Privacy policy
This policy explains what personal data Find Time collects, why, who it is shared with, and the rights you have under the GDPR. It covers the marketing site, the waitlist, and the Find Time web app.
1. Who is responsible
Find Time is operated by the individual trading as Lexora. For any privacy question or to exercise a right below, contact privacy@usefindtime.com.
If the operating entity is based in Germany, a separate Impressum is published as required by §5 DDG.
2. What we collect
Waitlist: your email address, the page the sign-up came from (a short "source" label), and a salted, irreversible hash of your IP address used only for spam and rate-limit protection. Your raw IP is not stored.
Account: your email address, your name if you give it, and a password hash (or the Google account you sign in with). Sign-in runs on our own servers and this data is kept in our database, together with your active sign-in sessions (device and IP address, to keep them secure). For a connected Google account we keep Google’s anonymous account id, not its email address; the email is read from Google only to show you which account is connected.
What you create in Find Time: tasks, habits, events you add, your planning preferences and your Plan with AI conversations are stored so the app can work for you.
Google Calendar (optional): if you connect a Google account, we request access to read your calendars and to manage events. We store only when your events are (start and end, whether they show as busy, your RSVP and the number of guests) plus encrypted OAuth tokens. Event titles, notes, locations, guest names and video links are not stored: they are read from Google each time you open your calendar or use Plan with AI, used for that request and discarded. We write to your calendar only when you ask us to, in two cases. First, if you turn on Google Calendar sync, we add, update and remove the blocks you keep in Find Time as private events on your primary calendar, and read back changes you make to them there. Second, when you move, resize or delete one of your own events in Find Time, we make that same change in Google Calendar; this is offered only for one-off events you organise with no other guests, and no one is notified. Find Time never changes your Google events on its own, and never changes meetings with other guests, repeating events or events someone else organised.
Find Time’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data or use it for advertising, and we do not use it to develop, improve or train generalized AI or machine-learning models.
You can disconnect Google at any time in Find Time’s calendar settings, which revokes our access and deletes the stored event times for that account. You can also remove access from your Google Account under Security → Third-party apps & services.
Security: OAuth tokens are encrypted at rest, and all traffic between your browser, our servers and Google is encrypted in transit (TLS).
AI features: Plan with AI reads what you type with an AI model (OpenAI). It is sent the messages of that conversation, what you have told Find Time (your rules, preferences, settings, tasks and habits), the times of your events, and event titles, including those of your Google events, when it looks something up to answer you. For example, if you ask for time after a named event, the model reads the calendar to find it. The notes, locations and guests of your Google events are never sent. Saved copies of Plan with AI’s replies have Google event titles removed. Each account has a monthly AI allowance; past it, Plan with AI works without the model until the month ends. OpenAI does not use this data for training and keeps it for up to 30 days for abuse monitoring only.
Operational logs: standard security and error logs (timestamps, coarse request metadata) generated by our host.
Cookie choices: when you choose in the cookie banner, we log a random consent ID (also kept in your browser), the date, the version of this policy and what you chose. Nothing that identifies you is stored with it.
3. Why we can process it (legal bases)
Waitlist — your consent (Art. 6(1)(a)). You can withdraw it any time by asking us to remove your email.
Running the app for you — performance of a contract (Art. 6(1)(b)).
Spam prevention, rate limiting and security logging — our legitimate interest in keeping the service available and abuse-free (Art. 6(1)(f)).
Keeping a record of your cookie choice — our legal obligation to be able to show consent (Art. 6(1)(c) with Art. 7(1)).
Connecting Google Calendar — your consent, given through Google’s own permission screen.
4. Processors we use
Resend — sends sign-in codes and beta invitations to your email address.
Neon — managed PostgreSQL database (EU region).
Google — Calendar API when you connect an account.
OpenAI — reads what you type in Plan with AI, and event titles and times when it looks them up, and chooses what to look up or propose. OpenAI does not use API data for training and keeps it for up to 30 days for abuse monitoring.
Railway — application hosting and infrastructure logs.
Better Auth — an admin dashboard for sign-ins: receives account and sign-in events (user ID, name, email address, time, IP address and device) so we can support and secure accounts.
Each acts as a processor under a data-processing agreement and only on our instructions.
5. How long we keep it
Waitlist entries: until launch invitations are complete or you ask for removal, whichever is first.
Account and calendar data: for as long as your account exists. Deleting your account removes your user row and cascades to your profile, connected accounts, calendars and events; your sign-in data and sessions are deleted with it.
Rate-limit counters: rolling, cleared automatically after about two days.
Cookie-choice log: 3 years, then deleted automatically. Your browser keeps the choice for 12 months, after which we ask again.
Logs: retained for a short period by our host for security and debugging.
6. International transfers
Data is stored in the EU where possible (Neon EU region). Some processors (Google, Resend, OpenAI, Railway, Better Auth) may process data outside the EU under Standard Contractual Clauses or an adequacy decision.
7. Your rights
You have the right to access, correct, delete, restrict or object to processing of your personal data, and to data portability. Where processing is based on consent, you can withdraw it at any time.
To exercise any of these, email privacy@usefindtime.com. You also have the right to lodge a complaint with your local data protection supervisory authority.
9. Changes
We may update this policy as the product changes. The date at the top reflects the last revision (currently 5 October 2026).