Privacy policy
Last updated: October 13, 2026
Slotwise ("we") is a scheduling service operated by Andrew Gartner at slotwise.gartners.org. This policy covers account holders ("hosts") and the people who book time with them ("guests").
What we collect
- Hosts: your Google account name, email address and Google account ID; the handle and settings you choose; an encrypted Google OAuth refresh token; and session and API-token records (stored only as hashes).
- Guests: the name, email address, time zone and optional notes you enter when booking, plus the booking time.
- Operational: IP-based rate-limit counters, kept for a few minutes, and standard Cloudflare request logs.
How we use Google user data
Slotwise requests exactly these scopes, and only uses them as described:
openid,email,profile: to sign you in, identify your account, and show your name and email address in the dashboard.https://www.googleapis.com/auth/calendar.freebusy: to query free/busy times on the calendars you select (FreeBusy API), so guests are offered only open times. We receive busy time ranges only, never event details.https://www.googleapis.com/auth/calendar.calendarlist.readonly: to list your calendars (calendarList.list) so you can choose which ones count as busy and where bookings go.https://www.googleapis.com/auth/calendar.events: to create the event (with a Google Meet link and an invitation to the guest) when someone books you (events.insert), and to delete it if the booking is cancelled (events.delete). Slotwise doesn't read, list or change any other events.
We don't store your event titles, descriptions or attendees, apart from the events Slotwise itself creates. We don't use Google user data for advertising, we don't sell it, and we don't use it to train AI models. People never read it except when you ask for support, for security reasons, or when the law requires it. Slotwise's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Sharing
Guest details are shared with the host they book with and added to the host's calendar invitation. We use Cloudflare (hosting and database) and Google (calendar) as processors. We don't share data with anyone else unless the law requires it.
Security and retention
Refresh tokens are encrypted with AES-GCM, and sessions and API tokens are stored as SHA-256 hashes. Bookings are kept until the host deletes them or deletes their account. You can disconnect Google from the dashboard, or revoke access at myaccount.google.com/permissions. Deleting your account removes your user record, settings, tokens, bookings and polls.
Contact
Questions or deletion requests: andrew@gartners.org.