Privacy Policy — Gesty

What We Collect

We collect only what Gesty needs to run your calendar, your booking links and your account.

Account Information

• name
• email address
• sign-in details via Apple, Google, or email authentication
• language, time format and time zone settings
• random identifiers for each installation of the app, and the notification tokens of your devices (used to deliver notifications, Live Activities on iPhone and Live Updates on Android)

Your Events and Reminders

Events you create in Gesty — title, notes, location, link, time, repeat and reminder settings — are stored on our servers so they appear on all your devices and so we can send their reminders. Timed events mark you as busy on your booking links while “Block this time for bookings” is on; all-day events do not. We keep earlier versions of an event for 90 days and deleted events for 30 days, so they can be restored; deleting your data removes them at once.

Booking Links and Bookings

• your availability, meeting titles and booking-link settings
• the meeting link you choose: your own link, Google Meet or Zoom
• for each booking: its time, and the guest's name and the contact they chose to leave (email, phone, WhatsApp, Telegram, Instagram, TikTok or another contact). Guests who book from inside the app also share their account name and email.

Google Calendar

With your permission, Gesty connects to your Google Calendar. Google asks you to grant two permissions: to see and edit events on your calendars, and to see the list of your calendars. We do not ask for full access to your Google account or to change your calendars' settings or sharing.

What we read: when you connect, Google gives us your Google account's email address and the list of your calendars. At first every calendar whose events we can see is selected; you can change that in the app. On the selected calendars we use each event's title, start and end time, whether it shows you as busy, and its ID and link. We use them to show your schedule in the app, to mark those times as unavailable on your booking links, and to name tomorrow's first event in an evening notification. Google also sends each event's description, location and guest list; we don't use them.

We don't store your Google events on our servers, with two exceptions: the ID and time of an event you chose to put a booking slot over, and the text of a Live Activity on your iPhone, which can show an event's title and time.

What we write: when a booking is saved to your Google Calendar, we add one event to your primary calendar. It contains the guest's name, the contact and meeting link if there are any, and the guest's email if they gave one (as a guest of the event and in its description). If you choose Generate Google Meet link, we ask Google to attach a Google Meet link to that event. If your bookings go to your iPhone calendar instead, we create a Google event only to hold the Meet link; its title can include the guest's name, and it has no description or guests. When a booking is moved or cancelled, we change or delete the event we created. We also read back the events we created for your bookings to keep them in step with your calendar. We never change or delete your other events.

On disconnect or data deletion we ask Google to revoke Gesty's access and delete our copy of the access tokens. Events we already added stay in your calendar — it is yours.

Google API Services User Data Policy

Gesty's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, Gesty uses Google Calendar data only to provide the user-facing features described above. We do not:

• transfer this data to third parties except as needed to provide or improve user-facing features (for example, delivering a notification to your phone), comply with applicable law, or as part of a merger, acquisition, or sale of assets (with notice to affected users);
• use the data for serving advertisements;
• allow humans to read the data, except (a) with the user's explicit consent for support, (b) for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) for internal operations when the data has been aggregated and anonymized;
• use the data to develop, improve, or train generalized AI or machine-learning models.

iPhone Calendar

On iPhone, with your permission, Gesty reads the calendars you choose to show your schedule in the app. For your booking links and evening notifications it sends our servers a copy of the next 90 days: each timed event's start and end time, title (up to 200 characters), and its event and calendar IDs. Guests then only see times when you are free, and we can name tomorrow's first event in an evening notification. Each sync replaces the previous copy. Bookings you keep in your iPhone calendar are added there by the app on your device. On Android, Gesty does not read the calendar on your device.

Zoom Data

With your permission, Gesty connects to your Zoom account so that a booking link can offer the “Generate Zoom link” option. During Zoom's OAuth consent flow we request three permissions and nothing more: create a meeting, delete a meeting, and read your own Zoom profile. We do not request access to your other meetings, recordings, chats, or contacts.

What we receive: an access token and a refresh token that let us perform those three actions on your behalf, the email address of your Zoom account, your Zoom user id, and whether your account is free or paid. The tokens are stored encrypted (AES-256-GCM) in our database. Clerk, which handles your sign-in, never sees any of this. We read the account type only so the app can tell you that meetings on a free Zoom account end after 40 minutes.

