Privacy Policy

This Privacy Policy explains how Cobaltmere, LLC ("Cobaltmere", "we", "us") collects, uses, stores, shares and deletes personal data in connection with Hourmere: the website at hourmere.com, the Hourmere cloud service that we host ("Hourmere Cloud"), and its API and remote MCP server (together, the "Service").

Hourmere is in development and Hourmere Cloud has not launched yet. This policy describes how we will handle personal data once it does. Until then, the only personal data we receive through Hourmere is the website request data described in section 14 and any messages you choose to send us, such as a request for launch updates.

The short version

• We use your data to run Hourmere and to provide the scheduling features you use.
• Calendar data from Google or Microsoft is used only to show your availability and manage your bookings. We never sell it, never use it for advertising and never use it to train generalized AI or machine learning models.
• AI assistants can access your account only with an API key that you create.
• If you self-host Hourmere, your data stays on your server and we do not receive it.
• You can disconnect calendars and delete your data at any time, and request a copy of your data by email.

1. Who we are and what this policy covers

Hourmere is scheduling software that is being developed as open source. It is developed and operated by Cobaltmere, LLC, a Delaware limited liability company. For Hourmere, this policy replaces the general privacy policy at cobaltmere.com/privacy.

For Hourmere Cloud, Cobaltmere is responsible for the personal data described in this policy, except where we process data on behalf of our customers as described in section 8. Customers who need a data processing agreement, for example under the GDPR, can request one at privacy@cobaltmere.com.

This policy does not cover Hourmere installations that other people or organizations run on their own servers (see section 9), or services from third parties that you connect to Hourmere, such as your calendar provider or your AI assistant.

2. Information we collect

• Account information: your name, email address, time zone and settings. Hourmere accounts have no passwords. You sign in with a link sent to your email address, with Google or with Microsoft.
• Email sign-in: when you sign in with an email link, we process your email address and a one-time sign-in token that expires after a short time.
• Sign-in with Google or Microsoft: we receive your name, email address, profile picture (if available) and your Google account ID or Microsoft account identifier. We use them to create your account and sign you in, and as your account profile: your name (and picture, if shown) appears in Hourmere, on your booking pages and in booking emails, and we send account and booking emails to your email address.
• Calendar connection information: when you connect a Google or Microsoft calendar, the access and refresh tokens the provider issues to Hourmere, and the email address of the connected account.
• Calendar data: free/busy information; the times and busy or free status of your events, with the event identifiers and sync metadata needed to keep them up to date; and the events Hourmere creates for your bookings. See section 4 and section 5.
• Scheduling information: the event types, availability settings and booking pages you set up.
• Booking information: details that invitees enter when they book with you, such as their name, email address and notes, and the time, time zone and status of each booking.
• API and agent access: the API keys you create for AI assistants and other applications, and records of the requests they make.
• Billing information (paid plans only): your plan, number of seats, billing country and transaction records. Card details are collected and processed by Stripe or, for purchases made through Stripe's merchant-of-record service, by Link, LLC, an affiliate of Stripe. We do not store full card numbers.
• Usage and diagnostic information: server and API log data such as IP address, browser and device type, the pages and API endpoints requested, timestamps and error reports.
• Communications: messages you send to us, for example to our support address or to ask for launch updates.

3. How we use information

• To provide the Service: signing you in, computing your availability, showing your booking pages, creating, updating and cancelling calendar events for bookings, sending email confirmations and reminders, and carrying out requests from applications you have authorized.
• To keep the Service secure, prevent fraud and abuse, and find and fix problems.
• To process payments for paid plans.
• To answer your questions, send you service-related notices, and send the launch announcement if you asked for launch updates.
• To understand how the Service is used and improve it, using usage and diagnostic information.
• To comply with legal obligations and enforce our terms.

We do not sell personal data. We do not use personal data for advertising, and we do not use calendar data or booking information to train generalized AI or machine learning models. We send marketing emails only if you ask to receive them.

If you are in the European Economic Area, the United Kingdom or Switzerland, our legal bases for processing are: performance of our contract with you; our legitimate interests in operating, securing and improving the Service; compliance with legal obligations; and your consent where we ask for it.

4. Google user data

This section describes how Hourmere accesses, uses, stores, shares and deletes data it receives from Google when you sign in with Google or connect Google Calendar ("Google user data"). Signing in with Google and connecting Google Calendar are separate, optional steps. Signing in does not give Hourmere access to your calendar; Hourmere asks for calendar access only when you choose to connect Google Calendar.

Signing in with Google

If you sign in with Google, Hourmere receives your name, email address, profile picture (if available) and Google account ID. We use them to create your account and sign you in, and as your account profile: your name (and picture, if shown) appears in Hourmere, on your booking pages and in booking emails, and we send account and booking emails to your email address.

