CORE Calendar

Privacy Policy

Scheduling service at cal.cored.app · Last updated 20 September 2026

This policy describes how CORE Marketing Group (“we”, “us”) handles personal information in the scheduling application we operate at cal.cored.app (the “Service”). The Service is a private, self-hosted deployment used by our staff to coordinate meetings. It is not open to public registration.

Who this covers

Two groups of people are described here, and they are treated differently:

  • Account holders — our staff, who sign in and connect their own calendars.
  • Invitees — anyone who books a meeting through a public booking link without holding an account.

What we collect from account holders

  • Name, email address, username, time zone, and a hashed password.
  • Availability rules, event types, and meeting preferences you configure.
  • Calendar connection credentials for any calendar you choose to link, stored encrypted.
  • Busy/free information and event details read from your connected calendars, used to calculate when you are available.

What we collect from invitees

When someone books a meeting, we collect the name, email address, and any answers they provide to questions on the booking form, along with the date, time, and time zone of the booking. This is used to create the meeting, send confirmations and reminders, and let both parties reschedule or cancel.

Google Calendar access

Account holders may connect a Google account. When you do, Google asks you to approve specific permissions, and we request only these:

  • calendar.readonly — to read existing events so the Service knows when you are already busy.
  • calendar.events — to create, update, and cancel the calendar events that result from bookings made through the Service.

We use this access solely to show accurate availability and to write bookings onto your calendar. Event details read from your calendar are used to determine busy times; we do not read them for any other purpose.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to serve advertising, we do not sell it, we do not transfer it to third parties except as needed to provide the Service, and we do not allow humans to read it except where you explicitly ask us to, where required by law, or where necessary for security purposes.

We do not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models.

Connecting a personal calendar

Account holders may connect personal calendars alongside work calendars so that availability reflects their real schedule. When you connect a personal calendar, the Service reads its busy times for availability purposes. You control which calendars are connected and which are used for conflict checking, and you can disconnect any of them at any time from Settings.

Where your data lives

The Service runs on a private server we control. Data is stored in a PostgreSQL database on that server. Calendar credentials are encrypted at rest. We do not use a third-party scheduling vendor, and your calendar data is not sent to one.

Who else sees it

We share personal information only with the service providers needed to run the Service:

  • Our hosting provider, which operates the server infrastructure.
  • Our transactional email provider, which delivers booking confirmations, reminders, and password resets.
  • Any video conferencing or calendar provider you choose to connect, to the extent needed to create meetings.

We do not sell personal information and we do not share it for advertising purposes.

How long we keep it

Account and booking records are retained while the account is active and for as long as needed for our business records. Calendar access tokens are deleted when you disconnect a calendar. You may ask us to delete your account and associated data using the contact details below.

Revoking access

You can disconnect a calendar at any time from Settings in the Service. You can separately revoke our access from your Google account at myaccount.google.com/permissions. Revoking access stops further reading or writing immediately; events already created on your calendar remain there.

Your rights

You may request access to, correction of, or deletion of the personal information we hold about you. Invitees who have booked a meeting may request deletion of their booking record. Contact us using the details below and we will respond within a reasonable period.

Security

The Service is served exclusively over HTTPS. Passwords are stored hashed, and calendar credentials are encrypted at rest. No system is perfectly secure, but access to the server is restricted to authorized administrators.

Children

The Service is not directed to children under 13 and we do not knowingly collect their information.

Changes

If we make material changes to this policy, we will update the date at the top of this page and, where appropriate, notify account holders directly.

Contact

CORE Marketing Group
110 Corporate Park East Dr
LaGrange, GA 3024

legal@coremarketing.group