Legal

Privacy policy

Last updated September 27, 2026

freeforonce is a group scheduling service that does not require an account. This policy covers the information it handles.

Information you provide

When you create or answer a poll, freeforonce stores its title, proposed dates and times, participant display names, availability, and final chosen time. If an organizer adds organizer suggestions, their display name is also stored with the poll. An organizer may provide an email address for organizer-link recovery or response notifications.

Google Calendar data

If you connect Google Calendar, freeforonce requests read-only access to your calendar list and events. We fetch calendar names, identifiers, and events for the relevant poll dates to show you conflicts and suggest free times. We send those details to your browser but do not store calendar events or short-lived Google access tokens in our database. If you select calendars to include, a first-party browser cookie remembers their identifiers for up to 400 days.

The connection can remain active for up to 30 days. During that time, freeforonce stores an encrypted Google refresh token and a hash of your session identifier in its database. Your browser holds the session identifier in an HTTP-only cookie. Disconnecting deletes the server session and cookie and asks Google to revoke the token.

Sharing and disclosure of Google data

Google provides calendar data to freeforonce when you authorize access. Our hosting provider, Vercel, processes calendar data and OAuth tokens while handling your requests. Our MongoDB database provider stores the encrypted refresh token and hashed session identifier needed to keep your connection active. We send the refresh token to Google to renew or revoke access. We do not send your calendar lists, event details, or Google credentials to poll organizers, other participants, advertisers, analytics services, or our email provider. If you save availability or a suggested date after checking your calendar, others can see that choice as poll data, as described under Public and private links.

freeforonce's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, use it for advertising, or allow humans to read it.

How we protect Google data

We use HTTPS to transfer calendar data from Google to our server and from our server to your browser. We do not store calendar events or access tokens, and we mark calendar API responses as not to be cached. Stored refresh tokens are encrypted with AES-256-GCM using a server-side key. The database holds a SHA-256 hash of the session identifier, not the identifier itself. The session cookie is HTTP-only, SameSite=Lax, and Secure on the production site. OAuth state validation protects the connection flow. Sessions expire after 30 days, and disconnecting removes the stored session.

Public and private links

Anyone with a public poll link can see the poll title, participant display names, and aggregate availability. Organizer and participant edit links act as private credentials. Anyone who has one can use the access it grants.

Technical information

freeforonce uses essential cookies for organizer and participant access, request security, and cross-site request forgery protection. It does not use advertising cookies or analytics identifiers. It may process short-lived, keyed hashes of network identifiers to prevent abuse and enforce rate limits.

Retention and deletion

Polls become read-only 90 days after creation and are scheduled for deletion after a seven-day recovery period. An organizer can delete a poll sooner from its management page. Deleting a poll removes its stored poll data, participant responses, and optional organizer email addresses.

Service providers

Hosting and database providers process the information needed to run freeforonce. If an organizer enables email recovery or notifications, an email provider also processes the recipient address and message. These providers use the information only to deliver their services.

Your choices

Google Calendar access is optional. You can disconnect the current session from the calendar control or remove freeforonce from your Google Account permissions. Calendar sessions expire after 30 days. Poll organizers can delete their polls and remove optional email settings.

Contact

For privacy or data-deletion questions, email ndrmntn@gmail.com.