Privacy Policy

Last updated: 12 July 2026

pika (“the App”, “we”, “us”) is a scheduling and client-management app for coaches and professionals, operated by the developer at [email protected]. This policy explains what data the App accesses when you connect your Google Account, why, and how we protect it.

1. Information we access

The App only accesses Google data if you explicitly connect your Google Account from the in-app Calendar screen. With your consent we request:

• Your email address and basic profile (openid, email) — to show which Google account is connected.
• Your Google Calendar (https://www.googleapis.com/auth/calendar) — to read your events so the App can display your busy time alongside your pika sessions, and to create, update or delete calendar events that you initiate inside the App.

We do not access Gmail, Drive, Contacts, or any other Google data.

2. How we use it

Google Calendar data is used solely to provide the calendar-sync feature you requested: overlaying your existing Google events on your weekly schedule and letting you manage events from the App. We do not use it for advertising, profiling, or any purpose unrelated to this feature.

3. How we store and protect it

The only sensitive data we retain is the Google OAuth refresh token that lets the App act on your Calendar at your request. We do not copy your calendar events into our own database — they are fetched live from Google each time you open the Calendar screen and are not persisted on our server.

• Encryption in transit: all traffic between the App, our server and Google travels exclusively over TLS/HTTPS. Your token is never placed in a URL, query string, or log file.
• Protection at rest: the refresh token is stored on our server outside the public web root (it is never web-accessible), in a file with restricted operating-system permissions, keyed by a one-way SHA-256 hash of your app token — your account identifier is never stored in the clear.
• Access control: access to the server and the stored token is limited to the App’s operator, solely to run the calendar-sync feature. No other employee, contractor, or third party can access it.
• No sharing, no secondary use: we do not sell, rent, or share your Google data, and we do not transfer it to anyone except Google’s own APIs as needed to provide the feature. It is never used for advertising, profiling, or to develop, improve, or train generalized AI/ML models.
• Deletion: disconnecting Google in the App (see section 5) immediately and permanently deletes the stored token from our server.

5. Data retention and deletion

You can disconnect Google at any time from the App’s Calendar screen (the “Disconnect” button). Disconnecting immediately deletes the stored refresh token from our server, revoking the App’s ongoing access. You may also revoke access directly at myaccount.google.com/permissions. To request deletion of any remaining data, email [email protected].

6. Changes

We may update this policy; material changes will be reflected by the “Last updated” date above.

7. Contact

Questions about this policy: [email protected].

---