Privacy & Data

What we read from your calendar

iCal/ICS feeds: Hey Julius reads event start and end times to compute free/busy availability. Other team members only ever see whether you are busy during a slot — not what the event is.

Your own event titles are opt-in and off by default. If you turn on "Show my own event titles" in Settings, Julius reads your own iCal event titles so you can see your own schedule with names (e.g. "Team standup") — never other team members' titles, regardless of this setting. Titles are displayed only to you, are never written to our database, and are never shared with other team members or sent to the AI scheduling engine. You can turn this off at any time, and event descriptions, locations, and attendee details are never read regardless.

Separately, when you book a meeting through Hey Julius, the title you type for that meeting is stored (see "What we store" below) and shared with the people you invite — that's the meeting's name, not something read from an existing calendar.

Google: When you connect Google as a team member, we request only Google's free/busy permission (calendar.freebusy), which cannot read event titles or details. There is an opt-in "Also check my other calendars" checkbox; if you tick it, we additionally request a narrow calendar-list permission (calendar.calendarlist.readonly) so Julius can see which of your calendars exist and check busy time across them — it does not grant access to event details. Organizers who use native meeting invites are asked for calendar write access to create events on their behalf, used only at the moment a meeting is confirmed.

Microsoft: Microsoft does not offer a free/busy-only permission for this flow, so we request Microsoft's Calendars.Read permission, which technically allows reading event details. Julius's code requests only each event's start time, end time, and busy/free and response status — never titles, descriptions, locations, or attendees — but the permission you grant to Microsoft is broader than what we use. Organizers using native invites are asked for calendar write access.

Availability is fetched live when scheduling; we do not build a persistent copy of your calendar.

What we store

• • Your name and email address (provided when you join a team)
• • Your iCal URL — stored encrypted (AES-128 Fernet). The raw URL is never written to disk in plain text.
• • Google and Microsoft OAuth tokens — if you connect via OAuth, your access token and refresh token are stored encrypted on your account. These allow Julius to check your availability without you re-authorising every session. You can disconnect these at any time from your profile page.
• • Your timezone and work-hours preference
• • A secure session cookie so you stay signed in (encrypted, httpOnly, expires in 30 days)
• • Meeting records created when a meeting is confirmed (title, start/end time, attendee emails)

Who can see your data

Your iCal URL and OAuth tokens are never displayed to other team members — only a masked label is shown (e.g. "Calendar 1 — calendar.google.com"). Team members can see the same free/busy overlay that you can, but no event details.

Team dashboards require login. Access is restricted to team members and the team owner. Only share your team link with people you trust.

Data retention and deletion

We keep your account, calendar connection, and meeting data for as long as your account exists — we do not automatically delete it after a fixed period, since you may return to use the service at any time. Free/busy data itself is never stored at all; it is fetched live from Google/Microsoft/iCal each time and discarded after the request completes.

You can disconnect your Google or Microsoft calendar, or remove an iCal calendar link, at any time from your personal page. Disconnecting removes the stored tokens or URL immediately; Julius will no longer use that calendar.

To remove all of your data across every team, sign in and use the "Delete my data" option on your profile page. This immediately and permanently deletes your account, your memberships in every team, your calendar connections and stored OAuth tokens, your Julius conversations, notifications, and join requests, and your sign-in links, and it signs you out. Meetings you were part of are kept for the other attendees, but your name and email in those records are replaced with "Deleted User" / "deleted@deleted". If you own a team that still has other members, ownership passes to another member (a leader first, otherwise the longest-standing member); the team itself is not deleted.

We also make a best-effort request to Google and Microsoft to revoke Julius's access to your account. If you connected Zoom, we delete our stored Zoom tokens, but we cannot revoke the authorization on Zoom's side — remove Hey Julius from your Zoom account's installed apps to do that.

How we protect your data

Hey Julius is served over HTTPS. OAuth access and refresh tokens, and any stored iCal calendar URLs, are encrypted at rest before being written to our database — the raw values are never stored in plain text. Session cookies are encrypted, HttpOnly, and scoped to your browser. Access to team data requires sign-in and is restricted to that team's members and owner; there is no public endpoint that returns calendar or meeting data without authentication.

Third-party services

• • Anthropic Claude — used for AI scheduling suggestions. We send the messages you type to Julius (and recent conversation history), free/busy slot summaries, and team members' names (so Julius can refer to people by name). We never send raw calendar data, event titles, or descriptions — but anything you type into a chat message is sent as written, so avoid putting sensitive details in it.
• • Resend — used to send account emails: magic-link sign-in, team invites, meeting confirmations, and meeting requests. These may include your email address, name, and meeting details (title, time) relevant to that email.
• • Google and Microsoft — calendar providers you choose to connect (see above); we send requests to their APIs to read availability and, for organizers, create events.
• • Zoom — only if you connect Zoom: we store your Zoom OAuth tokens (encrypted) and call Zoom's API to create a meeting link when you book a meeting.
• • Railway — our hosting and database provider; all data described on this page is processed and stored there.
• • Google Fonts — your browser loads our typefaces from Google's servers, which means Google receives your IP address and browser details when pages load.
• • No analytics, ad networks, or tracking pixels.

Contact

For privacy questions, data requests, or to request deletion of your account, email [email protected]. We will respond within 5 business days.

Google API data use disclosure

Hey Julius's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically: we use Google Calendar data solely to compute and display free/busy availability within Hey Julius and to create calendar events when you confirm a meeting. We do not transfer Google user data to third parties except as necessary to provide this scheduling service. We do not use Google user data for advertising, and we do not allow humans to read your Google Calendar data except when required by law or with your explicit permission.