Privacy policy

Book Me Soon is a service of AlexApps.Net Co, which is responsible for the information described here. "We" below means that company.

The service has two kinds of user, and they are treated differently because they share different things:

• Hosts sign in with a Google Account to publish times.
• Guests open a booking link and take a time. A guest never signs in and never connects a Google Account.

Signing in with Google gives this application your Google account identifier, name, email address and profile picture. We store the first three and discard the picture, which is never used, never stored, and never sent to your browser. Google offers no way to ask for a name without a picture, which is the only reason it is handed over at all. The account identifier — not your email address — is what identifies you here, so changing your email address at Google does not create a second account.

You also grant the calendar.app.created permission. This permission can only see and change calendars that this application itself created. Book Me Soon creates exactly one calendar for you and writes your bookings into it. It cannot read your existing calendars, it does not ask to, and no other Google data is requested.

To write to that calendar when you are not present, Google issues a refresh token. It is stored encrypted with AES-256-GCM under a key held outside the database, and it is never sent to a browser, written to a log, or returned by any part of the API.

When you book a time you give a name, an email address, an optional note, and your browser reports the time zone you are in. These are used to hold the booking, to write the calendar entry it creates, and to email you about it. They are shown to the host whose page you booked — the person you are meeting — and to nobody else.

Booking pages are public to whoever holds the link, so they are built to reveal nothing about anyone else: a page shows which times are taken, never who took them.

Today the site sets one cookie, aa_session, and only after a host signs in. It holds a random session identifier, nothing about you, and it expires after seven days. There is currently no analytics and no third-party tracking.

If advertising is introduced, as described below, the advertising provider will set cookies of its own. This page will say so, and name them, before that happens.

Booking confirmations and notifications are sent through Amazon SES from noreply@bookmesoon.com. Replying to one reaches a support mailbox we monitor; those replies are received and stored for a year so we can answer them.

Your booking and account information is never sold or rented, and never handed to an advertiser. Today it is processed by two providers, both acting for us:

• Amazon Web Services — hosting, the database, and email delivery. Data is held in the US West (Oregon) region.
• Google — sign-in and the calendar entries this application creates on your behalf.

If advertising is introduced, an advertising provider becomes a third party in your browser — see "Advertising" below for what that does and does not involve. We may also disclose information where the law requires it. Nothing else leaves.

Book Me Soon is free to use. We may in future show advertising on the site to support it, through providers such as Google or Meta.

If that happens, those providers may set cookies or similar identifiers in your browser and may use them to select and measure the advertisements you see. What they collect and how it is used is governed by their own policies:

• Google Privacy Policy and how Google uses information from sites that use its services
• Meta Privacy Policy

Two limits apply whatever happens. Nothing from a Google Account connected to this service is ever used for advertising — not your calendar, not your email address, not your name; the Limited Use terms below govern that and are not affected by ads on the site. And no guest's booking details are shared with an advertising provider: a name, an email address or a note given to make a booking is used to make that booking and to email about it, and for nothing else.

No advertising runs on this site today. Before any is introduced this page will be updated to say who provides it and what they collect, and any consent required where you live will be asked for first.

Book Me Soon' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the scheduling features described on this site. It is never used for advertising — including any advertising this site may itself carry — never sold, never transferred except as needed to provide those features or where the law requires it, and never used to train generalised artificial-intelligence or machine-learning models.

A booking and its calendar entry are kept until the booking is cancelled or you delete your data. Cancelling a booking removes it and frees the time. Sessions expire after seven days. Mail sent to support@ is deleted after a year.

There is no automatic deletion of older bookings yet. When one is introduced, this page will say what it is before it takes effect.

A host can revoke this application's access at any time from their Google Account permissions, which stops any further calendar access immediately. To have your account, your page and its bookings deleted here, or to ask what is held about you, use the contact form. A guest can ask the same about a booking they made.

This service is not directed at children. To use it you must be at least 16, or at least the age of digital consent where you live if that is lower — and never under 13.

We do not knowingly collect personal data from anyone below that age. If you believe a child has given us theirs, tell us through the contact form and we will delete it.

If this policy changes, the date at the top changes with it. Material changes affecting how existing data is used will be sent to hosts by email.

Questions about this policy, or about what is held on you, go through the contact form.