Who we are
wannago (wannago.io) is a scheduling tool for one-to-one in-person meetings. It is operated by Darrian Mikell, an individual in the United States. In this policy, "we" means wannago and its operator. You can reach us at privacy@wannago.io.
There are two kinds of people who use wannago. A host signs in with Google and shares a booking link. A guest uses a host's link to pick a time and a place. This policy covers both.
What we collect from hosts
- Your Google account name, email address and account ID, from signing in with Google. We use them to identify you and to make your booking link.
- Your settings: link name, weekly hours, notice and booking-window limits, time zone, meeting types, and the starting address you enter. Only you see your starting address. Guests never do.
- Access to your Google Calendar, described in the next section. We store the credential that keeps that access working encrypted, and we never write it to logs.
How we use your Google Calendar
When you sign in, you allow wannago two calendar permissions:
- Free/busy (calendar.freebusy). We ask Google when you are busy, so guests only see times you are free. We do not read the titles, guests or contents of your other events.
- Events on calendars you own (calendar.events.owned). We create the meeting on your own calendar when a guest books, plus travel blocks before and after it. We change or delete only the events wannago itself created, for example when a guest reschedules or cancels.
We do not store your calendar. Free/busy answers are used to work out open times and then discarded. The only calendar information we keep is the IDs of the events wannago created, so that we can move or remove them later.
wannago's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: we use Google user data only to provide the scheduling features you see in wannago. We do not sell it, use it for advertising, or use it to train machine-learning models. We do not let people read it, except where you ask us to, where it is needed for security, or where the law requires it.
What we collect from guests
- Your name and email address, so the host knows who is coming and you get the calendar invitation.
- The time and the place you chose. For the place we keep only Google's place ID; the name and address are looked up again when needed.
- Your starting point is not stored. When you type an address, suggestions come straight from Google to your browser. When you pick one, your browser sends us only map coordinates, once, to find places near the middle. We use them for that single search and keep nothing. The host never sees your address anywhere, including in the calendar event and emails. The host sees only roughly how many minutes you would travel.
The host who shared the link receives your name, email address, the time, and the place in the calendar invitation. What a host does with that information is up to them. We do not use anyone's email address for marketing, and emails about a booking are service messages.
Technical data
- To slow down abuse, we count requests per visitor. The visitor is represented by a scrambled one-way code made from the IP address, not the address itself. These counters are deleted daily.
- Our hosting provider keeps ordinary server logs, which can include IP addresses and the web addresses requested. The cancel and reschedule links in a confirmation are private, so please do not share them.
- We set only the cookies hosts need to sign in: a sign-in cookie that lasts up to 30 days (we store only a one-way hash of its value), and short-lived ones during the Google sign-in step. Guests get no cookies from us. We use no advertising or analytics cookies, and no tracking.
- Pages load the Nunito and Fredoka fonts from Google Fonts, and the map and address suggestions come from Google Maps Platform, so your browser connects to Google when you use them.
Who we share data with
We do not sell personal data. We share it only with the services that run wannago:
- Google, for Calendar, and for Maps Platform (address suggestions, places, photos, maps, and drive times). Google's own Privacy Policy applies to what it receives.
- Vercel, which hosts the website.
- Neon, which hosts the database.
We may also disclose information if the law requires it, or to protect the service and the people using it from abuse. If wannago is ever merged with, acquired by, or sold to another company, information may transfer to the new owner, who would have to honor this policy or tell you before changing how your information is used.
Features we are planning
We plan to add confirmation and reminder emails for guests and hosts. When we do, we will use an email delivery provider to send them, and it will receive the recipient's name, email address and meeting details for that purpose only. wannago offers a free plan today and may offer paid plans. If you buy one, payment would be handled by a payment processor. Your card details would go straight to the processor and would not be stored by wannago; we would receive only confirmation that you paid and which plan you are on. We will update this policy, and the date above, before either of these goes live. We would also update it before using your data in any other new way.
How long we keep things
- Holds on a time that nobody confirms expire after five minutes.
- Sign-in sessions expire after 30 days. Request counters are deleted daily.
- Host accounts and bookings are kept until you ask us to delete them. We do not delete old bookings automatically yet. The calendar events themselves live in the host's Google Calendar, which wannago does not control.
- Deleted information can remain in encrypted backups for a limited time until they are overwritten, and we may keep what the law requires us to keep.
Your choices
- Hosts can stop wannago's access to a calendar at any time at myaccount.google.com/permissions.
- Guests can cancel a booking with the link in their confirmation.
- Anyone can email privacy@wannago.io to ask for a copy of their data, to have it corrected, or to have it deleted. We will delete a host account, its settings, and its bookings, or a guest's name and email from bookings, within 30 days of a request we can verify.
Security
Calendar credentials are encrypted before they are stored. Sign-in session values are stored only as one-way hashes. Traffic to wannago uses HTTPS. No system is perfectly secure, but we keep what we hold to a minimum for that reason. If a breach affects your information, we will tell you as the law requires.
Where your information is processed
wannago is operated from the United States. Information is processed and stored in the United States and in other countries where our service providers run their systems. By using wannago, you understand that your information will be handled there.
Children
wannago is for adults. It is not intended for anyone under 18, and we do not knowingly collect information from people under 18. If you believe a young person has used wannago, email privacy@wannago.io and we will delete it.
Changes and contact
If this policy changes, we will update the date at the top, and tell hosts by email if the change is significant. Questions or requests: privacy@wannago.io.