Your page. Your privacy.

1. Google data we access

Google Sign-In. With your authorization, Google returns basic account information through the openid, email and profile permissions. MuradMe uses your Google account identifier, name, email address and email-verification status. We store the identifier, name and email address as your account identity. We do not receive your Google password or automatically copy your Google photograph into your profile background.

Calendar availability. If you authorize https://www.googleapis.com/auth/calendar.freebusy, we request the start and end times of busy intervals in your primary Google Calendar for a relevant date range. This availability request does not give us event titles, descriptions, locations or guest lists.

MuradMe calendar events. The permission https://www.googleapis.com/auth/calendar.events.owned allows management of events on calendars you own. Our integration uses it for private events it creates in your primary calendar: checking and creating approved meeting events, and checking, creating, updating or removing Open Plan events when the plan or your participation changes. Processing an app-created event may include its identifier, status, title, description, location and start/end times. We do not use this permission to browse or copy unrelated calendar events.

Authorization data. Google provides access tokens and, for an ongoing calendar connection, a refresh token. We store the refresh token encrypted, with the granted permissions and connection update time. Access tokens are used by the server to call Google APIs; they are not published or returned to other users. These permissions do not request access to Gmail messages, Google Drive files or Google Contacts.

2. How we use Google data

• Account identity: recognize your account, sign you in and associate your profile, requests and plans with you. Your email address is also used for applicable account and transactional messages.
• Availability: show busy intervals to the audience you permit, check scheduling conflicts, and filter Explore results for a requested meeting time only where your availability and request settings allow it.
• Event synchronization: add an approved meeting or confirmed Open Plan to the connected calendar, prevent duplicate app-created events, and reconcile Open Plan changes or cancellations. A Google Calendar connection is not required to keep plans inside MuradMe.
• Continued access: use the refresh token to obtain short-lived access tokens while your calendar is connected, including for permitted synchronization when you are not actively using the app.

We do not sell Google user data, use it for advertising or advertising profiles, provide it to data brokers, use it for lending or credit decisions, or use it to train generalized artificial-intelligence or machine-learning models.

MuradMe's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This applies to Google data and information derived from it.

3. Other information you provide

We store the profile information and settings you choose: name or nickname, photograph, biography, city, time zone, dated locations, Spotify links, Instagram link and privacy preferences. Your account may also have email sign-in records, passkey public credentials and an In Prime entitlement status. Passkey private keys remain with your authenticator.

Meeting requests and Open Plans can include descriptions, names, contact details, dates, locations, applications, decisions and reasons for leaving. My people stores saved people, private notes, pins and blocks. We also store notifications, reports and synchronization records needed for these features. Details you type into a request are separate from the Google identity linked to a signed-in sender.

We process technical request information to provide the service and prevent abuse. Application rate limits use hashed IP-derived identifiers. Infrastructure providers also process network information needed to serve requests.

4. Sharing and service providers

Other users and visitors. Published profile content is shown according to your privacy settings. A name initially obtained from Google may become part of the profile you choose to publish. Your Google account email, Google account identifier and OAuth tokens are not automatically displayed on your public page. Contact details you put in public text may be visible to its audience.

When you enable availability sharing, the permitted audience can see busy times or a matching availability result, not the titles, descriptions or guests of unrelated Google Calendar events. Meeting recipients receive your submitted details and may see the public profile identity of a signed-in sender. Open Plan details and locations follow the plan's audience, location and participation settings. Private My people notes are not shown to the people they describe.

Cloudflare. Cloudflare hosts the website and server APIs. Its D1 database stores account information, including Google identity data, encrypted calendar refresh tokens and application records. R2 stores uploaded photographs. Cloudflare processes these data to provide hosting, storage, delivery and security for MuradMe.

Google. Google processes authorized sign-in and Calendar API requests. Synchronization sends relevant meeting or plan details to your Google Calendar. Calendar access and any separate sharing you configure in Google remain subject to Google's controls.

Resend. Resend delivers sign-in and transactional emails when configured. It receives the recipient email address, which may come from Google Sign-In, and message contents needed for delivery, such as names and relevant request or plan details. We do not send Google OAuth tokens or unrelated calendar busy data to Resend.

