Privacy Policy for Pinluma

1. Introduction

Pinluma ("we", "our", or "the Application") is a calendar product developed by Expeditise LLC, available as a Windows/macOS desktop widget and as the Pinluma web and mobile apps (collectively, "the Service"). This Privacy Policy explains how we collect, use, store, and protect your information when you use Pinluma.

Desktop vs. cloud custody. On the desktop apps, your data — including provider OAuth tokens — stays on your device. The web and mobile apps require a server-side connection to your calendar provider, so for those products we hold an encrypted copy of your provider refresh token on our servers. Where this policy distinguishes the two, it says "desktop" or "web/cloud" explicitly.

By using Pinluma, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Calendar Data

When you connect your accounts to Pinluma, we access the following information:

• Google Calendar: Event titles, descriptions, start/end times, locations, attendees, and calendar metadata
• Outlook/Microsoft Calendar: Event titles, descriptions, start/end times, locations, attendees, and calendar metadata
• Account Information: Your email address from connected accounts (used solely for authentication)

2.2 AI Feature Data (Optional)

If you enable AI features and provide your own OpenAI API key:

• Event Text: Natural language text you input for event creation
• Images: Images you paste or drop for AI processing (converted to text)
• Calendar Context: Limited calendar data sent to OpenAI for smart scheduling (event titles and times only, never confidential details)
• API Key: Your OpenAI API key (encrypted and stored locally in Windows Credential Manager)

2.3 Calendar Sharing Data (Optional)

If you enable calendar sharing:

• Availability Slots: Only free/busy time blocks (no event details like titles or descriptions)
• Time Zone: Your preferred time zone for display purposes
• Share Settings: Optional access controls (PIN/password) you configure

2.4 Application Settings

We store local preferences including:

• Widget position and size on your desktop
• Selected theme and opacity settings
• Refresh interval preferences
• Which calendars you've chosen to display

3. How We Use Your Information

Your information is used exclusively for the following purposes:

• Display Calendar Events: To show your upcoming events in the desktop widget
• Sync with Calendar Services: To retrieve and update your calendar information from Google Calendar and Outlook in real-time
• AI Event Creation: To process natural language and generate calendar events (using your own OpenAI API key)
• Calendar Sharing: To share free/busy availability via secure links (data stored temporarily on Cloudflare)
• Meeting Requests: To send and receive meeting invitations via email
• Offline Access: To cache events locally so you can view them without an internet connection
• Personalization: To remember your preferences and settings for the best user experience

We do NOT:

• Sell, rent, or share your data with third parties
• Use your data for advertising or marketing purposes
• Analyze your calendar content for any purpose other than displaying it to you
• Store your data on remote servers (all data is stored locally on your device)

4. How We Store and Protect Your Information

4.1 Local Storage (Desktop apps)

On the desktop apps, all your data is stored locally on your computer in the following locations:

• Event Cache: SQLite database at %AppData%\Pinluma\calendar_cache.db
• Settings: JSON file at %AppData%\Pinluma\settings.json
• OAuth Tokens: Windows Credential Manager (DPAPI encrypted)

4.2 Server-Side Custody (Web & mobile apps)

The web and mobile apps connect to your calendar provider on the server so your calendar can sync even when your device is offline. To do this we store, in our cloud (Amazon Web Services), only what is necessary:

• Account & identity: Your sign-in is managed by Amazon Cognito (email/password with optional multi-factor authentication, or Google/Microsoft social sign-in). Signing in is separate from granting calendar access.
• Provider refresh tokens: When you click "Connect" for Google or Outlook, we receive a refresh token for your calendar. We store it as an envelope-encrypted attribute in Amazon DynamoDB, encrypted with a dedicated AWS KMS key. Tokens are decrypted only in memory, only to sync your calendar on your behalf.
• Calendar data: Events and tasks needed to render your calendar are stored per-user, partitioned and access-scoped to your account only (no cross-account access).
• Tenant isolation: Every read and write is scoped to your user partition; we do not run bulk scans across users.

You can disconnect a provider at any time, which deletes the stored refresh token and revokes our server-side access. See Section 7 for retention and deletion.

4.3 Security Measures

We implement industry-standard security practices:

• Encrypted Storage: On desktop, OAuth tokens are encrypted using Windows DPAPI (Data Protection API). In the web/cloud, provider refresh tokens are envelope-encrypted with AWS KMS and DynamoDB is encrypted at rest.
• Scope minimization: The desktop apps request only read access where possible. The web/mobile apps request read/write calendar scopes (e.g. Google Calendar and Microsoft Calendars.ReadWrite) plus offline_access so you can create, edit, and delete events — we request no more than the features you use require.
• HTTPS Communication: All communication with Google and Microsoft servers uses secure HTTPS connections
• No Third-Party Services: We don't use external analytics or crash reporting services
• Optional AI Processing: AI features require your own OpenAI API key - we never send data to AI services without your explicit consent and API key

4.4 Calendar Sharing

When you enable calendar sharing:

• Cloudflare Infrastructure: Free/busy data is temporarily stored on Cloudflare Workers and KV for public link access
• Privacy-First: Only time blocks are shared, never event titles, descriptions, or attendee information
• User Control: You can regenerate or revoke share links at any time
• Optional Protection: Add PIN/password protection to restrict access to your availability

5. AI Features and OpenAI API

Pinluma offers optional AI-powered features that require your own OpenAI API key:

5.1 How AI Features Work

• You provide and manage your own OpenAI API key
• AI processing happens via OpenAI's servers (not ours)
• You control what data is sent for AI processing
• Minimal calendar context is shared (event titles/times only, never confidential meeting content)

5.2 Data Sent to OpenAI

When you use AI features, the following may be sent to OpenAI:

• Text you type for natural language event creation
• Images you paste or drop (converted to text via OCR)
• Limited calendar context for smart scheduling (dates, times, event titles only)

5.3 Your Responsibilities

• OpenAI's privacy policy applies to data processed through their API (OpenAI Privacy Policy)
• API usage costs are your responsibility
• You can disable AI features at any time in settings

6. Google and Microsoft API Services

6.1 Google Calendar API

Pinluma's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google Limited Use disclosure. This applies to Google user data accessed by our web/cloud service as well as the desktop apps. Specifically:

• We use Google Calendar (and, where enabled, Google Tasks) data only to provide and improve the user-facing calendar features you request.
• We do not transfer Google user data to others except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger/acquisition with your consent.
• We do not use Google user data for serving advertisements, and we do not use it to train generalized/third-party AI/ML models.
• We do not allow humans to read your Google user data unless we have your affirmative consent for specific messages, it is necessary for security (e.g. investigating abuse), to comply with applicable law, or the data is aggregated and used for internal operations in line with applicable privacy requirements.
• Refresh tokens for server-side calendar access are stored envelope-encrypted (AWS KMS) and are deleted when you disconnect the provider or delete your account.

6.2 Microsoft Graph API

When connecting Outlook/Microsoft Calendar, we comply with Microsoft's data handling requirements and the Microsoft Privacy Statement.

For both services:

• We only access the minimum data necessary to provide calendar display functionality
• We do not transfer your Google data to third parties
• We do not use your data for serving advertisements
• We do not allow humans to read your data unless required for security purposes or with your explicit consent