← Commonhour
Privacy Policy
Effective date: September 19, 2026 · Updated October 17, 2026
1. Information We Collect
Information you give us directly:
- Your name and email address, when you create or respond to a plan
- The plan details you enter: plan name, dates, time window, location or meeting link, and your marked availability
- If you create an account: your email, and a password if you choose that sign-in method
- If you buy a plan or an add-on: your payment details, which you enter on Stripe's checkout page and not on ours. We receive and keep your plan, subscription status, billing period dates and a Stripe customer ID, but never your full card number (see Section 5)
- If you choose to connect a Google calendar: the permission you grant on Google's consent screen, and the connection token that lets Commonhour read your availability (see Section 4)
- If you join the waitlist for a feature that isn't released yet (such as Organizer): your email address, the feature you asked about, and your account if you were signed in
- If you email us for support: whatever you include in that message
Information collected automatically:
- Standard technical data (IP address, browser type, device type) collected by our hosting provider
- Cookies and local storage used to keep you signed in and remember your admin status on a plan you organized
- Usage counts that let us apply plan limits, such as how many invitation emails you send in a month
2. How We Use Information
- To run the core service: matching everyone's availability, showing the group heatmap, and generating the calendar invite (Google Calendar / Outlook / .ics) with names and emails pre-filled
- To send you sign-in emails (a magic link or a one-time code) if you use passwordless sign-in
- To save your plan history if you create an account ("My Plans")
- To process payments, manage subscriptions and give your account the features of the plan you chose
- To apply plan limits, such as the number of responses on a plan or invitation emails per month
- To connect your calendar, only if you choose to, as described in Section 4
- To email you once when a feature you joined the waitlist for launches. We use waitlist addresses for that and nothing else; reply to that email or contact us to be removed
- To detect and prevent abuse (for example, the response cap on no-account plans)
We do not sell your personal information, and we do not use your name, email, availability or calendar data to train any AI model.
3. Who We Share Information With
We use a small number of service providers to run Commonhour, each of whom only sees what they need to do their job:
| Provider | What they handle |
|---|
| Supabase | Database, authentication (magic link, OTP, password) |
| Resend | Delivery of sign-in and notification emails |
| Cloudflare | Website hosting |
| Stripe | Payment processing, subscriptions, receipts and billing management. For some purchases Stripe may act as the seller of record and handle sales tax. Stripe collects and uses payment information under its own privacy policy |
| Google (Google Calendar) | Only if you connect a Google calendar: the calendar you authorize, as described in Section 4 |
We don't share your data with anyone else. Supabase, Resend and Cloudflare are not permitted to use your data for their own purposes beyond providing the service to us. Stripe and Google handle information for the parts of the service they run (payments and your calendar account) under their own privacy policies.
4. Calendar Connection (Google)
Connecting a calendar is optional. Commonhour works fully without it, and the calendar invite you generate when a time is booked never requires it. If you choose to connect a Google calendar, you give permission on Google's own consent screen, and we ask only for the access the feature needs.
What we access, and why: Commonhour only reads your availability, to pre-fill the times you are free when you respond to or organize a plan. We use only your busy and free times. We do not store, display or use the titles, descriptions, locations or guests of your events. Depending on the provider, the permission you grant may technically allow access to more than your availability; we request only what the feature needs and discard everything except busy and free times.
What we never do to your calendar: Commonhour never creates, changes or deletes anything on your calendar. When a time is booked, you add the event yourself with the calendar invite button.
What we do not do: we do not sell this information, use it for advertising, or use it to train any AI model. We do not allow people to read it, except with your consent, to investigate abuse or a security problem, or where the law requires. We do not transfer it to others except as needed to provide the feature you turned on or to comply with the law.
Google API Services User Data Policy: Commonhour's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Storage and disconnecting: We store the encrypted connection token that lets Commonhour read your availability. We do not keep a copy of your calendar. You can disconnect at any time from your Profile page in Commonhour, or by removing Commonhour's access in your Google Account's app permissions. When you disconnect, we delete the token and revoke the connection with Google. If you delete your account (see Section 6), we disconnect your calendar first, so the token is deleted and the connection is revoked with Google, and then we delete the account.
5. Payments and Billing
- Payments are processed by Stripe. Your card details go to Stripe, and we never see or store your full card number.
- We receive and keep your plan, subscription status, current billing period end, whether you bought an add-on, and your Stripe customer and subscription IDs, so that your account has the right features.
- You can manage or cancel a subscription at any time through the billing portal linked from your Profile page.
- Calendar invite generation is free on every plan and is never tied to a payment.
6. Data Retention and Deletion
- Anonymous (no-account) plans cap at 12 respondents.
- Any plan auto-deletes 10 days after its booked meeting date, once the organizer has picked a final time.
- If a plan is never booked, it auto-deletes 30 days after the last listed candidate date, so unresolved plans don't sit indefinitely.
- The organizer (or account owner) can manually delete a plan at any time, which removes it and every response immediately.
- Billing records: we keep your plan and billing status for as long as your account exists, and keep payment and tax records for as long as the law requires. Stripe keeps its own records under its privacy policy.
- Calendar connections: the connection token is deleted, and revoked with Google, when you disconnect your calendar.
- Deleting your account: you can delete your account yourself at any time from the "Danger zone" at the bottom of your Profile page. Deleting removes your profile, your plans and everyone's responses to them, your saved contacts and saved plans, and your calendar connection (the token is deleted and revoked with Google). If you have an active subscription, it is canceled first. Deletion is immediate and can't be undone. We keep a small number of records that we still need once an account is gone, such as billing records the law requires us to keep and our list of email addresses that have opted out, so we never email them again.
- If you'd like other data deleted sooner than these windows, or you can't sign in to your account, email us (see Section 11) from the address on your account.
7. Your Rights
Depending on where you live, you may have rights to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data
- Object to or restrict certain processing
- (California residents) Know what categories of data we collect and opt out of any "sale" — note we do not sell personal information
To exercise any of these, email us at [email protected].
8. Children's Privacy
Commonhour is not directed at children under 13 (or under 16 in regions where that's the applicable age), and we don't knowingly collect data from them. If you believe a child has provided us data, contact us and we'll delete it.
9. Security
We use industry-standard measures (encrypted connections, Supabase's row-level security, hashed passwords) to protect your data, but no online service can guarantee absolute security.
10. Changes to This Policy
If this policy changes materially, we'll update the effective date above. Continued use of Commonhour after a change means you accept the updated policy.
11. Contact Us
Questions about this policy or your data: [email protected]
Mailing address: CommonHour, 3130 Grants Lake Blvd #16232, Sugar Land, TX 77496