Privacy Policy

1. Information We Collect

We collect information you provide, information created through your use of ChaosRoots, and limited technical information needed to operate and secure the service.

• Account and profile information – your email address, public name, preferred time zone, password digest, and records of accepting our terms.
• Account security information – email-verification and password-reset records, two-factor authentication data, recovery-code digests, session status, IP address, and browser or device user agent.
• Calendars and organization content – calendar and event titles, descriptions, locations, dates, time zones, tags, organization names and contact details, memberships, and invitation email addresses.
• Import and media information – calendar-feed URLs, temporary iCalendar uploads, filenames, content types, generated calendar or event images, and related storage metadata.
• Connected app information – when you authorize an app, such as an AI assistant, to access your account, we store the app's registered name and redirect address, the permissions you granted, the dates you granted and revoked access, and hashed access and refresh tokens.
• Billing information – Stripe customer, price, checkout, and subscription identifiers and the subscription status needed to provide paid features. ChaosRoots does not store full payment-card numbers.
• Operational information – request identifiers and application, queue, cache, and security logs used to operate, protect, and troubleshoot the service.
• Aggregate usage counts – daily totals of how often add-to-calendar pages are viewed, their subscribe and add buttons are used, and calendar feeds are refreshed. These counts have no user, account, IP address, device, or calendar identifiers attached.

2. How We Use Information

We use this information to:

• Create, authenticate, secure, and support your account
• Provide calendars, events, organizations, invitations, sharing, imports, exports, and location features
• Let apps you authorize, including AI assistants, read and manage your calendars and events on your behalf
• Show your public name on public calendar, event, and filtered share pages when you choose one; otherwise organization shares use the organization name and personal shares show no organizer attribution. Your login email is not used as public attribution.
• Process subscriptions and maintain access to paid features
• Prevent abuse, investigate failures, and maintain service reliability
• Send essential account, security, invitation, and service emails

We currently send transactional service messages, not promotional or marketing email.

3. Cookies

ChaosRoots uses essential signed cookies and session storage for authentication, security, post-login return paths, and pending organization invitations. ChaosRoots does not set analytics or advertising cookies. Google Maps may receive request and device information and use its own cookies or similar technologies when its location integration loads.

4. Service Providers

We do not sell your personal information. We use service providers to operate ChaosRoots, and they process information for the services they provide to us.

• Infrastructure and object-storage providers host the application, databases, backups, generated images, and temporary uploads.
• Stripe provides subscription checkout, billing, and account-management services.
• Resend delivers essential account, security, and invitation email.
• Google Maps provides location search and autocomplete. Loading the integration can send your IP address, browser or device information, and location searches to Google.

5. AI Assistants and Connected Apps

You can connect third-party apps, including AI chat assistants, to your ChaosRoots account. We only grant access after you sign in and approve each permission.

• You choose which permissions to grant: view your calendars, view your events, create and manage your calendars and tags, and create, change, and delete your events.
• Once connected, an app can read and change the calendars and events your account can access, within the permissions you granted. It acts with your account's access, so changes it makes appear as your changes.
• We do not control how a connected app or the company behind it uses information it receives. Its own terms and privacy policy apply to that information.
• You can see and revoke connected apps in your account settings. Revoking an app ends its access, and changing your password revokes all connected apps.
• Access tokens expire after one hour, and refresh tokens expire after 30 days without use. Expired and revoked tokens, and app registrations that were never authorized, are removed by a routine daily cleanup.

6. Data Retention

We retain information for as long as needed to provide and secure ChaosRoots, meet legal and billing obligations, resolve disputes, and maintain reliable backups.

• Uploaded iCalendar source files are purged after an import is committed or cancelled. Abandoned import previews and their uploaded files are reaped after 24 hours.
• Session access expires after the configured absolute session period, which defaults to 30 days. Session records are removed when you sign out, when an expired session is encountered, when you next sign in, or when your account is deleted.
• Connected app records (tokens and permissions) are kept while the connection is active and are removed by routine cleanup after they expire or are revoked.
• Account, calendar, event, organization, and subscription records are retained while needed to provide the service or until they are deleted, subject to shared ownership and lawful-retention requirements.
• Logs, backups, billing records, and security records are retained only as long as needed for operations, recovery, fraud prevention, accounting, or legal obligations.

7. Data Security

We use HTTPS, access controls, password hashing, and encryption for selected sensitive account-security and billing identifiers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Your Choices and Rights

You may update supported profile information in account settings or contact us to request access to, correction of, or deletion of your personal information.

• Email deletion requests to hello@chaosroots.com. We will complete deletion requests within 30 days of your initial request, subject to verifying your identity.
• Account deletion removes content you authored, including content shared with an organization. If you own an organization with other members, contact us before requesting deletion so we can confirm what happens to the organization and its shared data.
• We may retain the minimum information required for legal, billing, fraud-prevention, security, backup, or data-integrity obligations.
• Depending on where you live, you may have additional rights over your personal information. Email us and we will honor those rights to the extent the law requires.

9. Children

ChaosRoots is not intended for children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us information, email us and we will delete it.

10. Where Information Is Processed

ChaosRoots is operated from the United States. Information may be processed and stored in the United States and in other countries where our service providers operate.

11. Changes to This Policy

We may update this Privacy Policy as ChaosRoots changes. We will post the revised policy and effective date here and will provide additional notice for material changes when appropriate.

12. Contact Us

For privacy questions or requests, contact:

• ChaosRoots, operated by Whimsical LAMB LLC
• hello@chaosroots.com