Security and data
What it reads, what it keeps, what it never touches.
Written against what the software does, not against a template. If something here stops being true, the page changes the same day the code does.
Reads
- Which calendars you subscribe to
- When you are busy, live, each time it plans
- Text you type or paste, when you do
Stores
- Your tasks, blocks and drafts
- Working hours and calendar choices
- Google tokens, unreadable to users
- A mirror of your Stripe subscription
Never touches
- Your email, contacts or files
- Events it did not create
- Your card number
- Your data, for ads, sale or training
Straight answers
The questions people ask before connecting a calendar.
In plain words. Everything below this section is the same answers at full length.
- Do you store my calendar?
- No. Each time Pensova plans, it asks Google when you are busy, uses that to find free time, and forgets it. The only thing it keeps about your calendar is a short fingerprint of the busy pattern, so the background job can tell whether anything changed. The fingerprint cannot be turned back into your events.
- Can Pensova read my email, contacts or files?
- No. It asks Google for two Calendar permissions and nothing else, and Google shows you both before you approve. Google reviewed the app and verified it for those two permissions in September 2026.
- What does it put on my calendar?
- Only the blocks it places for your tasks. It edits and removes those blocks and never touches an event it did not create. You can delete or move a Pensova block like any other event, and Pensova respects that.
- Can anyone at Pensova see my calendar?
- No. The tokens that let the server act on your calendar cannot be read by any signed-in person, including you, and there is no screen at Pensova that shows anyone's calendar. The server uses them only to plan.
- Is my data used to train an AI?
- No. When you type a task in plain words or paste meeting notes, that text goes to Anthropic's Claude so it can be read into tasks. Your calendar is not sent. Anthropic does not train on it, and Pensova keeps only the drafts that come back, not the text.
- Where does it live, and who else handles it?
- In a Postgres database at Supabase in the United States, with every user's rows walled off from every other user's. The app runs on Vercel. Cards and billing addresses go to Stripe and never reach Pensova.
- How do I get out?
- Remove Pensova from your Google account permissions and it can no longer see or touch your calendar; the blocks it placed stay as ordinary events you own. To delete the account and everything stored, email privacy@pensova.com from your sign-up address; it is done within 30 days, usually the same day. A button for this is in development.
- Can I use it with my work calendar?
- If it is a Google calendar and your employer allows third-party apps, yes, and you choose which calendars count as busy. Microsoft 365 is not connected yet. An employer's tenant decides what gets in, which is as it should be.
Two Calendar permissions, and nothing else.
calendar.readonly- Lists the calendars you subscribe to and reads when you are busy. Needed because free time is not only about your primary calendar: a shared work calendar and a public-holiday calendar both occupy real time.
calendar.events- Creates, moves and deletes the events Pensova itself places. It only ever modifies events it created.
No Gmail, no contacts, no Drive. Google shows the full list before you approve, and you can revoke access at any time from your Google account permissions. Pensova’s use of Google data follows the Google API Services User Data Policy, including the Limited Use requirements.
Google verified Pensova for both Calendar permissions in September 2026, after reviewing the app, its home page, its branding and this policy. Sign-in shows Google’s ordinary permission screen with no warning.
Stored
What is in the database.
Postgres at Supabase, in the United States, with row-level security on every user table so a signed-in user can only reach their own rows.
| Data | What exactly | Who can read it |
|---|---|---|
| Account | Email address and Google account id. | You, and the server. |
| Tasks | Title, duration, deadline, priority, status, repeat rule, split setting. | You, and the server. |
| Scheduled blocks | The times chosen and the id of the Google event created for each. | You, and the server. |
| Drafts | Tasks proposed from capture or meeting notes, until accepted or dismissed. | You, and the server. |
| Settings | Working hours and days, first day of the week, which calendars count as busy. | You, and the server. |
| Calendar fingerprint | A short hash of your busy pattern, so the background job knows whether to replan. | The server only. |
| Google tokens | Needed to act on your calendar between visits. Row-level security with no access policies at all. | The server only. No signed-in user, including you. |
| Subscription | Plan, status, trial and renewal dates, Stripe customer and subscription ids. | You can read it. Only Stripe's webhook writes it. |
Your calendar events are not copied into the database. Pensova reads your availability from Google each time it plans, and forgets it. What it keeps about your calendar is the busy pattern reduced to a short fingerprint, so the background job can tell whether anything changed since it last looked. The fingerprint cannot be turned back into your events.
Processed, not stored
Plain-words capture and meeting notes.
A task typed in plain words, or pasted meeting notes, is sent to Anthropic’s Claude API together with your name and email, so the model can tell which items are yours. Your calendar is not sent. Anthropic does not train on API inputs.
The rule is extract and discard: the text is processed in memory and is not written to the database, to logs, or to any job queue. What is stored is the drafts that come back, until you accept or dismiss them. The model never writes to your task list or your calendar; it only proposes.
Billing
Your card never touches Pensova.
Checkout and the billing portal are hosted by Stripe. Card numbers and billing addresses go to Stripe and are never seen by Pensova’s servers. Pensova keeps a mirror of the subscription (plan, status, trial and renewal dates, Stripe’s ids) that is written only by Stripe’s signed webhook. No user can write to it, so nobody can promote their own plan.
Regulated data
An honest position for clinicians, lawyers and anyone under a compliance regime.
Pensova is not a HIPAA-compliant product today, and it does not claim to be. Becoming one requires a Business Associate Agreement with each covered entity and with every processor beneath us, plus audit logging, admin-consent sign-in and an independent security review. That is an enterprise track, and it is not built.
What holds now, and is designed to keep holding so that track can be built on it later: calendar events are never copied into our database; access tokens cannot be read by any signed-in user; and pasted text is processed and discarded rather than stored.
In practice, an employer’s Google or Microsoft tenant is admin-controlled and will not let a third-party app in without review. That is correct. A clinician can use Pensova on a personal Google account for the non-clinical half of their week today.
Reporting
Found something?
Write to security@pensova.com before telling anyone else. Good-faith reports are welcome and answered. For account deletion and privacy questions, privacy@pensova.com. The full Privacy Policy and Terms say the same things at greater length.