calendar or conferencing account stops further syncing and hides that data from active views, but does not delete the historical record unless you separately request deletion.
• Video meetings created through Microsoft Teams are not automatically deleted when a booking is cancelled or rescheduled, Microsoft's API currently offers no supported way for us to do this, and the old meeting may remain accessible on Microsoft's own system via its original link.
• Video meetings created through Zoom are automatically deleted from Zoom when you cancel a booking through Calino, when you delete a manually created event that uses Zoom (including when the event is deleted directly in your calendar provider), or when you change that event's location away from Zoom. When a booking or event is rescheduled, the same Zoom meeting is moved to the new time and its link stays the same; only if the connected Zoom account has changed is the old meeting deleted and a new one created. Disconnecting your Zoom account immediately stops Calino from creating, modifying, or deleting any further Zoom meetings on that account.
• When you close your account, we aim to delete or irreversibly de-identify the personal data associated with it within 30 days, except where we are required to retain certain records for longer to comply with law. See Section 9.

8. International data transfers

Our infrastructure is configured to run in the following regions:

• Supabase (database and authentication): Northeast Asia (Seoul), South Korea.
• Railway (application hosting): Singapore.
• Resend (transactional email): Tokyo, Japan (ap-northeast-1).

These are the regions our infrastructure is configured to run in, not a guarantee that every piece of personal data remains exclusively within South Korea, Singapore, and Japan. Each provider may still process or transfer data through other countries as part of its own global operations, backups, or subprocessors (for example, outbound email delivery, fraud prevention, or support tooling). We have not independently verified or documented the specific legal safeguards (such as the EU Standard Contractual Clauses) that apply to those incidental transfers, and we do not claim any specific certification or contractual protection beyond what is stated here. If you need more detail for your own compliance purposes, contact us and we will request it directly from our providers.

9. Your rights and choices

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing (for example, under the EU/UK General Data Protection Regulation, or the UAE Personal Data Protection Law).

• You can disconnect a calendar or conferencing account at any time from the Integrations page.
• You can edit your profile information directly in the app.
• There is currently no self-service “delete my account” button in the product. To request deletion, contact us at appcalino@gmail.com. We aim to complete deletion requests within 30 days.
• To request a copy of your data, contact the same address.

A note on what “deletion” currently means for hosts with booking history. Calino deliberately does not delete booking records tied to meetings you've already held, so that guests' and hosts' past scheduling history isn't silently destroyed out from under either party. When you request account deletion, we will delete your profile, connected-account tokens, and calendar/event data, and remove the personal identifiers from your historical booking records, rather than deleting those records outright.

10. Children's privacy

Calino is not directed at, and we do not knowingly collect personal information from, anyone under the age of 16 (or the higher age of consent applicable in your jurisdiction). If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here with a new “Last updated” date, and for material changes, we will notify you by email.

12. Contact us

K2 Labs (FZE)
SRTIP, Block B, B14-149, Sharjah, United Arab Emirates
appcalino@gmail.com

You can also reach us through the support form.