The principle that guides the rest
Everything you create here is born private. No entry, contact detail or profile information becomes public without an explicit action from you, item by item. There is no automatic publishing, and no “public by default to make things easier”.
When you publish something, it becomes visible to anyone on the internet, including people without an account. Unpublishing hides it again from here, but it does not undo copies third parties may already have made while it was public.
Data we collect
Data you provide
- Sign-up: email, password and the name shown on your calendar. The email identifies your account and is used for communications about the service.
- Profile: public handle, activity, headline, bio and location — all optional except the name.
- Contact: email, phone and website. Each has its own public-or-private marker, and all default to private.
- Entries: title, description, location, date, time and time zone. Every entry has a visibility level that only you set.
- Imported calendars: if you connect an external calendar, we import the events it exposes.
Data generated by use
- Session: a random identifier kept in a cookie to keep you signed in. We use no advertising cookies and no cross-site tracking cookies.
- Calendars you follow: the relationship between you and the profiles you follow.
- Technical records: operational data about the running and the security of the service.
- Traffic measurement: we count how many pages were seen, at what hour, from which country, and whether there was an open session. We do not store your IP address and we use neither tracking cookies nor third-party analytics services. To know how many visitors there were on a given day without identifying anyone, we generate a temporary code that changes every 24 hours and cannot be reversed or tied to you, to your account, or to another day. Those codes are deleted after 120 days. Legal basis: legitimate interest (art. 7, IX of Brazil’s LGPD), limited to measuring the audience of this site.
- Language: when you pick a language in the selector, the choice is kept in a cookie in your browser. Before that, the page comes out in the language of the country the request arrives from — information the network already hands to any server, and which is not stored.
We do not record the content of your calendar in logs. The title, location, description and participants of entries do not go into technical records, telemetry or error messages.
The three levels of visibility
Every entry in your calendar has a level, chosen by you:
- Public: appears on your public profile with all the details you filled in.
- Busy: appears only as a taken slot. Whoever looks does not learn the title, the location or the description — the system is built so that those fields never even leave the server in that case.
- Private: appears nowhere beyond your own calendar.
Your profile as a whole has the same choice: until it is published, it doesn’t appear in discovery and isn’t reachable at the public address.
Events imported from external calendars
Every imported event arrives private, without exception. Personal calendars are mostly private — doctor’s appointments, family commitments, internal meetings — and importing with any public default would expose precisely what shouldn’t appear. Publishing an imported event is always a later, individual choice of yours.
We import only the fields needed to build the calendar. When you disconnect a calendar source, the access credentials are deleted.
Who we share with
We do not sell your data and we do not hand it to advertising. Sharing happens in three situations:
- With the public, through what you published. That is the normal working of the public profile and of discovery.
- With infrastructure providers needed for the service to exist — hosting and database. They process data under our instruction and cannot use it for their own purposes.
- By legal obligation, when required by law or a court order.
If you choose to connect a social network to promote your events, the data of that specific event is sent to the chosen network at the moment you ask to publish, and becomes governed also by that network’s policy.
Your rights
Brazil’s General Data Protection Law (Law 13.709/2018) guarantees that you may, at any time:
- Confirm that we process your data and access it
- Correct incomplete, inaccurate or out-of-date data
- Request anonymization, blocking or deletion of unnecessary data, or data processed contrary to the law
- Request portability of your data
- Withdraw consent and request deletion of the account
- Be told who we share your data with
Much of this you already do yourself in settings: edit the profile, change the visibility of any item, disconnect calendars and export your public calendar as a calendar file.
When you delete your account, we delete your profile, your entries, your sessions and the calendar connections. Records the law obliges us to keep are preserved only for the required period.
Security
Passwords are never kept in readable text: we store only a cryptographic derivation of them. Access to your content is isolated by owner in every query, and the public areas read only items marked public, filtered on the server.
No system is immune to failure. Should a security incident occur that could pose a relevant risk to you, we will notify you and Brazil’s National Data Protection Authority, as the law requires.
Minors
The service is not intended for people under 18. If we identify an account of a minor without guardian authorization, the account will be removed.
Changes to this policy
If we change this policy in a material way, we will give notice through the service itself before the change takes effect. The date at the top shows the last revision.
Contact
To exercise any of the rights above, or for questions about this policy, write to contact@tempavio.com. We answer from the same address.