Privacy

This page explains what data Parea stores, why, where it is hosted, and how to have it deleted. Parea is a private, non-commercial, invite-only beta: there is no account, no advertising, no audience measurement tool, and no tracking cookie.

This page is also available in Français, Deutsch and Español.

Data stored on the server

• The plan: its title, its time zone, and the planner's display name.
• Participants: the display name each person chooses when joining the plan.
• Availability: the days and time ranges the planner proposes, and each participant's answers.
• Activities: each participant's preferred activity types and optional free-text idea.
• Access keys: only a fingerprint (hash) of private links and edit keys, never their raw value.

This data is used only to run the plan: showing the proposed days, saving answers, and ranking the time slots. Plan participants see, for each slot, the first names of the people who are free, and only the planner's screen also shows who is not free and who has not answered yet. No screen shows the times a person entered, but they can be deduced: by combining all the slots and the names attached to them, anyone with the plan link can rebuild each participant's times on the proposed days, in 30-minute steps. Only enter times you are willing to share with the other participants of the plan.

Data kept on your device

Your browser keeps in its local storage your edit key, the plan's invite link, the list of plans opened on this device (title, your role, and last opened date), an unsent answer draft, an unsaved draft of proposed days, your light or dark theme choice, and your language choice; the creation step in progress is kept in the tab's session storage and disappears when the tab closes. These items are never sent to a third party. The edit key is the exception: your browser sends it to the Parea API with every request about the plan, to prove your right to open or change it; the server keeps only a fingerprint of it, never the value itself. The answer draft is sent only when you press "Send", and the draft of proposed days only when you press "Save proposal". The plan list, the invite link, the creation step, the theme, and the language never leave your device. Clearing the site's data in your browser deletes them, but you then lose edit access to the plan from this device.

Google Calendar (optional)

If you connect Google Calendar, Parea asks only for permission to read your busy times (free/busy), never the title, location, or attendees of your events. Google access tokens are encrypted (AES-256-GCM) before they are stored. Busy times are read on demand to suggest time slots and are not stored with your availability; only the classification you choose for a busy block ("blocking" or not) is kept, attached to your participation in the plan, under an opaque block identifier that reveals neither the title nor the content of the event: this classification is therefore pseudonymous, not anonymous. Disconnecting Google Calendar from the plan deletes the tokens; you can also remove access at any time from your Google Account permissions. Data received from Google is never sold, never shared with a third party, and never used for advertising or to train an artificial intelligence model. Parea's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Technical logs

The server writes technical logs to diagnose errors. They pass through a filter that removes private links, keys, tokens, and page addresses. Your IP address is used in memory to limit abuse (number of requests per minute) and is not stored in the database.

Hosting

• The website is served by Vercel.
• The API runs on Google Cloud Run, in the Belgium region (europe-west1).
• The PostgreSQL database is hosted by Neon, in a European Union region.

Retention and deletion

A plan is deleted automatically the day after its last proposed day, at midnight in the plan's time zone: if the last proposed day is 1 April, the plan disappears on 2 April. A plan with no proposed day is deleted thirty days after it was created. Deletion removes everything the plan contains (participants, availability, activities, access keys, Google Calendar connections) and cannot be undone; the plan link then stops working. You can also ask for a plan to be deleted before those dates. Temporary technical data expires on its own: a Google authorization in progress after ten minutes, a Google connection waiting for confirmation after two minutes, a write idempotency key after seven days. A regular maintenance task then erases it automatically. The idempotency record of a plan's creation, which contains only fingerprints, is kept as long as the plan and deleted with it. To have a plan or your answers deleted, or to exercise your GDPR rights of access, rectification, and erasure, write to contact@parea.date.