PRIVACY POLICY
Your schedule data should not be a mystery.
This policy explains what ScheduleFlowLab processes when you browse the website, build a schedule, use browser storage, create an optional account, save to the cloud, view advertising or contact us.
INFORMATION WE PROCESS
Different actions create different data.
You can browse and build in guest mode without opening a ScheduleFlowLab account. Technical request information can still be processed when a page loads.
| When this happens | Information involved | Why it is used |
|---|---|---|
| Visit the website | IP address, browser or device information, requested URL, timestamp, referral and server or security logs. | Deliver pages, diagnose faults, protect the service and prevent abuse. |
| Build in guest mode | Schedule names, events, people, times, preferences and planner settings you enter. | Create the schedule and restore compatible work in the same browser when local saving is used. |
| Create or use an account | Email, account identifier, sign-in method, session data, and profile name or image when supplied. | Authenticate you, display the account and connect it to the correct cloud workspace. |
| Use cloud features | Schedules, events, people, availability, time off, templates, versions, memberships or shares you choose to save. | Store, retrieve, update, organize and share account-linked data through available controls. |
| Contact ScheduleFlowLab | Your name, reply email, selected topic, page URL, message and any attachment you choose to send. | Respond, investigate a report or handle a privacy request. |
| View ads when enabled | Consent signals, IP address, device or browser information, ad requests and interactions, cookies or similar identifiers. | Deliver, secure, measure and control advertising, including permitted personalization. |
PURPOSES
Processing is connected to a defined job.
Provide the service
Load pages, run tools, maintain a valid session and perform account or cloud actions you request.
Protect and troubleshoot
Detect misuse, enforce access rules, investigate failures and maintain reliability and security.
Communicate
Use the reply information you provide for the conversation or request you initiate.
Meet obligations
Keep or disclose limited data when required by applicable law, valid legal process or legal claims.
Depending on location and activity, processing may rely on providing a service you request, legitimate interests in operating and securing the site, consent, or compliance with a legal obligation. The applicable basis depends on the specific processing.
LOCAL & CLOUD STORAGE
Know where a schedule is being kept.
Guest mode: this browser
Compatible builders may keep schedule content and preferences in local browser storage. Another device does not automatically receive that data. Clearing site data, losing the device or replacing the browser profile can remove it. Files you export are controlled by you after download.
Signed-in mode: account-linked cloud
When you sign in and choose a cloud feature, relevant account and schedule records are sent to Supabase-hosted services and linked to the authenticated identifier. Session information may persist so a valid sign-in can continue between page loads.
Do not place passwords, login codes, API keys, payment-card information, patient records or unnecessary confidential details in schedule fields. Use the least identifying information that still completes the planning task.
SERVICE PROVIDERS
Some features require other services.
Hosting and WordPress
Hosting, WordPress and active security components can process request logs, operational events and technical data needed to deliver and protect the website.
Supabase
Supabase provides optional authentication, session, database and cloud-workspace infrastructure.
Supabase Privacy Notice ↗Google sign-in
If you choose Google sign-in, Google authenticates you and returns the account information authorized for sign-in, such as an identifier, email, name or profile image.
Google Privacy Policy ↗Google advertising—when enabled
Google and approved vendors may use cookies, local storage, IP addresses, device data, consent signals and ad interactions for delivery, measurement, fraud prevention, frequency controls and permitted personalization.
Google advertising information ↗Email providers
The Contact page prepares a message in your email application. If you send it, your provider and the receiving mailbox provider process that email under their own policies.
Consent management
Where required, a consent platform can process region, consent choices and related technical signals so optional technologies follow the recorded choice.
Where consent is required, non-essential advertising or measurement technologies should be controlled by the consent interface. Google-served ads for visitors in the European Economic Area, United Kingdom and Switzerland require an appropriate Google-certified consent management platform integrated with the IAB Transparency and Consent Framework.
COOKIES & SIMILAR TECHNOLOGIES
Browser storage supports core functions and optional services.
ScheduleFlowLab uses browser storage for functions such as guest schedule saving, preferences and persisted account sessions. When advertising or measurement is active, providers may also use cookies, local storage and similar signals for the purposes described above.
Clearing site data can sign you out and permanently remove schedules stored only in that browser. Read the Cookie Policy for categories, purposes and controls.
RETENTION & DELETION
Different records have different lifecycles.
Local schedules
Remain until deleted, replaced, site data is cleared or access to that browser profile or device is lost. ScheduleFlowLab cannot restore data that existed only locally.
Account and cloud data
May remain while the account or feature is active and afterward only as reasonably needed for deletion processing, backups, security, disputes or applicable obligations.
Emails and support records
May be kept as reasonably needed to handle the conversation, document the issue and protect the service, then deleted or minimized.
Technical logs
Retention depends on operational, hosting and security needs and should not exceed what is reasonably necessary for those purposes and applicable obligations.
YOUR CHOICES
Rights depend on where you live and which law applies.
Identity may need to be reasonably verified. Exceptions can apply, and this policy does not claim every right exists in every location.
Access: ask whether applicable personal information is processed and request access.
Correction: request correction of inaccurate account or profile data.
Deletion: request deletion where the law provides that right and no valid exception applies.
Restriction or objection: make these requests where applicable.
Portability: request an applicable portable copy where required.
Consent: withdraw consent for future processing when consent is the relevant basis.
Regulator: raise a concern with an appropriate privacy regulator where available.
SECURITY & CHILDREN
Controls reduce risk; they cannot eliminate it.
ScheduleFlowLab uses authentication and database-access controls for account-linked features. No website, storage system or transmission method can be guaranteed completely secure. Protect credentials, sign out on shared devices and avoid unnecessary sensitive information.
The general website and account system are not directed to children under 13. A parent or guardian who believes a child submitted personal information can contact ScheduleFlowLab with enough information to investigate—without sending additional sensitive information in the first message.
Providers may process information in countries other than yours. Where applicable law requires safeguards for cross-border processing, the relevant parties are responsible for using them.
PRIVACY REQUEST
Contact ScheduleFlowLab about your information.
Use the Contact page or email contact@scheduleflowlab.org . Include the account email when relevant, but never send a password, login code, authentication token or private schedule contents.