Privacy

Signing up stores:

• Your email address, and a password — hashed by our authentication provider, never stored or seen in readable form. If you sign in with Google we receive your email address and name from Google instead.
• What you choose to put on your profile: a display name, a handle, a photo, your timezone and region, and — for business accounts — a contact address and phone number.
• Your schedule: the titles, notes, categories and times of everything you add, and any calendar you connect or timetable you import.

Booking stores your name, your email address, the time you booked, and any note you add. If what you booked is something delivered, it also stores the address you gave us to deliver it to. The person you booked with can see all of it — that is the point of a booking. Nobody else can: the parts of a schedule that are public expose only that a time is taken, never what it is taken for, who took it, or where anything is going.

Some businesses ask for photos when you book — the shoes you are sending in, the look you want. Adding them is optional. They are stored privately and only that business can see them, through links that expire within the hour. A business may also send you photos of the finished work in its "all done" email; those are its own pictures, stored with its gallery.

An invitation is a link. Opening it stores nothing. Answering it stores the name you give, your answer, and any note — and puts a cookie in your browser so the page knows that answer is yours when you come back. No account is made. The host sees your name and your answer; other guests see your name on the guest list, and only if the host chose to show it.

If the event has a chat, what you write there is stored with your name and is visible to the host and to everyone else who has answered. The same goes for putting your name against something on the chip-in list. The host can remove any message and can block a guest, which hides everything that guest has written from everyone else. You can hide a message from your own view, which is kept in your browser and nowhere else, and you can report one to us. Deleting the event deletes all of it.

If you import a schedule by photograph, that image is sent to Anthropic's API to be read, and the times and titles it finds come back for you to check before anything is saved. The picture is used for that reading and is not kept by us afterwards. Do not upload a picture containing something you would not want processed this way — the rest of a photographed page gets sent along with the timetable on it.

Telling us something has gone wrong stores what you wrote, the address to reply to, the name if you gave one, and any screenshots you attached. Screenshots are kept apart from everything else the app stores, in a place nothing public can reach — a link to one only works if we make it, and those expire. Please blank out anything on a screenshot you would rather we did not see; they often carry more than the part that went wrong.

Reporting a chat message or a review stores which one, the reason if you gave one, and an email address if you chose to leave one — you do not have to. Reports are read by a person within a day.

Kept while the complaint is open and for a reasonable time after it is answered, so that if you come back to it there is a record of what was said. Ask and it goes sooner.

Signing in, booking and counting a page view are all limited to a sensible number of attempts a minute, or a script could hammer any of them. Doing that means recognising that the same caller has been here several times just now, which is worked out from the network address your request arrives with.

The address itself is not kept. It is turned into a fingerprint with a secret only this server holds, and the fingerprint is what gets counted — the same caller produces the same one for as long as it is being counted, and there is nothing in it to read back. Those rows are deleted within the hour regardless.

If you turn on notifications for a device, we store what the browser gives us to reach it: an address issued by your phone or browser maker, two keys used to encrypt the message so only that device can read it, and a short label — “iPhone”, “Chrome on Windows” — worked out from your browser so you can tell your own devices apart when you come to turn one off. That label is never shown to anyone else.

Sending a notification means handing it to whoever runs the push service for your device — Apple, Google or Mozilla, depending on the browser. They deliver it. The contents are encrypted to your device before they leave us, so what they can see is that a message is on its way, not what it says. Turning notifications off for a device deletes its record here.

Business accounts get a count of how many people opened their booking page and profile, and roughly where those people arrived from. It is a counter and not a log: one number per day, per page, per source. There is no address, no browser, no visitor identifier, no cookie, and no time more precise than a date, so it cannot be turned into a record of any particular person later — the detail was never kept.

Where a visit came from is worked out in your own browser and only the resulting word is sent — “instagram”, “google”, “direct”. The actual referring address never leaves your device, which matters because it can carry a search you typed or the address of a private group somebody shared the link in.

If a page fails, a report goes to Sentry so it can be found and fixed. It says what went wrong, which line of our code it happened on, and which page you were on. It is not a record of you: your address is not attached, what you typed into a form is never included, and nothing about your screen is recorded or replayed.

Anything that could identify somebody is removed before the report is sent, not after it arrives. Email addresses, booking references and account identifiers are stripped out, and so is the private link from a booking email — that link is the key to a booking, so it is replaced before it can travel anywhere. The same goes for the page you arrived from and for every request the page made before it failed.

Joining a group shares your free and busy times with the other members, so the group can find a time that suits everyone. If the group is tracking money — a trip, shared expenses — then what was spent, who paid it and what each member owes is visible to everyone in that group. Leaving a group stops your availability being shared; amounts already recorded stay, because they are the other members’ record as much as yours.

