Security
Last updated 5 September 2026
LineMerge holds calendar data for people who trust us with it. We treat that as the product's first requirement, not a feature. Here is how we protect it.
Sharing minimised by design
Event details exist so you can see your own schedule; exposing them is opt-in per calendar. By default a calendar is private: your household, your booking-page visitors and everyone else see anonymous busy intervals only — never titles, notes, attendees, or locations. Disconnecting a calendar deletes its mirror immediately.
Encryption
- All traffic is encrypted in transit with TLS.
- OAuth tokens — the credentials that reach your calendar and Zoom accounts — are encrypted with AES-256-GCM before they are stored, under a key kept outside the database.
- Connections between our application and its database are encrypted.
- Nightly database backups are encrypted and expire on a rolling schedule.
Least-privilege access
- We request the narrowest Google and Microsoft OAuth scopes that make the product work, and we adhere to the Google API Services User Data Policy, including its Limited Use requirements.
- Production access is restricted to the minimum set of people and systems, protected by strong authentication, and audit-logged.
- The application runs with an isolated database role that cannot reach other systems' data.
Revocation and deletion
- Disconnecting a calendar immediately deletes its mirrored data and tokens from our systems.
- You can revoke LineMerge's access directly from your Google or Microsoft account at any time — revocation works even if you never log back in to LineMerge.
- Deleting your account (available in-app and by email) removes your tokens, mirrored calendar data, and personal information, and you can export your data first. See the Privacy Policy.
Operational security
- Infrastructure sits behind Cloudflare; origin servers accept traffic only from it.
- Secrets are stored in encrypted secret-management tooling, never in code or plain files.
- Dependencies are scanned in CI; systems are patched and monitored, with alerting on anomalies.
- Booking endpoints are rate-limited and bot-protected.
Reporting a vulnerability
If you believe you have found a security issue in LineMerge, please email [email protected] with the details. We will acknowledge your report promptly, keep you informed as we investigate, and will not pursue good-faith security research.