Privacy Policy

• Account: your email address, a passkey credential (public key only — we never see a password), and an optional display name.
• Preferences: your city, interests, whether you want kid-friendly picks, your timezone, and your reactions to events (likes, dislikes, category votes). This is the taste profile our recommendations run on.
• Your personal calendar feed (optional): if you connect a private iCal URL, we read it to learn when you are busy or free. We store the URL and use busy/free times to schedule around your life. We never display the URL or your calendar contents back to anyone.
• Google Calendar (optional): see the dedicated section below.
• Social features: if you invite friends to a hangout or forward an event, we store the email addresses you provide in order to send those invitations.
• Messages: what you type to the concierge, so the conversation works and your preferences improve.

If you connect Google Calendar, we request calendar access to do two things: create a dedicated calendar named “good.pm” in your account, and write and update our event picks inside that calendar. We read your calendar list only to find or create that calendar. We do not read, store, or process events from your other calendars. You can disconnect at any time in good.pm, and you can revoke our access at myaccount.google.com/permissions, which invalidates our stored tokens.

good.pm’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We protect your information — and especially sensitive data like your Google Calendar access and connected-calendar times — with the following measures:

• Encryption in transit: all traffic to and from good.pm is encrypted with TLS (HTTPS). We never transmit your data over unencrypted connections.
• Encryption at rest: your data is stored by Convex, our database provider, which encrypts data at rest on managed cloud infrastructure.
• Sensitive credentials: Google OAuth tokens (including the refresh token that grants Calendar access) are held server-side only. They are never sent to your browser or to any third party (including Anthropic), are scrubbed from your account record immediately after they are handed to the calendar sync, and are deleted the moment you disconnect Google Calendar or revoke access at myaccount.google.com/permissions.
• Access control:every read and write goes through authenticated, per-user server functions, so your data is scoped to your own account and is not accessible to other users. Access to production systems is restricted to good.pm’s operator.
• Data minimization:for sensitive Google Calendar data we keep only what’s needed — we create and write only our own “good.pm” calendar and read only busy/free times. We do not copy or retain the contents of your other calendars.
• Deletion: disconnecting Google Calendar deletes our stored tokens immediately; emailing privacy@good.pm deletes your account and its data within 30 days.

• Convex — our database and hosting provider; all application data lives there.
• Resend — delivers our emails (invites, your calendar link).
• Google — only if you connect Google Calendar, as described above.
• An IP-based lookup may run in your browser once to suggest your city; the guess is only saved if you keep it.

We do not sell your data, run ads, or share your information with anyone beyond these service providers.