1. Who we are
ActEarly ("we", "our") is an early-stage, unincorporated project operated from India. It provides a desk-break scheduling tool at actearly.app. Questions about this policy: +91 89391 11367.
2. What we collect
Account data. When you sign in with email and password, Google, or Microsoft, we receive the account information needed to identify you, such as your name, email address, and profile photo when provided. We store this in our database.
Calendar data. Calendar connection is optional and separate from login.
For Google we request https://www.googleapis.com/auth/calendar.events; for
Microsoft we request delegated Calendars.ReadWrite. We use this access to
read today's primary calendar event titles and start/end times to find gaps between
meetings, then create, update, or delete ActEarly break events in those gaps. We do not
read event descriptions, attachments, video links, or events outside of today.
Body map data. During onboarding you select which body regions are giving you trouble, such as neck, wrists, or lower back. We store these selections to route exercise sessions to the relevant region. This information is never shared with any third party.
Usage data. We use Firebase Analytics to collect anonymized usage signals: which exercises were completed, session length, and break timing. This data cannot be traced back to an individual identity.
Technical data. Standard server logs may include IP address, browser type, operating system, and referring URL. These are kept for security and debugging purposes only.
3. How we use it
- To find gaps in your calendar and write break events into them.
- To route exercise sessions to the body regions you selected.
- To send break prompts at times that fit your actual schedule.
- To improve the product using aggregated, anonymized analytics.
- To respond to support requests you send us.
We do not use your data for advertising. We do not build behavioral profiles. We do not use your calendar data for any purpose beyond scheduling your breaks.
4. Data sharing
Your data is never visible to any employer, organization, or third party. The only people who can access your account data are you and ActEarly staff when needed to resolve a support issue.
We never sell personal data. This is not something we have ever done or will do.
Legal requirements. We may disclose data if required by law, subpoena, or to protect our legal rights. We will notify you where legally permitted.
5. Third-party services
- Google OAuth and Calendar API. We use Google Sign-In for authentication and the Google Calendar API to read your schedule and create, update, or delete ActEarly break events. Google's privacy policy: policies.google.com/privacy.
- Supabase. Your account data and preferences are stored in Supabase with row-level security. Data at rest is encrypted. Supabase privacy policy: supabase.com/privacy.
- Microsoft OAuth and Microsoft Graph. We use Microsoft Sign-In for authentication and, only when separately connected, Microsoft Graph to read calendar timing and create, update, or delete ActEarly break events. Microsoft privacy: privacy.microsoft.com/privacystatement.
- Firebase Analytics. Used for anonymized usage analytics only. Firebase is not used for authentication or data storage. Firebase privacy: firebase.google.com/support/privacy.
- Cloudflare Turnstile. We use Turnstile on the desk-strain assessment form to help prevent automated submissions. Read Cloudflare's Turnstile Privacy Addendum.
- Google AI Gemini. When exercise sessions are generated through our AI layer, prompts are sent to the Gemini API via our own backend proxy. We do not include personally identifiable information, such as name, email, or calendar content, in these prompts.
6. Calendar access in detail
We request Google's calendar.events scope or Microsoft's delegated
Calendars.ReadWrite permission. Both allow viewing and editing calendar
events. We use them for one purpose: reading
today's primary calendar events to find gaps, and creating, updating, or deleting
ActEarly break events in those gaps.
We do not access shared calendars belonging to other users, read content beyond event titles and times, or store calendar data between sessions.
ActEarly's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect calendar access inside ActEarly Settings. You can also revoke Google access at myaccount.google.com/permissions. Microsoft access can be revoked at account.live.com/consent/Manage. If you do, the calendar timeline will show a reconnect prompt and break auto-scheduling will pause until you reconnect.
7. Data retention and deletion
We keep your account data, including name, email, body map selections, and preferences, for as long as your account is active. If you delete your account, we delete your data within 30 days, except where we are required by law to retain it.
Calendar event data is read at request time and not stored in our database. We do not cache your calendar content.
To request account deletion, message us on +91 89391 11367 with the text "Delete my account."
8. Your rights
Depending on where you are located, you may have the right to:
- Access. Request a copy of the personal data we hold about you.
- Correction. Ask us to correct inaccurate data.
- Deletion. Ask us to delete your personal data.
- Portability. Request your data in a machine-readable format.
- Objection. Object to certain processing activities.
- Restriction. Ask us to restrict processing while a dispute is resolved.
To exercise any of these rights, message us on +91 89391 11367. We will respond within 30 days.
If you are in the European Economic Area, you have the right to lodge a complaint with your local data protection supervisory authority.
9. Children
ActEarly is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have done so, message us on +91 89391 11367 and we will delete it promptly.
10. Security
We use industry-standard measures to protect your data: encrypted connections (HTTPS/TLS), row-level security on the database so users can only access their own records, and bearer token authentication for all API requests. OAuth tokens are never exposed in URL query strings.
No transmission method is 100% secure. If you discover a security issue, message us on +91 89391 11367 and we will investigate promptly.
11. Changes to this policy
We will notify you of material changes by in-app notice at least 30 days before they take effect. The effective date at the top of this page reflects when the current version took effect.
Continued use of ActEarly after the effective date means you accept the updated policy.
12. Contact
Privacy questions: +91 89391 11367
ActEarly (early-access project) · Terms of Service