Privacy Policy

Last updated 16 October 2026

Pensova schedules your work into your Google Calendar. To do that it has to read your calendars and write events to them. This page says exactly what it reads, what it keeps, and how to make it stop.

What Pensova asks Google for

Two Calendar permissions, and nothing else:

calendar.readonly: Lists the calendars you are subscribed to and reads the times you are busy. Needed because free time is not just about your primary calendar — a shared work calendar and a public-holiday calendar both occupy real time, and without this permission Pensova would book over them.
calendar.events: Creates, moves and deletes the events Pensova itself places. It only ever modifies events it created.

It does not ask for access to Gmail, contacts, Drive, or anything outside Calendar. Google shows you the full list before you approve it, and you can revoke it at any time from your Google account permissions page.

What is stored, and where

Your account: Email address and Google account id, so the app knows whose tasks are whose.
Your tasks: Whatever you type: title, how long it takes, deadline, priority, status, whether it repeats.
Scheduled blocks: The times Pensova chose and the id of the calendar event it created for each, so it can move or remove them later.
Drafts: Tasks proposed from your plain-words capture or pasted meeting notes, until you accept or dismiss them.
Your settings: Working hours and days, and which calendars count as conflicts.
Google access tokens: Needed to act on your calendar between visits. These live in a database table with row-level security enabled and no access policies at all, which means no signed-in user — including you — can read them through the application. Only the server itself can.

Your calendar events are not copied into our database. Pensova reads your availability from Google each time it plans, and forgets it. What it stores about your calendar is the busy pattern reduced to a short fingerprint, so a background job can tell whether anything changed since it last looked without re-reading everything. That fingerprint cannot be turned back into your events.

Data is held in Postgres at Supabase (United States) and the application runs on Vercel.

Plain-words capture and meeting notes

If you type a task in plain words — “deck for the board by Thursday, about two hours” — or paste meeting notes, that text is sent to Anthropic’s Claude API to be turned into structured drafts you then review. Only the text you typed or pasted is sent, together with your name and email so the model can tell which items are yours; your calendar is not. Anthropic does not train on API inputs.

The notes themselves are processed in memory and discarded: they are not stored, logged, or kept in any job queue. What is stored is the drafts that come back, until you accept or dismiss them. If you never use these features, nothing is ever sent.

Email we send you

Account and billing emails carry no tracking. A beta invitation records whether its link was clicked, so we know the invitation arrived and worked; it does not record whether the email was opened, and nothing in it identifies you to anyone else.

The waitlist, and signing up from an ad

If you join the waitlist or ask for a beta invitation, on the site or through a sign-up form in one of our Facebook or Instagram ads, we store your email address, a referral code of your own, the code of whoever referred you if anyone did, and a short tag for where you came from (for example, which ad). We use these to send your invitation and news about Pensova, to count referrals, and to see which ads work.

When you tap Sign up on one of our ads, Meta shows you a form with your email already filled in. Pressing Submit sends that email address to us; nothing else from your Facebook or Instagram account is passed to us. Meta’s handling of the form is covered by Meta’s Privacy Policy.

Your email, referral codes and where-from tag are also kept in our mailing list at Loops, which sends the newsletter; invitations and account emails are sent through Postmark. Both process it only to send email for us. To be removed from the waitlist and the mailing list, reply to any email or write to privacy@pensova.com.

Cookies

Pensova sets the cookies it needs to work. Signed in, a session cookie keeps you signed in; a small cookie remembers your device’s time zone; if you arrived through a beta invitation, a cookie carries the invitation code through sign-in and is then removed; connecting a company social account uses a short-lived cookie to protect that sign-in; and one cookie remembers the choice you make on the cookie bar, for six months. None of these is used to track you across other sites and none is shared with anyone.

With your permission, one more: a Meta cookie called _fbp (and _fbc if you arrived from one of our ads) so that Meta can tell us which ads lead to sign-ups. It is set only after you press Accept on the bar at the bottom of the site, and it is the only reason that bar exists. Choose Only essential and nothing from Meta is loaded or set. You can change your mind here at any time; switching to Only essential removes the Meta cookies at once.

The beta sign-up page also keeps a random code in your browser’s storage, not a cookie, so that we can count visits from our ads: whether the page was viewed, read for a few seconds or scrolled, and whether it opened inside the Facebook or Instagram app. The code is not linked to your name or email, is not shared, and is not used anywhere else. Clearing your browser’s site data removes it.