Google Calendar: what we access

Depending on the permissions you grant on Google's consent screen, Hourmere accesses:

• the email address of your Google account, to show you which account is connected;
• the list of calendars in your account (such as their names, identifiers and time zones), so you can choose which calendars to check for conflicts and which calendar receives new bookings;
• free/busy information for the calendars you select;
• events on the calendars you select, so Hourmere can work out when you are available. Google's Calendar API returns full event details, such as titles, descriptions and attendees. Hourmere uses and stores only each event's start and end times, whether it shows you as busy or free, and the event identifier and sync metadata (such as a sync cursor) needed to keep this information up to date. It does not store the titles, descriptions or attendees of events it did not create; and
• the events Hourmere creates on your calendar for bookings, including the details written to them (such as the title, time, description and attendees), so that Hourmere can update or remove them when a booking is rescheduled or cancelled.

We request only the permissions these features need. Google's consent screen shows the exact permissions before you agree.

How we use it

We use Google user data only to provide Hourmere's user-facing features. We use sign-in data to create your account, sign you in and show your account profile, as described above. We use calendar data only for scheduling: showing your available times on your booking pages and to applications you authorize, preventing double-booking, adding booked meetings to your calendar, updating or removing those events when bookings change, and showing you the status of your calendar connection.

We do not:

• sell Google user data;
• use or transfer it for advertising, including retargeting and personalized or interest-based advertising;
• transfer it to advertising platforms, data brokers or information resellers;
• use it to determine credit-worthiness or for lending purposes; or
• use or transfer it to develop, improve or train generalized or non-personalized AI or machine learning models.

How we share it

We do not share or transfer Google user data, except:

• as needed to provide the features you use. For example, people who visit your booking page see the times you are available, but not the details of your calendar events, and an AI assistant or other application you authorize receives, at your direction, the results of the requests it makes for you (see section 6);
• with service providers that host and run the Service for us, such as our cloud hosting and database providers, who may process it only on our instructions and only to provide the Service;
• when necessary for security purposes, such as investigating abuse;
• to comply with applicable laws; or
• as part of a merger, acquisition or sale of assets, only after obtaining your explicit prior consent.

Who can read it

Our staff do not read your Google user data unless you give us explicit permission for specific data (for example, to help with a support request), it is necessary for security purposes (such as investigating a bug or abuse), it is necessary to comply with applicable law, or the data has been aggregated and anonymized and is used for internal operations in line with applicable law.

How we store and protect it

Google user data is stored with our cloud hosting providers. Hourmere Cloud is intended to be hosted in the United States and/or the European Union (see section 12). Google user data is encrypted in transit, and calendar connection tokens are stored encrypted. Access is limited to the systems and personnel that need it to run the Service. See section 11.

Retention and deletion

We keep Google user data only as long as we need it to provide the features described above. The busy times and sync data Hourmere stores are refreshed and replaced as your calendar changes.

• When you disconnect Google Calendar, Hourmere stops accessing it and deletes the connection tokens and the data it cached from Google (your calendar list, busy times, event identifiers and sync state) within 30 days.
• Your Hourmere booking records are part of your Hourmere account. They are kept while your account exists, unless you delete them.
• Events that Hourmere created in your Google Calendar remain at Google until you delete them there.
• When you delete your Hourmere account, we delete your Google user data, including sign-in data, within 30 days. Copies in our backups are rotated out and deleted within a further 30 days.

You can also remove Hourmere's access at any time from your Google Account's third-party connections page, and you can ask us to delete your data by emailing privacy@cobaltmere.com.

Limited Use

Hourmere's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Hourmere's use of information received from Google Workspace APIs, including the Google Calendar API, also adheres to the Google Workspace API User Data and Developer Policy.

If we change how Hourmere uses Google user data, we will tell you and ask for your consent before using it in a new way or for a different purpose.

5. Microsoft sign-in and calendar data

If you sign in with Microsoft, Hourmere receives your name, email address, profile picture (if available) and Microsoft account identifier. We use them to create your account and sign you in, and as your account profile: your name (and picture, if shown) appears in Hourmere, on your booking pages and in booking emails, and we send account and booking emails to your email address. Signing in does not give Hourmere access to your calendar.

When you connect a Microsoft 365 calendar, Hourmere accesses the same kinds of data described for Google in section 4: the connected account's email address, your calendar list, free/busy information, the events on the calendars you select, and the events it creates for bookings. As with Google, Microsoft returns full event details, but for events it did not create Hourmere uses and stores only their times, their busy or free status, and the event identifiers and sync metadata needed to keep this information up to date, not their titles, descriptions or attendees.

We use, share, protect, retain and delete Microsoft data in the same way and under the same restrictions as Google user data in section 4: only to provide Hourmere's features, never sold, never used for advertising and never used to train generalized AI or machine learning models. When you disconnect a Microsoft calendar, its tokens and cached data are deleted within 30 days, your Hourmere booking records stay in your account, and the events Hourmere created remain in your Microsoft calendar until you delete them. You can remove Hourmere's access from your Microsoft account's app permissions, or ask your organization's administrator.

