privacy policy

skore accesses the following google user data:

• google account information: your email address, display name, and profile identifier — obtained through google oauth sign-in.
• google calendar data: calendar events including event titles, dates, times, and descriptions — accessed via the google calendar api with your explicit consent (scope: https://www.googleapis.com/auth/calendar).

in addition to google data, skore stores tasks, projects, team settings, and preferences you create within the application.

your google user data is used solely for the following purposes:

• authentication: your google account information is used to identify and authenticate your account.
• calendar synchronization: google calendar events are fetched and displayed within skore to provide a unified view of your schedule alongside your tasks and projects.

skore does not use your google user data for advertising, marketing, analytics, or any purpose unrelated to the core functionality described above.

skore does not sell or rent google user data, and does not share it for advertising, marketing, or profiling. we do not transfer it to data brokers, and we do not use it to develop, improve, or train generalized ai or machine-learning models.

google user data (your google account email, display name and profile identifier, and your google calendar events) is shared only with the following parties, only as needed to run skore:

• supabase (supabase inc.) — our database and authentication provider. it stores your account, your tasks and notes, your google calendar event data synced into skore, and your google oauth tokens. supabase acts as our processor and may not use this data for its own purposes.
• vercel (vercel inc.) — our hosting provider. google user data passes through vercel's servers in transit while pages and api requests are served. vercel acts as our processor and may not use this data for its own purposes.
• google — when you schedule a task, skore writes it back to your own google calendar through the google calendar api.
• people you invite — if you add someone to a team or share a project or note with them, the items you shared become visible to them, along with your google account email and display name, so they can see who they are working with. your google calendar events are never shared this way.
• legal requests — we may disclose data if required to do so by law, or to protect the rights and safety of our users.

skore has no other recipients. if we ever add one, we will update this policy before the change takes effect.

google user data — including your google oauth tokens and any calendar data synced into skore, which we treat as sensitive — is protected by:

• encryption in transit — all traffic between you, skore, supabase, and google's apis uses TLS 1.2 or higher. skore is served over HTTPS only.
• encryption at rest — the database and its backups, including stored google oauth tokens and synced calendar data, are encrypted at rest by supabase (AES-256).
• access control — every table is protected by postgres row-level security, so a signed-in user can only read or write their own rows. these policies are enforced by the database itself, not just by application code.
• credential handling — your google oauth tokens are stored in the database described above, encrypted at rest, and are never sent to the browser and never logged. skore's own api keys and its google client secret are held as server-side environment variables and are never committed to source code.
• limited scope — skore requests a single google scope, calendar, which google asks you to grant when you sign in. it requests no other google scope: not gmail, drive, contacts, or google tasks. administrative access to production data is limited to skore's sole developer.

your google account information — your email address, display name and profile identifier — is kept for as long as your skore account exists, and is deleted when you delete your account. your google oauth tokens are kept only while google calendar stays connected. calendar events that skore imports become tasks in your skore account, and — like anything else you create in skore — they are kept until you delete them or delete your account.

• disconnecting google calendar — choose disconnect in skore's settings. skore immediately revokes your tokens with google and deletes them from its database, and stops all further access to your calendar. events already imported stay in your skore account as your tasks, with their link to google removed; skore does not delete your work on disconnect. you can delete those tasks yourself at any time, individually or by deleting your account. you can also revoke access at google account permissions, which stops all further access at once.
• deleting your account — email email@jae.ee and we will delete your account, your google oauth tokens, all google calendar data synced into skore, and your tasks, projects and notes within 30 days of the request.
• backups — deleted google user data is purged from encrypted database backups within 30 days, when those backups age out.

deleting a task in skore that was synced to your google calendar removes the matching event from your calendar; deleting your skore account does not delete anything else in your google account.

skore's use and transfer of information received from google apis adheres to the google api services user data policy, including the limited use requirements. specifically:

• we only request access to data that is necessary for skore's functionality
• we do not use google user data for serving advertisements
• we do not allow humans to read your data unless required for security purposes, to comply with applicable law, or with your explicit consent
• we do not transfer google user data to third parties except as necessary to provide or improve the application, for security purposes, or to comply with applicable law

we may update this privacy policy from time to time. changes will be posted on this page with an updated date. continued use of skore after changes constitutes acceptance of the revised policy.

if you have questions about this privacy policy or your data, contact us at email@jae.ee