Last updated: September 19, 2026
Doodle Clone ("the app", "we") is a scheduling tool that lets you propose meeting times, share a link, and collect availability from other people. This policy explains what data the app handles and how.
Information we store
When you create a poll or respond to one, we store only what you type in:
- Poll details you enter: title, optional description, optional location, and the proposed time slots.
- Responses: the name a participant enters and their Yes / Maybe / No choice for each proposed time.
This information is stored in Amazon DynamoDB and is accessible to anyone who has the poll's shareable link. We do not require account registration, and we do not collect passwords. We do not use advertising or third-party tracking, and we do not sell data.
Google Calendar access
Connecting Google Calendar is optional. If you choose
to connect it, the app requests read-only access to
your calendar events (the
https://www.googleapis.com/auth/calendar.events.readonly
scope) using Google's browser-based sign-in. This is the narrowest
scope that lets the app read the events on your primary calendar.
- Your calendar events are read only in your own browser, solely to display your existing events as a visual overlay on the scheduling grid so you can pick times around them.
- Your Google Calendar data is never sent to our servers, never stored, and never shared with anyone. It stays in the browser tab and is discarded when you close or reload the page.
- The access token Google issues is short-lived and held only in memory for the current session.
- Doodle Clone's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke the app's access at any time from your Google Account permissions page.
How we protect your data
We apply the following safeguards to the data the app handles, including any sensitive data obtained through Google APIs:
- Encryption in transit. All traffic between your browser, Google, and our backend is served exclusively over HTTPS (TLS 1.2+). The Google OAuth token exchange happens directly between your browser and Google over TLS.
- Encryption at rest. Poll and response data stored in Amazon DynamoDB is encrypted at rest using AWS-managed server-side encryption (AES-256). No Google Calendar data is ever written to our storage.
-
Data minimization. The app requests the narrowest
OAuth scope it needs
(
calendar.events.readonly) and reads only the events on your primary calendar for the week you are viewing. Event details are used solely to render a visual overlay in your browser and are never transmitted to our backend, logged, or shared with any third party. -
Token handling. The short-lived Google access token
is held in browser memory for the current session only. It is not
persisted to
localStorage, cookies, or any server-side store, and it is discarded when you close or reload the tab. - Access control. Backend infrastructure runs on AWS behind IAM-scoped roles; only the app maintainer has administrative access. We do not have employees or third-party processors with access to Google user data because none is ever received or stored.
- No secondary use. Data received from Google APIs is not used for advertising, sold, transferred, or used to train machine-learning models, in accordance with the Google API Services User Data Policy, including the Limited Use requirements.
- Incident response. If we become aware of a security incident affecting user data, we will notify affected users by updating this page and, where we have a contact address, by email, without undue delay.
Data retention & deletion
Poll and response data persists so that shared links keep working. If you want a poll and its responses deleted, contact us at the email below with the poll link.
Contact
Questions about this policy? Email brennanj414@gmail.com.