Privacy policy

LineMerge ("LineMerge", "we", "us") is a scheduling service operated by Nameverse Inc. It merges the calendars behind your accounts and phones into one availability and publishes a booking page on top. This policy explains what we collect, why, who sees it, how long we keep it, and how to export or delete it. It covers the website (linemerge.com), the web app, the iOS and Android apps, and the email and text messages we send.

1. Who this covers

• Hosts — people with a LineMerge account who connect calendars and publish a booking page.
• Bookers — people who book time with a host. Bookers do not need an account. We process their data on the host's behalf and under this policy.
• Members — people a host adds to a household or business. They have their own accounts and their own privacy settings.

2. What we collect

Account information (hosts and members)

• Name, email address, timezone, and a password stored as a salted hash — or your Google identity if you use "Continue with Google".
• Settings: booking pages, meeting types, working hours and date overrides, questions you ask bookers, per-calendar names ("source tags") and per-calendar privacy choices, language, notification preferences.
• Optional profile image and business logo, stored on our object storage and served publicly on your booking page.
• Billing: plan, subscription status and invoices. Payment details go directly to Stripe; we never see or store full card numbers.
• Two-factor secrets, if you enable 2FA, and API keys the mobile apps use to pair a phone.

Calendar data (Google Calendar, Microsoft 365 / Outlook)

When you connect a calendar account with OAuth, we read its calendar list and events to compute your merged availability, and we write the events for confirmed bookings to the calendar you choose. We store each event's start, end and busy/free status, plus its title and description (notes) and its location, so that you can see your complete merged schedule in one place. For meeting types you mark as happening at the booker's address, the booking page uses the city in those locations to tell a booker only whether you are already in their area on a given day. If you link two of your calendars so that one blocks time for the other, we write placeholder events (with the title and details you chose, and nothing from the original event) to the calendar you named, and keep a record of each one so we can move or remove it. Who else sees details is a per-calendar choice, and the default is nobody:

• Private (default): details are visible only to you. Your household, your business members, booking-page visitors and everyone else see anonymous busy time.
• Household: members of your household can also see titles.
• Public: titles may appear where you publish them, for example on a shared household calendar.

We also store the OAuth tokens that keep calendars in sync (encrypted at rest) and provider event identifiers that keep the sync accurate and duplicate-free. Disconnecting a calendar deletes its mirrored events and tokens immediately.

Zoom

If you connect a Zoom account, we store your Zoom user ID and account email, and the OAuth tokens that let us act for you (encrypted at rest). We use them only to create a Zoom meeting when a booking of a Zoom meeting type is confirmed, to move that meeting when the booking is moved, and to delete it when the booking is cancelled. We send Zoom the meeting's title — the meeting type and the booker's name — and its time, and we store the meeting's ID and join link with the booking. We do not read your other meetings, recordings, contacts, chats or settings. Disconnecting Zoom in LineMerge, or removing LineMerge in the Zoom App Marketplace, deletes the stored tokens and Zoom account details immediately; meetings already created stay in your Zoom account, and join links already sent stay on the bookings they belong to.

Phone calendars (Device Bridge, mobile apps)

If you enable the Device Bridge, the app reads the calendars on your phone using the operating-system permission you grant, and uploads snapshots of the calendars you select — and only those — under the same private-by-default rule. The app also stores a device name and identifier so you can see and remove the phone from your account, and a push-notification token if you allow notifications.

Booking data (bookers)

• Name, email address, timezone, the time booked, notes, and answers to the questions the host configured.
• Phone number, if the booker gives one (required for phone-call and in-person meeting types). It is used to send the text messages described in SMS terms and shown to the host so they can reach the booker.
• Booker language, and the referral source of the booking link (for example "signature" or "instagram") when the host tags their links, for the host's own insights.
• Whether the booking was confirmed, moved, cancelled, or marked as a no-show by the host.

Hosts see this data in their dashboard, receive it in their confirmation emails, and can send it to their own systems through webhooks they configure (a CRM, Zapier, Make). Once a host does that, the host's own privacy practices apply to the copy they hold.

Referrals

If you share your referral link, we record which account signed up through it so we can apply the free month to both of you. Referred users see the referrer's name during signup; the referrer sees a count and the first name of who joined, not their email.

Calendly import

If you import meeting types from Calendly, the personal access token you paste is used for that one request and is not stored.

Technical and usage data

• Server logs: IP address, browser type, requested pages and timing, retained for security and reliability for up to 30 days.
• Product analytics: a self-hosted, cookieless instance of Umami records page views and a small set of product events (for example "booking page viewed", "booking submitted") in aggregate. No advertising identifiers, no cross-site tracking.
• Bot protection on booking forms (Cloudflare Turnstile), when enabled, sees the request that loads the challenge.

3. Google user data: Limited Use disclosure

LineMerge's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use Google Calendar data to provide and improve the user-facing features you see in LineMerge: computing your merged availability, displaying your unified calendar, and creating or updating events for bookings you approve.
• We do not transfer Google user data to third parties except as necessary to provide these features, to comply with applicable law, or as part of a merger or acquisition with prior notice to you.
• We do not use Google user data for advertising, and we do not sell it to data brokers or information resellers.
• Humans do not read your Google Calendar data, except (a) with your explicit permission, for example a support request, (b) as required for security or to comply with applicable law, or (c) in aggregated, anonymized form for internal operations.
• We do not use Google user data to develop, improve, or train generalized artificial intelligence or machine-learning models.

