Trust & security
Linemerge sees a lot of calendars. Here is exactly what it keeps, what it refuses to keep, and who else touches it.
The short version
- Private calendars contribute busy times only. Titles, guests, locations and notes are dropped when events are ingested — they are never written to the database.
- Bookers see free slots, never your events. Public booking pages show availability; the merged view with titles is yours alone.
- OAuth tokens are encrypted at rest (AES-256-GCM) and deleted the moment you disconnect an account.
- You can export or delete everything from Account & security. Deletion is immediate and cascades to bookings, calendars, tokens and sessions.
- No ads, no data sales, no tracking pixels. Product analytics are cookieless and aggregate.
What is stored
- Account: email, name, timezone, working hours, plan.
- Calendars: which accounts and calendars you connected, and for each event start and end time; plus the title if — and only if — you marked that calendar public.
- Bookings: the booker's name, email, phone (if given), answers to your questions, and the time. Bookers get the same reschedule/cancel rights you do.
- Phone pairing: the app uploads busy-time snapshots of the phone's calendars with the same private/public rule.
Who processes it
Servers run in two regions behind Cloudflare. Email is sent through Resend, text messages through Twilio (only when a booker gives a number), payments through Stripe (we never see card numbers), and analytics through a self-hosted Umami instance. Google and Microsoft calendars are read and written through their official APIs with the narrowest scopes they offer.
Engineering practices
- Double-booking is impossible by construction — a database constraint, not application logic.
- Every credential-accepting endpoint is rate-limited; sessions are HttpOnly cookies; the site ships a strict Content-Security-Policy with no third-party scripts on booking pages.
- Webhook deliveries are signed; inbound webhooks (Google, Microsoft, Stripe) are verified.
- Two-factor authentication is available on every account.
Reporting a problem
Found something? Email [email protected]. We answer security reports first and credit responsible disclosure.
See also the privacy policy, terms and security overview.