What we create: when someone books a slot through a booking link where you chose “Generate Zoom link”, we create one Zoom meeting for that booking, titled with the meeting name and the guest's name. The meeting's join link and passcode are shown to the guest and stored on the booking. If the booking is cancelled, we delete that meeting. We do not read, modify, or delete any other meeting in your Zoom account.

On disconnect or removal: you can disconnect Zoom in the app or at gesty.ai/meet/zoom, or remove Gesty from inside your Zoom account. In every case we revoke the token with Zoom and delete our copy immediately. Meetings we have already created stay in your Zoom account — you own them, and disconnecting does not delete them. If you cancel a booking after disconnecting, we can no longer delete its meeting for you; the app marks the deletion as pending, and you can retry it after reconnecting.

Data received from Zoom is used only to provide the scheduling features described above. It is never used for advertising and is never shared with advertising partners. See our Zoom help page for step-by-step instructions.

Feedback

If you send feedback from the app, we store your answers and comment together with your account, language, platform and app version. If you close the feedback prompt without sending anything, we note that you closed it. Feedback a guest sends from a booking page (the message, an email address if they add one, their language and time zone, and which booking link it came from) goes to our team's internal chat and is not stored in our database.

Diagnostics and Technical Information

• App diagnostic logs linked to your account: events and errors in the app, app version, device model, the install identifier, and — if a sign-in fails — the email address that was typed. We use them to find and fix problems.
• Crash and error reports sent to Sentry: device model, operating system, app version, the error details, the app's most recent log lines (which can include your account ID) and how often the app is opened without crashing.
• Approximate country, derived from the IP address of your request and your device's region setting. It decides whether the app must ask before advertising measurement (see Advertising & Analytics) and is stored with the record of that choice and in the app diagnostic logs. We never use precise location.
• IP address, in our hosting provider's request logs, kept for a short period for security and debugging.

We do not access the contacts, photos, microphone or precise location on your device, and we do not collect health or other sensitive personal information.

Adults

Gesty is intended for adult users and is not directed to children. We do not knowingly collect personal data from children.

If You Book a Meeting Through Gesty

You don't need an account to book a time on someone's Gesty link. On the booking page we collect your name, the contact you choose to leave, and the time you pick. We do not store your IP address or your time zone with the booking.

The host sees your name and contact in the app. Notifications on their phone can show your name and the meeting details. If the booking is saved to their Google Calendar, the event also includes your contact and your email address if you gave one.

Booking pages carry no analytics and no advertising cookies, and nothing about you is shared with Meta. Your browser keeps your language, time format and time zone choice for the next visit, and, for this tab only, a one-time code that lets you open your booking in the app.

Your booking stays with the host's booking link until the host deletes the link or their account. To have your details removed sooner, see Delete your account.

How We Use Your Data

Your data is used only to:

• show your calendar, events and reminders
• schedule and confirm meetings
• synchronize calendar events
• create meeting links for your bookings, if you choose them
• send reminders and service notifications
• improve platform stability and user experience
• provide customer support and read your feedback
• protect account security and prevent fraud
• measure how effective our advertising is — only as described in Advertising & Analytics, which also explains when we ask first and how to turn it off

Calendar and Zoom access are requested only to provide scheduling functionality and only with your permission. Calendar contents and data received from Zoom are never used for advertising or shared with advertising partners.

Third-Party Services

We rely on the following third-party processors to operate Gesty. Each processes only the minimum data required to perform its function:

• Clerk — authentication, session management, and identity (email, Apple ID, Google sign-in linkage)
• Vercel — application hosting, edge network, and request/error logging
• Supabase — primary database (Postgres) for account records, your events and reminders, booking links, bookings, availability, busy times from your iPhone calendar, feedback, app diagnostic logs, and encrypted Google and Zoom connection tokens
• Google Calendar API — reading and writing events on the calendars you connect, and Google Meet links, only when you have explicitly connected your Google account
• Zoom (Zoom Video Communications, Inc.) — creation and deletion of Zoom meetings for your bookings, only when you have explicitly connected your Zoom account. Receives the meeting details needed to create the meeting; we receive the join link and passcode in return.
• Expo Push Notification Service, Apple Push Notification Service and Firebase Cloud Messaging — delivery of notifications, Live Activities and Live Updates to your device. These carry what the notification shows, such as a guest's name, a meeting or event title, and its time.
• Sentry (Functional Software, Inc.) — crash and error reports from the app, stored in the EU
• Telegram — internal alerts to our own team chat: a new sign-up (name, email, account id, sign-in method), feedback from the app or a booking page (app feedback comes with your name, email and number of bookings), and app errors and crashes. Error alerts can include your account id, part of an install identifier, device and app version, the error details and, after a failed sign-in, the email that was typed. Telegram is not used to contact you.
• Google Analytics — aggregate website usage statistics (pages visited, approximate location, device type) for the Gesty website only. It is not present in the mobile app or on booking pages. It sets cookies, so it only runs if you accept them in the website's cookie notice.
• RevenueCat — handling of in-app subscription status and App Store or Google Play receipt verification (only when paid plans become available)
• Meta Platforms, Inc. — advertising measurement for the mobile app only: on by default outside the EU, EEA, UK and Switzerland (you can turn it off in Settings), and only with your consent inside those regions. It is not present on this website: no Meta pixel or Meta cookie is used here. Receives the limited events listed in Advertising & Analytics. Unlike the processors above, Meta is an independent controller of this data and may use it for its own purposes under its own privacy policy — which is why we ask first where the law requires it and why you can turn it off at any time.