Music, fonts and Android updates. Spotify provides music links, metadata and embedded playback. Google Fonts supplies the website typeface. Expo/EAS delivers Android software updates. Using these services may send technical information such as your IP address; Spotify may use its own cookies. We do not supply them with Google Calendar contents or OAuth tokens for these features.

Providers may process data in countries other than where you live. We do not transfer Google data to advertisers or unrelated recipients. Other disclosures of Google data are limited to what is necessary for security or applicable law, consistent with Google's Limited Use requirements.

Human access. Apart from information you choose to share with other users, human access to Google data is limited to your affirmative agreement to view specific data, necessary security or abuse investigations, or legal obligations. It is not used for routine browsing of your calendar.

5. How we protect your data

• MuradMe uses HTTPS for website, app API and Google API communications.
• Stored Google Calendar refresh tokens have application-level AES-GCM encryption bound to the account. The encryption key is a server secret, separate from the stored token.
• Cloudflare D1 and R2 encrypt stored database records and objects at rest, in addition to the application-level encryption of calendar refresh tokens.
• Private operations require authenticated sessions and ownership or access checks. Calendar authorization verifies that the connected Google identity matches the account.
• Google OAuth uses expiring state and PKCE. Website session cookies use Secure, HttpOnly and SameSite controls. The database stores session-token hashes rather than raw session tokens.
• On Android, the sign-in token is kept in device secure storage. The app also keeps a local account cache and may keep editor drafts on the device.

These measures reduce unauthorized-access risks; no online service can guarantee absolute security. Do not send passwords or sign-in codes in privacy or support requests.

6. How long we keep data

• Google identity and account records: kept while your account exists and until a verified deletion request is processed. Inactive accounts have no automatic deletion deadline.
• Calendar refresh tokens and connection records: kept while your calendar is connected. Disconnect calendar deletes the stored connection and refresh token from the application database and disables busy-time sharing. Account deletion also includes the stored connection.
• Busy intervals and event responses: processed for availability or synchronization rather than kept as a history of your Google Calendar in the application database. Responses may exist temporarily in server or device memory or short-lived caches.
• MuradMe meeting, plan and synchronization records: kept to display requests, plans, history and synchronization status until removed through relevant controls or reviewed as part of a data deletion request. Hiding or clearing a history view is not a request to erase every associated record everywhere.
• Authentication records: sessions expire after 30 days unless ended earlier. OAuth state and sign-in challenges have short validity periods, normally up to 10 minutes, enforced on use. Expiry prevents use; it does not mean every database record is erased at that exact moment.

Limited records may be retained for a legal obligation, security investigation or dispute. We explain applicable exceptions and retention periods when responding to deletion requests. Copies in provider backups may remain until those backups expire under the provider's retention process; removing live data is not instant erasure of every backup.

7. Your controls and deletion requests

Studio lets you edit your profile, control its audience, unpublish it, change your photograph or music, and manage availability sharing. Profile, availability and incoming-request privacy settings are separate. Unpublishing or signing out does not delete your account.

Disconnect Google Calendar: use Disconnect calendar in Studio to remove the stored connection and stop future calendar access through it. To revoke Google's authorization itself, use your Google Account's third-party connections settings. Revoking access does not automatically delete your MuradMe account; disconnecting does not remove events already created in Google Calendar.

Delete your account or Google data: follow Delete your account or email m.shukyurov@gmail.com. Request deletion of the full account or specify Google identity, stored calendar authorization or associated data. Send from your account email if possible and identify your profile. Do not send passwords, login codes or identity documents in your first message.

Deletion is manual, not instant or automated. We verify ownership, review the scope, delete applicable live account data and uploaded media, and tell you the outcome or necessary further steps. For a request limited to Google data, we explain any effects on sign-in or other account functions before proceeding.

Events already written to Google Calendar, delivered emails and copies received by other people are separate from MuradMe's live database. You may need to delete calendar events in Google Calendar and manage those copies separately. Android sign-out clears its saved session and account cache; removing local app data does not delete server-side data.