How AlignHour keeps your data safe

What AlignHour can see in your Google account

• Your email address. So AlignHour knows which account is yours and which plan you have.
• Events on the calendars you own. AlignHour only creates and updates the meetings you ask it to, sends the invites, and reads the replies and the current time of those same events. It never reads your other events.
• Not your Gmail. AlignHour has no access to your Gmail. You read and send your emails yourself.

Google reviewed AlignHour's request to use your calendar and approved it on 31 October 2026.

The Chrome extension has one more permission: it can create one spreadsheet in your Google Drive for the activity log, and only does so if you switch the log on. It can't open your other files.

Your Google data is never used for ads, never sold, and never used to train AI. Nobody at AlignHour reads it, unless you ask us to or the law requires it. AlignHour follows the Google API Services User Data Policy, including its Limited Use rules.

You can remove AlignHour's access at any time at myaccount.google.com/permissions.

Where your data is kept

• Your AlignHour account (meetings, saved clients and settings) is stored by Supabase, in its Singapore region.
• If you use the Chrome extension, it also keeps a copy on your computer.
• Our website and the web app are delivered by Cloudflare.
• Everything travels over encrypted HTTPS, and our hosting provider encrypts the stored data too.

How it is protected

• A locked database. Nobody can read our database without its password, which only AlignHour's server code and our administrator (for support, security and backups) have. Every table is locked, and the app gives you only your own meetings and what your team shares with you.
• Google confirms who you are. Each time you sign in, our server checks Google's signed proof: that Google really signed it, that it was made for AlignHour, that it hasn't expired, and that Google has confirmed your email address. AlignHour never trusts an email address just because the app sends it.
• Your calendar access stays with you. When the web app adds a meeting to your Google Calendar, your browser talks to Google directly. Google's sign-in stays in your browser and is never stored on our server.
• Sign-in passes are stored scrambled. If you tick "Keep me signed in", your device gets its own sign-in pass for 30 days (1 day if you untick it). Our server keeps only a scrambled copy of it, never the pass itself.
• Sign out everywhere. In the web app, Account → "Sign out on all devices" ends every sign-in pass at once. Your data stays.
• Strict browser rules. The web app tells your browser to run only AlignHour's own code, to connect only to AlignHour's server, Google and our public-holiday service, to always use HTTPS, and never to show the app inside another website.
• Limits against abuse. Our server limits how often it can be called.

Your data, your control

• We never sell your data or use it for ads.
• Delete one meeting in the app, and it is deleted from your AlignHour account too.
• Delete everything with "Delete my data" under Account in the web app, or "Delete my backed-up data" in the Chrome extension's Settings. Your plan, its payment records, this month's booking count and your account email stay, so your plan keeps working.
• Ask for a copy, a correction or full deletion by emailing privacy@alignhour.com from the address you use with AlignHour. We reply within 30 days. These are your data rights (GDPR and CCPA), and you have them wherever you live.
• Kept until you delete it. Meetings, saved clients and settings stay in your AlignHour account until you delete them.

Companies that help run AlignHour

We share your data only with these service providers, so they can run AlignHour for you:

• Supabase (Singapore): stores your AlignHour account.
• Cloudflare (USA): delivers our website and web app, and counts website visits without cookies.
• Zoho (USA): sends our emails and runs our support inbox.
• Google: sign-in and Google Calendar, for the features you switch on.
• Your browser's push service (Google, Apple, Mozilla or Microsoft): delivers the notifications you turn on.
• Lemon Squeezy (USA): handles payments. We never see your card.
• Nager.Date: our public-holiday list. It only ever receives a country code and a year.

When your data leaves your country, these providers protect it with standard contractual clauses or equivalent safeguards.

Reporting a security problem

If you think you have found a security problem in AlignHour, please email security@alignhour.com. Tell us what you found and how we can see it. Please give us a chance to fix it before you share it with anyone else.

This page is a short summary. The full details are in our Privacy Policy and Terms of Service. Questions about your data? Email privacy@alignhour.com.