BoardSpy Privacy Policy

This policy explains what information BoardSpy collects, why we collect it, how we use and protect it, and the choices you have.

1) Who this applies to

This policy applies to users of:

• The BoardSpy web app at boardspy.site
• The BoardSpy mobile app for iOS and Android
• The BoardSpy browser extension

2) Data we collect

• Account data: email, name, sign-in method, and identifiers from Google Sign-In or Sign in with Apple when you use those options.
• Route and commute data: saved route addresses or map coordinates, schedule times, active days, transport mode, and traffic-check history used for alerts and insights.
• Location data: when you allow it, precise or approximate location to create routes, show maps, suggest nearby places, and deliver relevant local deals. We use location for app functionality, not for selling ads.
• Preferences: city, country, interests, deal categories, notification settings, and similar in-app choices.
• Device and push data: push notification tokens, device type, platform (iOS, Android, web, extension), and related metadata needed to deliver alerts you request.
• Voice assistant data: when you use push-to-talk, audio is sent to our voice service to answer your request. We treat voice input as functional session data; we do not use it for advertising.
• Purchase and plan data: subscription or in-app purchase status, product identifiers, and entitlement/plan level when you buy through the App Store, Google Play, or other supported checkout flows. Payment card details are handled by the store or payment provider, not stored by BoardSpy.
• Carpool data (optional): if you opt in to car pool features, we may store contact details you choose to share (such as phone or WhatsApp), route preferences, and match-related profile fields so matched riders can coordinate. Contact details are shared only according to in-app car pool rules.
• Google Calendar data (optional): only if you connect Google Calendar in the app. See sections 3 and 3A below.
• Apple Calendar data (optional, iOS): only if you tap Connect Apple Calendar and grant Calendar access on your iPhone. See section 3B.
• Usage and diagnostics: operational logs, alert delivery records, crash/diagnostic information, and limited product analytics needed for reliability, anti-abuse, debugging, and improving BoardSpy’s user-facing features. This does not include using Google Calendar event contents for analytics, advertising, or model training.

3) Google Calendar (optional)

Connecting Google Calendar is optional and separate from signing in with Google for your BoardSpy account. If you only use Google to create or sign in to BoardSpy, we receive basic profile information (such as name and email) to create and authenticate your BoardSpy account. We do not access your calendar unless you explicitly connect it later (for example from Profile in the mobile app).

When you choose to connect Google Calendar, BoardSpy requests Google’s read-only calendar permission (calendar.readonly). With that permission we may read:

• Upcoming calendar event titles, start and end times, locations (if any), and related metadata needed to schedule alarms
• Which Google account email is linked for that connection
• Your in-app choices such as alarm lead time and per-meeting alarm on/off

We use this Google Calendar information only to provide and improve these user-facing BoardSpy features:

• Send a meeting reminder at your chosen lead time before an event starts, and/or
• Estimate time-to-leave when an event has a physical place, using your saved commute origin and Maps travel data where available
• Show today’s meetings in the Calendar screen so you can enable or disable alarms per meeting

We do not create, edit, delete, or share your calendar events. We store an encrypted refresh token so BoardSpy can keep reading your calendar until you disconnect. Disconnecting Google Calendar in the app removes that connection and stops calendar alarms. Deleting your BoardSpy account also removes associated calendar connection data as described in our account deletion process.

3A) Google API Services / Limited Use

BoardSpy’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, for Google user data obtained through Google Sign-In, Google Calendar (when connected), Maps/Places used to support those features, and related Google APIs:

• We limit use of that data to providing or improving user-facing features that are prominent in BoardSpy (account sign-in, commute/route alerts, and optional calendar meeting / time-to-leave alarms).
• We do not use or transfer Google user data for advertising, including targeted, personalized, retargeted, or interest-based ads.
• We do not sell Google user data to data brokers, information resellers, or other third parties.
• We do not use Google user data to determine credit-worthiness or for lending.
• We do not use Google user data to create, train, or improve generalized / non-personalized AI or machine-learning models.
• We do not use Google Calendar event contents to personalize deals, marketing emails, or unrelated product recommendations.
• Deals recommendations (when you use that feature) are based on preferences you set in BoardSpy (such as city and interests), not on Google Calendar contents.
• Human access to Google user data is limited to cases needed for security, abuse investigation, or to comply with law, or when you explicitly ask support to look at a specific issue.

Independent product analytics tools (for example PostHog, where enabled) may receive BoardSpy app usage events. They are not used to receive or process raw Google Calendar event contents obtained via calendar.readonly.

3B) Apple Calendar (optional, iOS)

Connecting Apple Calendar is optional and separate from Sign in with Apple. BoardSpy does not read your iPhone calendars unless you tap Connect Apple Calendar and allow Calendar access in the system prompt. We request full calendar access only so we can read upcoming events; we do not create, edit, or delete events, and we do not access Reminders.

