Privacy policy
Last updated:
This policy explains what personal data Kairos handles, why, for how long, and what you can do about it. It covers the Kairos service at kairos.coding-pit.comand this website. Kairos is open-source software: a copy that someone else runs on their own server is their responsibility, not covered here.
Who is responsible
The data controller is Juan Jesús Cilla, an individual based in Spain, who runs Kairos free of charge. Contact for anything in this policy: scallop.projects@gmail.com.
Who this is about
- Hosts — people who sign in with Google, connect their calendars and offer times.
- Guests — people who open a Booking Link and book a Session. Guests never sign in.
- Visitors to this website.
What we collect and why
Hosts
| Data | Why | Legal basis |
|---|---|---|
| Google account email address, name and time zone | To identify you, check that you were invited, and show times in your zone | Performance of the service you asked for (GDPR art. 6(1)(b)) |
| Google OAuth tokens (stored encrypted) | To keep reading your free/busy time and writing Session events without asking you to sign in every time | |
| Names of your calendars | So you can choose which calendars count as busy and which one receives Session events | |
| Your Offers, Standing Offers and settings; daily counts (Tallies) of Slots offered, vetoed, opened and booked | To find times every Host agreed to, and to show the team its own statistics | |
| An audit log of sign-ins and changes (who, what, when) | Security and troubleshooting | Legitimate interest in keeping the service secure (art. 6(1)(f)) |
Guests
| Data | Why | Legal basis |
|---|---|---|
| The Intake you submit: name, email, topic, short bio, social handles, time zone and language | To book the Session you asked for, tell the Hosts who you are and what you will talk about, and send you the calendar invitation | Steps taken at your request to arrange the Session (art. 6(1)(b)) |
| The Session's time and state, and a random Manage Token | So you can cancel or reschedule from your confirmation link | Same as above |
Everyone
Your IP address is used in memory to limit abusive request rates and is not stored by Kairos. Request logs record the method, the path (with Booking Link and Manage Token removed), the status and the time taken — no IP addresses, no personal data. Our hosting providers may keep short-lived network logs for security.
Google user data
Kairos asks Google for the smallest set of permissions it needs:
- Your email and basic profile — to sign you in.
- Free/busy information (
calendar.freebusy) — to know when you are busy. Kairos sees that you are busy, never the title, description, location or attendees of any event. - Calendar list (
calendar.calendarlist.readonly) — the names of your calendars, so you can pick which ones count. - Events (
calendar.events) — used only to create the event for a booked Session in the calendar you chose, and to delete that same event if the Guest cancels or reschedules. Kairos does not read, change or delete any other event.
Free/busy answers are used on the spot to compute Open Slots and are not stored. Google data is never sold, never used for advertising, never used to train AI or machine-learning models, and never read by a human except with your permission, for security, or to comply with the law.
Kairos's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke Kairos's access at any time from your Google account's third-party connections; Kairos then stops reading your calendars immediately.
Who else receives data
- Google (Google Calendar) — the Session event is written into each Host's calendar with the Guest as an attendee, and Google sends the invitation. From then on the event lives in those Google accounts under Google's own terms.
- The Team's Hosts — see the Guest's Intake to prepare the Session.
- IONOS SE (Germany) — hosts the server Kairos runs on, in the EU.
- Cloudflare, Inc. — stores encrypted off-site backups of the server.
- GitHub, Inc. — hosts this website (not the Kairos service).
Google, Cloudflare and GitHub are US companies. Where data leaves the EU it is covered by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. Nobody else receives your data, and none of it is sold.
How long we keep it
- Guest Intake: anonymised 24 months after the Session. Name, email, topic, bio, social handles and the Manage Token are erased, as are the audit-log lines that name the Guest; only the Session's date, length and state remain, for the team's statistics. A cancelled booking is treated the same way.
- Host data: for as long as you are a Host. When you leave, or ask us to, your account, tokens and Offers are deleted; the team's aggregate counts may remain without your name.
- Offers: removed once the day they refer to has passed; only the day's counts (Tally) are kept.
- Sign-in sessions: deleted when they expire.
- Backups: overwritten on a rolling basis; deleted data disappears from them within the backup retention period.
Your rights
You can ask to access, correct, erase or export your data, to restrict or object to its processing, by writing to scallop.projects@gmail.com. We answer within one month. A Guest can also cancel their booking at any time from their confirmation link. If you think your data has been mishandled, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos.
Cookies
This website sets no cookies and loads nothing from third parties. The Kairos service sets two strictly necessary cookies for Hosts — one keeps you signed in, one protects the Google sign-in from forgery — and stores your light/dark preference in your browser. There are no analytics, advertising or tracking cookies.
Security
Traffic is encrypted with HTTPS. Google tokens are encrypted at rest. Booking and confirmation links carry unguessable random identifiers and are removed from logs. Access to the server is limited to the operator.
Children
Kairos is not meant for anyone under 14, and we do not knowingly collect their data.
Changes
If this policy changes in a way that matters, the date below changes and Hosts are told by email beforehand. The history of this page is public in the website's repository.