6. AI assistants and API access

Hourmere has an API and a remote MCP server that AI assistants and other applications can use. They can access your account only with an API key that you create; OAuth authorization for AI connectors is planned. An authorized application can do what the API allows: list your event types, check your availability, and book, reschedule or cancel meetings.

Availability and booking data that Hourmere returns to an AI agent or application you authorized is sent at your direction, to provide the feature you requested. The availability is calculated from your connected calendars. Our commitments about Google user data in section 4 (no advertising, no sale, and no use by us to train AI or machine learning models) apply to Hourmere. Once the data is delivered to the application, its handling is governed by the terms and privacy policy of the application's provider, and of the AI model behind it, not by this policy. Only authorize agents and applications you trust. You can revoke an API key at any time.

7. How we share information

We do not sell personal data. We share it only as described in this policy, including with:

• Service providers that act only on our instructions, under contracts that require them to protect the data: cloud hosting and database providers, and an email delivery provider for sign-in links, booking confirmations and reminders.
• Payment providers: Stripe and Link, LLC, an affiliate of Stripe, process payments for paid plans and handle sales tax, VAT or GST. They also act as independent controllers for their own purposes, such as fraud prevention and meeting their legal and regulatory obligations, under their own privacy policies, including Stripe's privacy policy.
• Calendar providers you connect (Google and Microsoft), to read your availability and to create, update and remove events for your bookings.
• Applications you authorize, such as AI assistants, as described in section 6.
• The other party to a booking. When someone books with you, the details they enter are shared with you, and your name and the booking details are shared with them.
• Legal and safety reasons: when required by law, or to protect the rights, property or safety of our users, the public or Cobaltmere.
• Business transfers: if Cobaltmere is involved in a merger, acquisition or sale of assets, subject to this policy. For Google user data, we will first obtain your explicit consent.

8. If you book a meeting through Hourmere

If you book a meeting on someone's Hourmere booking page, the person or organization you are booking with (the "host") decides what information to ask for and how to use it. We process your booking information on the host's behalf to provide the Service, for example to add the meeting to the host's calendar and send you confirmations and reminders. For questions about how a host uses your information, contact the host. If you contact us, we will pass your request on or help where we can.

9. Self-hosted Hourmere

Hourmere is designed so that anyone can run it on their own servers. A self-hosted instance is operated by whoever runs it, and that operator is responsible for the data it holds and for its connections to calendar providers. Cobaltmere does not receive data from self-hosted instances. If we ever add telemetry to the software, it will be optional, opt-in and anonymous, and we will document what it sends.

10. Retention and deletion

• Account, scheduling and booking information is kept while your account exists. You can delete event types, bookings and calendar connections at any time.
• Calendar data is retained and deleted as described in section 4 (Google) and section 5 (Microsoft).
• When you delete your account, we delete your data, including booking information about your invitees, within 30 days, except records we must keep for legal, tax or accounting purposes. Those records never include calendar data. Copies in our backups are rotated out and deleted within a further 30 days.
• Server and API logs are kept for 30 days.
• Support requests and other correspondence are kept for up to 2 years after the last message.
• Requests for launch updates are kept until you ask us to stop or we have sent the launch announcement.

11. Security

We protect personal data with measures appropriate to the risk, including encryption in transit, encrypted storage of calendar connection tokens, access controls and the principle of least privilege. No system is completely secure. If a data breach affects your personal data, we will notify you as required by law. To report a security issue, email security@hourmere.com.

12. Where data is processed

We are based in the United States. Hourmere Cloud is intended to be hosted in the United States and/or the European Union. Some service providers, such as those for payments and email delivery, may process data in other countries. Where the law requires it, we protect international transfers of personal data with appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

13. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent at any time. You can disconnect calendars, revoke API keys and delete your account in the Service. To request a copy or export of your data, or to exercise any of these rights, email privacy@cobaltmere.com. We will not discriminate against you for exercising them. You may also lodge a complaint with your local data protection authority.

We do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined under California law.

14. This website, cookies and local storage

hourmere.com is a static website. It does not set cookies itself; our hosting provider may set strictly necessary security cookies. The website does not use analytics or third-party trackers, and its fonts are served from hourmere.com. Our website hosting provider processes standard request data, such as IP address, browser type and the page requested, to deliver the site and protect it from abuse. The documentation pages save small preferences, such as your light or dark theme choice, in your browser's local storage; this stays on your device.

When Hourmere Cloud launches, it will use only cookies that are strictly necessary for it to work, such as keeping you signed in. We do not use advertising cookies.

15. Children

Hourmere is not directed to children. You must be at least 18 years old, or the age of majority where you live if that is higher, to create a Hourmere account. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

16. Changes to this policy

We may update this policy. We will post the new version on this page with a new effective date and, if the changes are material, notify you by email or in the Service before they take effect. Changes to how we use Google user data are also subject to section 4.

17. Contact

Cobaltmere, LLC
Privacy questions and requests, including access, export and deletion: privacy@cobaltmere.com
Support: support@hourmere.com
Security reports: security@hourmere.com
Website: hourmere.com · cobaltmere.com