Security and data
What it reads, what it keeps, what it never touches.
Written against what the software does, not against a template. If something here stops being true, the page changes the same day the code does.
Reads
- Which calendars you subscribe to
- When you are busy, live, each time it plans
- Text you type or paste, when you do
Stores
- Your tasks, blocks and drafts
- Working hours and calendar choices
- Google tokens, unreadable to users
- A mirror of your Stripe subscription
Never touches
- Your email, contacts or files
- Events it did not create
- Your card number
- Your data, for ads, sale or training
Two Calendar permissions, and nothing else.
calendar.readonly- Lists the calendars you subscribe to and reads when you are busy. Needed because free time is not only about your primary calendar: a shared work calendar and a public-holiday calendar both occupy real time.
calendar.events- Creates, moves and deletes the events Pensova itself places. It only ever modifies events it created.
No Gmail, no contacts, no Drive. Google shows the full list before you approve, and you can revoke access at any time from your Google account permissions. Pensova’s use of Google data follows the Google API Services User Data Policy, including the Limited Use requirements.
Google’s verification of the app is under review. Until it is granted, Google shows an “unverified app” screen at sign-in that you can click through, and the app is limited to 100 users in total.
Stored
What is in the database.
Postgres at Supabase, in the United States, with row-level security on every user table so a signed-in user can only reach their own rows.
| Data | What exactly | Who can read it |
|---|---|---|
| Account | Email address and Google account id. | You, and the server. |
| Tasks | Title, duration, deadline, priority, status, repeat rule, split setting. | You, and the server. |
| Scheduled blocks | The times chosen and the id of the Google event created for each. | You, and the server. |
| Drafts | Tasks proposed from capture or meeting notes, until accepted or dismissed. | You, and the server. |
| Settings | Working hours and days, first day of the week, which calendars count as busy. | You, and the server. |
| Calendar fingerprint | A short hash of your busy pattern, so the background job knows whether to replan. | The server only. |
| Google tokens | Needed to act on your calendar between visits. Row-level security with no access policies at all. | The server only. No signed-in user, including you. |
| Subscription | Plan, status, trial and renewal dates, Stripe customer and subscription ids. | You can read it. Only Stripe's webhook writes it. |
Your calendar events are not copied into the database. Pensova reads your availability from Google each time it plans, and forgets it. What it keeps about your calendar is the busy pattern reduced to a short fingerprint, so the background job can tell whether anything changed since it last looked. The fingerprint cannot be turned back into your events.
Processed, not stored
Plain-words capture and meeting notes.
A task typed in plain words, or pasted meeting notes, is sent to Anthropic’s Claude API together with your name and email, so the model can tell which items are yours. Your calendar is not sent. Anthropic does not train on API inputs.
The rule is extract and discard: the text is processed in memory and is not written to the database, to logs, or to any job queue. What is stored is the drafts that come back, until you accept or dismiss them. The model never writes to your task list or your calendar; it only proposes.
Billing
Your card never touches Pensova.
Checkout and the billing portal are hosted by Stripe. Card numbers and billing addresses go to Stripe and are never seen by Pensova’s servers. Pensova keeps a mirror of the subscription (plan, status, trial and renewal dates, Stripe’s ids) that is written only by Stripe’s signed webhook. No user can write to it, so nobody can promote their own plan.
Regulated data
An honest position for clinicians, lawyers and anyone under a compliance regime.
Pensova is not a HIPAA-compliant product today, and it does not claim to be. Becoming one requires a Business Associate Agreement with each covered entity and with every processor beneath us, plus audit logging, admin-consent sign-in and an independent security review. That is an enterprise track, and it is not built.
What holds now, and is designed to keep holding so that track can be built on it later: calendar events are never copied into our database; access tokens cannot be read by any signed-in user; and pasted text is processed and discarded rather than stored.
In practice, an employer’s Google or Microsoft tenant is admin-controlled and will not let a third-party app in without review. That is correct. A clinician can use Pensova on a personal Google account for the non-clinical half of their week today.
Reporting
Found something?
Write to security@pensova.com before telling anyone else. Good-faith reports are welcome and answered. For account deletion and privacy questions, privacy@pensova.com. The full Privacy Policy and Terms say the same things at greater length.