With the exception of Meta, described above, these processors are bound by contract to use your data solely to provide their services to Gesty. They are not permitted to use your data for their own purposes.

Internal Ecosystem Access

Gesty is part of the Mamagesty Universe ecosystem. Your account may be used across affiliated applications within this ecosystem to enable single sign-on (SSO) and consistent account management.

Sharing your account across the ecosystem is for single sign-on and account management only. It does not itself involve advertising partners; any advertising measurement is limited to what is described in Advertising & Analytics and can be turned off at any time.

Data Sharing

We never sell or rent your personal data.

Data is shared only when necessary to provide Gesty functionality — for example, a guest's booking details go to the host they booked with — when required by law, or, for advertising measurement, limited to the events and subject to the choices described in Advertising & Analytics. We do not share your calendar contents, meeting details, or any data received from Google or Zoom APIs for advertising or marketing purposes, under any circumstances.

Data Storage and Deletion

Your data is stored securely for as long as your account remains active.

When you delete your account, your data is deleted from our database right away. A few records are kept — for example, meetings you booked on someone else's link stay in their booking, and app diagnostic logs are kept. The full list, with how long each is kept, is on Delete your account, which also explains how to ask for deletion without the app. Backup copies, if any, expire on our database provider's regular schedule.

Connection credentials for Google Calendar and Zoom are an exception to the account-lifetime rule: they are deleted immediately when you disconnect them, without waiting for account deletion.

Subscriptions & Payments

Gesty is currently free and does not offer any paid plans or charges.

If subscription features are introduced in the future, payments will be processed through the Apple App Store, Google Play, and/or authorized providers such as RevenueCat. We do not collect, store, or have access to users' full payment details, including Apple or Google payment information.

Any free trial, if offered, will automatically renew into a paid subscription unless canceled before the trial period ends.

This Privacy Policy will be updated accordingly if paid features are introduced.

Security

We use industry-standard security measures, including encrypted connections, secure authentication, access-controlled storage, and regular security reviews. Google Calendar and Zoom access tokens are stored encrypted (AES-256-GCM).

Your Rights

You may access, update, or delete your personal information at any time within the app.

You can also ask us to provide, correct, or delete the personal data we hold about you by emailing gestyuniverse@gmail.com. We respond to every such request.

You can also change language, timezone, and notification preferences in the app or your device settings.

Google Calendar access can be revoked at any time by disconnecting it in the app, which revokes our access with Google and deletes our copy of the tokens, or in your Google Account's third-party access settings. iPhone calendar access can be turned off in the iPhone's Settings → Gesty → Calendars.

Zoom access can be revoked at any time — in the app, at gesty.ai/meet/zoom, or by removing Gesty from your Zoom account. Each of these revokes our token with Zoom and deletes our copy immediately. Meetings already created remain in your Zoom account.

You may delete your account from within the app or by email. Depending on the option you choose, this removes your Gesty data or permanently deletes your entire account and all associated data across the Mamagesty Universe ecosystem. See Delete your account.

You may turn analytics and advertising measurement on or off at any time — in the app's Settings → Notifications, or on the website via the Cookie settings link in the footer — without affecting any other functionality. See Advertising & Analytics.

Changes to This Policy

We may update this Privacy Policy from time to time. Continued use after such updates means you acknowledge the revised Policy.

Contact

For privacy-related questions or requests: gestyuniverse@gmail.com