Privacy Policy

Account information. When you create an account we collect your email address. Sign-in is handled by our authentication provider (Supabase) using a password or an emailed sign-in link. If you add profile details, such as an avatar, we store those too.

Content you create and upload. We store the campaigns, characters, scheduling rules, and proposed and confirmed session times you create, and the files you upload to your library — including the content we extract and index from uploaded files so it can be shown in the app. Library content is available to you and, under the library-sharing model described in our Terms, to members of campaigns you belong to.

Google Calendar data. If you choose to connect a Google Calendar, we collect the calendar information described in the next section. Connecting a calendar is always optional.

Technical data. Our hosting and authentication providers automatically record IP address, browser/device type, and request timestamps in server logs for security, debugging, and abuse prevention. We do not use these logs for advertising or profiling.

What we do not collect. The service does not currently take payments, and we never see or store payment card details. The app contains no advertising trackers and no third-party analytics. If we introduce paid plans, payments will be processed by a third-party payment processor that handles card data under its own policy; we will update this policy and notify you before charging anyone.

How connecting works. You connect through Google’s own sign-in (OAuth), which asks for the calendar.events permission. You can disconnect at any time, as described below.

What we access. Events on your primary Google Calendar only — never your other calendars — looking from today through the next 35 days each time we sync.

Event titles.When we sync, event titles are read on our servers only long enough to apply your own ignore rules (for example, events you have told us don’t block game time). Titles are never written to our database, never logged, and never shown to any other user.

What we store.Busy times. For each event we store its start time, its end time, a simple label (busy, ignored under your rules, or created by this app), and Google’s event ID so repeated syncs stay consistent. Every sync replaces the previously stored set completely.

What other people see. Members of a campaign you belong to can see only your busy time ranges (start and end), never event titles, Google event IDs, or any other calendar detail. Busy ranges are released only through a restricted database function that strips everything except start/end times. The scheduler combines members’ busy ranges to propose a session time.

Events we create. Only when you choose “add to calendar” for a session. We then create a single event on your own primary calendar with the session name and time, privately tagged as created by this app so it never blocks its own session. We never change or delete your existing events.

Tokens. Google gives us a refresh token so we can keep your availability current without asking you to sign in repeatedly. Your tokens are stored encrypted (AES-256-GCM) and are never shown to other users.

Disconnecting. In Calendar Settings you can disconnect at any time. Disconnecting revokes our access with Google and permanently deletes your stored tokens and all of your stored busy times.

Limited Use.The True BBEG’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we: (a) use Google user data only to provide and improve the scheduling features you see in the app; (b) do not transfer it to third parties except to our hosting/database providers acting on our behalf, as required by law, or with your explicit consent; (c) do not use it for advertising; (d) do not allow humans to read it except with your consent, for security or abuse investigation, or to comply with law; and (e) do not sell it.

We use the information above only to operate the service: finding session times your group is free for, running campaigns and characters, and unlocking library content. We do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined under California law, and we do not use it for advertising.

The service runs on infrastructure providers — Vercel (hosting) and Supabase (accounts, database, and file storage) — which process information only to provide the service. Data is stored on servers in the United States (Supabase region US West, Oregon).

We may disclose information (i) to our service providers listed above; (ii) when required by law, subpoena, or to protect rights, safety, or the integrity of the service; or (iii) to a successor if Ner Tamid LLC is merged or acquired, in which case this policy continues to apply. Google Calendar data is subject to the Limited Use restrictions above in all cases.

In the preceding 12 months we collected these categories: identifiers (email, user ID, IP), account/profile content, user-generated content and uploads, and (if connected) calendar busy data. Sources: you and Google (at your direction). Purpose: operating the service. We have not sold or shared personal information for cross-context behavioral advertising and do not use sensitive personal information to infer characteristics. You may request access, correction, deletion, or a portable copy, and will not be discriminated against for exercising rights. Submit requests to privacy@truebbeg.com; we verify requests by confirming control of the account email and respond within 45 days. An authorized agent may submit on your behalf with written permission.

Your content stays while your account exists; you can delete campaigns, characters, and uploads in the app. Calendar data is erased immediately and permanently when you disconnect, and stored busy times only ever cover a rolling window of the next 35 days. To request complete deletion of your account and its remaining data, contact us at privacy@truebbeg.com, and we will delete your account data within 30 days of a verified request. Content you shared into a campaign (confirmed sessions, pooled library items) may remain visible to that campaign unless you delete it first. Residual copies may persist in encrypted provider backups for up to 30 days before being purged.

Passwords are handled by our authentication provider and are never stored by us in plain text. Calendar tokens are encrypted at rest, and database access rules restrict raw calendar data (tokens, event IDs, labels) to the owning user; fellow campaign members can obtain only start/end busy ranges through a restricted function.

The service is not directed at children under 13, and we do not knowingly collect information from them. If we learn we have collected personal information from a child under 13, we will delete it promptly. Users must be at least 13 (or 16 in jurisdictions requiring parental consent above 13) to create an account.

We will post the updated version here and revise the date above. For material changes we will also notify you by email or in-app notice at least 14 days before the change takes effect. Continued use after the effective date constitutes acceptance.

Contact us at privacy@truebbeg.com. Postal: Ner Tamid LLC, 444 Alaska Ave Ste AYR851, Torrance, CA 90503.