We request the narrowest Google OAuth scopes that make the product work, and you can review or revoke LineMerge's access at any time at myaccount.google.com/permissions. Microsoft 365 calendar data is handled under the same principles; access can be revoked from your Microsoft account settings.

4. How we use information, and the legal basis

Purpose	Data	Basis (GDPR / UK GDPR)
Compute and display merged availability; run booking pages; write confirmed bookings to your calendar	Account, calendar, device, booking data	Performance of a contract (hosts); the host's legitimate interest in running their schedule (bookers)
Send transactional email and text messages: booking requests, confirmations, reminders, changes, account notices	Email, phone number, booking details	Contract; legitimate interest; consent for text messages (the booker enters a number)
Product tips to account holders (onboarding nudges, a weekly digest)	Email, usage	Legitimate interest, with a one-click opt-out in every message and in Account & security
Billing and invoicing	Name, email, plan, invoices	Contract; legal obligation
Security, abuse prevention, debugging, aggregate product analytics	Logs, analytics events	Legitimate interest
Legal compliance and responding to lawful requests	As required	Legal obligation

We do not sell personal data, share it for cross-context behavioural advertising, use calendar contents for profiling or marketing, or train AI models on your data.

5. Who we share data with

We use a small number of service providers ("subprocessors"), each receiving only what its job needs. The current list, with locations, is kept at /subprocessors. In summary: Cloudflare (network, bot protection, file storage), Stripe (billing), Resend (email), Twilio (text messages), Google and Microsoft (the calendar APIs you connect), Zoom (meeting links, if you connect it), Apple and Google (push notifications for the apps), and our hosting provider. We disclose information when required by law, to protect the rights and safety of users, or in connection with a merger or acquisition, with notice to you.

Hosts see the booking data of people who book them. Household and business members see what the sharing settings allow: at minimum anonymous busy time, and titles only where a calendar is set to household or public.

6. Where data is processed

Our servers are operated by us on infrastructure in North America, behind Cloudflare. Some subprocessors operate globally. Where data leaves the EEA, UK or Switzerland we rely on the providers' standard contractual clauses or equivalent safeguards.

7. How long we keep data

Data	Kept until
Mirrored calendar events and OAuth tokens	You disconnect the calendar, remove the device, or delete your account — then deleted immediately
Zoom tokens and Zoom account details	You disconnect Zoom, remove LineMerge in Zoom, or delete your account — then deleted immediately
Bookings and booker details	The host deletes the booking or their account. Hosts can also delete a client record from their dashboard.
Account settings, booking pages, meeting types	Account deletion
Webhook delivery logs	30 days
Server logs	Up to 30 days
Invoices and payment records	As long as tax and accounting law requires (typically 7 years), held by Stripe and in our billing records
Encrypted backups	Expire on a rolling schedule within 30 days; deleted data ages out with them

8. Your rights and choices

• Export: Account & security → Export my data gives you a machine-readable copy of your settings, bookings, and stored calendar data.
• Delete: delete your account from the web dashboard or from Settings in the mobile apps. Deletion is immediate. Details at /delete-account.
• Revoke: remove LineMerge from your Google, Microsoft or Zoom account at any time, independently of us.
• Correct: edit your details in Account & security, or ask us.
• Opt out of emails: product tips have an opt-out link and a switch in Account & security. Booking emails are part of the service and cannot be switched off while you host bookings.
• Opt out of texts: reply STOP to any message. See SMS terms.
• Bookers: your confirmation email carries links to move or cancel your booking without an account. To have your details removed from a host's records, contact the host, or email us and we will help.

EEA, UK and Switzerland. You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with your supervisory authority. California. You have the right to know, delete, correct, and to opt out of sale or sharing; we do not sell or share personal information as defined by the CCPA/CPRA, and we do not discriminate for exercising rights. Canada. We handle personal information in line with PIPEDA and applicable provincial law. We honour these requests wherever you live: email [email protected] from the address on your account and we respond within 30 days.

9. Cookies

We use only first-party cookies that the service needs: your sign-in session, a CSRF token, your timezone and language for booking pages, and a short-lived referral cookie if you arrive by a referral link. Analytics are cookieless. The full list is at /cookies.

10. The mobile apps

The iOS and Android apps use your account data, calendar data and bookings exactly as the web app does. They ask for calendar access only if you turn on the Device Bridge, and notification permission only if you want booking alerts. The apps contain no advertising SDKs and no third-party analytics. The data-collection disclosures in the App Store ("App Privacy") and Google Play ("Data safety") listings are derived from this policy. You can delete your account from inside either app.

11. Security

OAuth tokens are encrypted before they are stored (AES-256-GCM), all traffic is encrypted in transit, nightly database backups are encrypted, production access is restricted and audited, and private-calendar contents never reach other people by design. Double-booking is prevented by the database itself. See Security and Trust. No system is perfectly secure; if a breach affects your data we will notify you and the relevant authorities as the law requires.

12. Children

LineMerge is not directed at children under 16, and we do not knowingly collect their data. Household plans are for adults who manage a shared calendar; if you believe a child has given us data, contact us and we will delete it.

13. Changes to this policy

We post changes on this page and update the date at the top. For material changes we notify account holders by email or in-app before they take effect.

14. Contact

Nameverse Inc.
Privacy questions, requests and complaints: [email protected]