Advertising measurement

If you accepted the measurement cookie, two moments are reported to Meta: that a sign-up happened, and that a first calendar connection happened. With each, Meta receives your IP address and browser, a hashed version of your email address (a fingerprint Meta can match against its own accounts but cannot turn back into the address), and the ids from its own cookies. That is the whole list. Nothing from your calendar, your tasks or your notes is ever sent, and nothing is sent at all unless you pressed Accept. We use what comes back only to see which ads are worth running.

Billing

Payment is handled by Stripe. Your card number and billing address go to Stripe and never touch Pensova’s servers. Pensova stores a copy of the subscription itself — plan, status, trial and renewal dates, and Stripe’s customer and subscription ids — so the app knows what you are entitled to without asking Stripe on every page.

If you sign in but do not start a trial, we may send up to two reminder emails about the trial, a few days apart, through our mailing provider. Each carries an opt-out, and replying to either stops them. We send nothing else unless you ask for it.

Google user data, specifically

Pensova’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Concretely, Google Calendar data is used only to provide the scheduling you can see in the app. It is not used for advertising, not sold, not transferred to anyone else except as needed to run the service, and not read by a human except where you have asked for support in writing, or where the law requires it.

How Google user data is protected

Sensitive data means the calendar information Pensova reads from Google and the access tokens that let it do so. These are the mechanisms that protect it:

Encryption in transit. Every connection between your browser and Pensova, between Pensova and Google, and between Pensova and its database uses TLS. There is no unencrypted path.
Encryption at rest. The database (Supabase, hosted in the United States) encrypts stored data at rest, including the table that holds Google access and refresh tokens.
Access controls. Every user table has row-level security, so a signed-in account can read only its own rows. The token table has row-level security with no access policies at all: no signed-in user, including you, can read tokens through the app. Only the server, with a key that never reaches a browser, can use them, and only to call Google on your behalf.
Minimal storage. Calendar events are never copied into the database. Availability is read from Google each time a plan runs and discarded; what is kept is a short hash of your busy pattern that cannot be turned back into events.
Operational access. Production systems are reachable only by the operator’s own accounts, protected by strong passwords and, where the provider offers it, two-step verification. Access is used for running the service and answering support you have asked for, and is not used to browse user data.
Retention and deletion. Tokens are deleted the moment you disconnect Google or delete your account, and when Google tells us a grant has been revoked. Account deletion removes everything stored about you; see “Getting rid of it” below.
Incidents. If we learn of unauthorized access to Google user data, we will notify affected users at the address on their account within 72 hours of confirming it, and describe what was affected and what we did.

What is never done with it

It is not sold, rented, or licensed to anyone.
It is not used to target advertising. Google Calendar data never reaches Meta or any other advertiser; with your consent, only the fact that a sign-up or a first calendar connection happened is reported, as described under Advertising measurement.
It is not used to train machine-learning models.
It is not shared with third parties beyond the services named above, which process it only to run the service.

Getting rid of it

Disconnecting Pensova in your Google account permissions revokes its access immediately; it can no longer read or change anything on your calendar. Events it already created stay on your calendar and are yours to keep or delete.

To delete the account itself and everything stored with it, email privacy@pensova.com from the address you signed up with. Deletion is permanent, covers tasks, blocks, drafts, settings, tokens and the subscription record, and is done within 30 days. This is currently a manual request rather than a button in the app — that is a gap, and it will become a button.

Phone testing, only if you turn it on

Beta testers can open a phone check page and, after ticking an agreement and pressing Start, let their phone record for 48 hours what it does in Pensova: the walkthrough steps shown, the buttons pressed, the screens opened, any errors, and the phone’s model, browser and screen size. Nothing typed is recorded. It is used only to find and fix problems, is never sold or shared, can be stopped at any time from that page or from Settings, and the recordings are deleted after 90 days. Nothing is recorded unless you turn it on.

How long things are kept

Tasks, blocks and settings are kept until you delete them or the account. Access tokens are replaced each time they are refreshed and deleted outright when Google tells us the grant is gone. Server logs, which record request paths and errors but not calendar contents, are kept for up to 30 days by the providers above.

Changes, and getting in touch

Material changes to this policy will be reflected in the date at the top of this page, and anyone with an account will be emailed before they take effect. Questions go to privacy@pensova.com.