When you grant access, the iPhone app may send BoardSpy:

• Upcoming event titles, start and end times, locations (if any), and the calendar name
• Your in-app choices such as alert lead time and per-meeting alert on/off

We use this information only to schedule leave-time and meeting alerts and to show today’s meetings in the Calendar screen. Events can come from iCloud, Google, Exchange, or other calendars that already appear in the iOS Calendar app. Disconnecting Apple Calendar in BoardSpy (or turning off Calendar access in iOS Settings) stops this sync and deletes the stored snapshot. We do not use Apple Calendar contents for advertising, deals personalization, or model training.

4) Deals and third-party content

BoardSpy’s deals feature surfaces publicly available promotional posts from third-party platforms such as Instagram, Facebook, and YouTube. We may store and display previews of that content (for example thumbnails, captions, creator names, engagement counts, and links to the original post) so you can discover local offers.

• That content remains owned by its original publishers.
• Each deal is attributed to its source and links back to the original post.
• We do not claim to be the author of third-party posts.

Rights holders may request removal of a listing from BoardSpy. See our Support page and Terms of Service for the takedown process.

5) How we use data

• Provide route traffic checks, departure alerts, and commute-related insights.
• If you connect Google Calendar or Apple Calendar, send optional meeting and time-to-leave alerts and show today’s meetings as described in sections 3, 3A, and 3B.
• Deliver personalized deals and recommendations based on your BoardSpy preferences and city (not based on Google Calendar contents).
• Send notifications you request (email, browser push, or mobile push).
• Operate the voice assistant, car pool matching (if enabled), and paid plan features.
• Process purchases, restore entitlements, and prevent billing abuse.
• Maintain platform security, prevent abuse, troubleshoot issues, and improve user-facing BoardSpy features.

We do not sell your personal information. We do not use an advertising ID to track you across other companies’ apps or websites for ads. Google user data is handled under section 3A (Limited Use).

6) Third-party services

BoardSpy uses trusted providers to operate the service. Depending on the features you use, data may be processed by providers such as:

• Google — Sign-In (account authentication), Maps/Places/routing for commute features, and (only if you connect it) read-only Google Calendar for meeting and leave-time alarms. Google user data is used only as described in sections 3 and 3A.
• Apple — Sign in with Apple, App Store billing (on iOS), and (only if you connect it) on-device Calendar access for meeting and leave-time alerts as described in section 3B
• Firebase Cloud Messaging — mobile push delivery of alerts you request (including calendar alarms when enabled)
• LiveKit — real-time voice assistant sessions
• RevenueCat — in-app purchase and subscription management (mobile)
• Brevo (or similar) — transactional email
• PostHog (where enabled) — BoardSpy product analytics for reliability and feature improvement; not used to ingest Google Calendar event contents
• Hosting, database, and infrastructure providers that store and process data on our behalf to operate BoardSpy

Your use of those features may also be subject to each provider’s own terms and privacy policies. We do not transfer Google user data to third parties for advertising or sale.

7) Data retention

We retain personal data only as long as needed to operate the service, comply with law, resolve disputes, and maintain security. When you delete your account, we remove your profile, routes, preferences, registered devices, Google Calendar connection data (if any), and associated personal records as described on our account deletion page. Some anonymized or legally required records may be kept for a limited period where permitted by law.

8) Your choices

• Update routes, preferences, and notification settings in the app or extension.
• Disable push notifications in BoardSpy settings and in your device or browser settings.
• Decline location or microphone permission; some features may not work without them.
• Connect or disconnect Google Calendar or Apple Calendar at any time in the mobile app (Profile → Calendar). You can also revoke BoardSpy’s Google calendar access in your Google Account permissions, and revoke iOS Calendar access in Settings → BoardSpy → Calendar.
• Turn alarms on or off for individual meetings in the Calendar screen when Calendar is connected.
• Delete your account from the mobile app (Profile → Delete account) or by email — see /delete-account.
• Request access, correction, or deletion by contacting us (see Contact below).

9) Security

We use reasonable administrative and technical controls to protect personal data, including encrypted HTTPS/TLS connections between apps and our servers, and encryption of stored Google Calendar refresh tokens. No system can be guaranteed 100% secure, but we continuously monitor and improve safeguards.

10) International users

BoardSpy may process and store information in countries other than where you live, including where our service providers operate. Where applicable law grants you additional rights (for example under GDPR), you may contact us to exercise them.

11) Children

BoardSpy is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.

12) Policy updates

We may update this policy from time to time. Material updates will be reflected on this page with a revised “Last updated” date.

13) Contact

For privacy requests, data deletion, or questions about this policy, contact [email protected]. General help is also available at boardspy.site/support.