Leaving a review publishes the name you put on it, your rating and what you wrote on that business’s public page, once the business approves it. Do not put anything in a review you would not want read by anybody. If the review came from a booking, we keep the link between the two so a business can tell a real customer from a stranger — that link is not public. Ask us and a review will be taken down.

Only the companies that run parts of this service, and only for that purpose. None of them are sent your data to use for their own ends, and none of it is ever sold.

All of them are outside Australia. Every one is based in the United States, and several run their systems across Europe and elsewhere as well, so your information is stored and handled overseas rather than here. We remain answerable for what they do with it.

• Supabase — the database, sign-in, and file storage. Effectively everything above lives there.
• Vercel — hosting. Sees requests as they are served. If a business puts its booking page on a domain of its own, that domain name is registered with Vercel so it can serve the page.
• Stripe — payments, when a booking is paid for. Card details go straight to Stripe and never touch this app; we keep only a reference to the payment. A business that takes payments has a Stripe account of its own, run under Stripe's terms; we keep its identifier, whether it is ready to charge, and — if the business asks for a payout early — a record of that payout and the fee on it. Buying the one-off Your brand extra goes through Stripe too, and we keep the date it was bought. So does the business plan: we keep the Stripe customer and subscription identifiers, the plan’s status and renewal date, and when it was first paid.
• Resend — the confirmation, reminder and cancellation emails. Receives the address it is sending to and what the message says.
• Anthropic — timetable photographs, as described above, and only when you import one.
• Sentry — error reports, when something on the site breaks. It receives what went wrong and which page it happened on, with identifiers, email addresses and private booking links removed before anything is sent. Not your IP address, not what you typed into a form, and no recording of your screen.
• Apple, Google and Mozilla — only if you turn on notifications, and only to carry one to your device. What is inside is encrypted to that device first.

Running the service and nothing else: showing your schedule, working out when you are free, taking bookings, and sending the emails that go with them. There is no advertising, no tracking across other websites, and no profiling.

Different things for different lengths of time:

• Your account and everything on it — until you delete it. There is a button for that on your profile settings, and it takes effect immediately.
• Bookings — kept by the business you booked with for as long as they need them. Where money changed hands, Australian tax law requires records to be kept for five years, so a paid booking is kept at least that long even after an account closes.
• Rate-limiting records — deleted within the hour. They hold a fingerprint rather than an address; see above.
• Page-view counters — kept indefinitely, because a count of how many people looked at a page in a month is not about anybody. There is nothing in them to expire.
• Notification devices — until you turn notifications off for that device, or the device stops accepting them, whichever is first.
• Timetable photographs — not kept at all. They are read and discarded.
• Photos you add to a booking — kept with the booking, for as long as the business keeps it.

Deleting your account removes your schedule, categories, services, images, groups you created and notification devices straight away. Bookings you made with other businesses stay with those businesses and stop being linked to you — that is their record of a customer, and a request to remove it goes to them.

A copy of what is held about you, a correction, or its deletion. Schejuold is run from Australia and handles personal information under the Privacy Act 1988 and the Australian Privacy Principles; if you are unhappy with how a request is dealt with you can complain to the Office of the Australian Information Commissioner. If you are in the UK or the EU the GDPR gives you the same rights and a complaint goes to your own national regulator instead. Either way, ask at Something’s gone wrong — you get a reference and a dated reply — or email hello@schejuold.online, which reaches the same person.

If you booked with a business through Schejuold, that business also holds your booking. A request to delete it may need to go to them as well as to us.

Nothing that follows you anywhere else, and nothing read by anybody but this app:

• A session cookie, so the app knows it is still you from one page to the next. Signing in does not work without it.
• If you add a second account to switch between, the sign-in for each account you added — kept on the device so switching does not ask for a password. Signing an account out removes it.
• Which menu sections you left open, which schedule tracks you have hidden, and where you got to in setting up your schedule, so the app is how you left it next time.
• Which guided tours you have already seen, so they do not play again. On an account this is stored with the account instead; the copy on the device is the fallback for when it cannot be.
• On an event page: the cookie that says which answer is yours, which messages you chose to hide, and when you last looked at the chat, so it can tell you what is new.
• On a business's booking page or profile: a note that this browser has already been counted today, so opening the same page twice is not counted as two people. It holds the word “counted” and a date, and nothing that identifies the browser or the person.

There is no advertising, nothing shared with another site, and nothing that recognises you across the web. The visitor-count note is the one thing here that is not strictly required to serve you the page.

The app is this website in a wrapper. It stores nothing beyond what the website stores, asks for no permissions of its own, and sends nothing to Google or Apple except what is described under notifications. Deleting your account from inside the app deletes it exactly as it does on the web.

If this page changes in a way that matters, the date at the top changes with it.