01Who we are
Timebird is based in the United Arab Emirates. This notice explains information handled through our website, Timebird for Mac, account features and public booking pages. Timebird is responsible for the processing described here; a booking host also controls how they use guest information for their appointment. Questions about your information can be sent to hello@timebird.space.
02Subscription billing
Creem handles payment details and subscription billing. We send your account email and a checkout reference to create your checkout, and store customer and subscription identifiers, your plan, trial dates and subscription status in Supabase to manage access. Card numbers are handled by Creem and its payment providers; Timebird does not store them. Creem’s own privacy terms apply to its checkout. Billing providers may retain transaction records for their legal obligations. Contact hello@timebird.space about your Timebird billing data.
03Information you share
Signing up with an email and password provides your email address and authentication credentials to Supabase, our authentication provider. Passwords are handled by the authentication service; they are not displayed in your Timebird profile.
If you choose Google or Apple, that provider supplies the identity information you authorize, such as an account identifier and email address. Apple may supply a private relay email. Signing in with Google sign-in asks for Calendar access so your events can appear in Timebird. You can also add Google accounts later from your calendar.
When you contact us, we receive your message, email address, and any information you choose to include.
04Calendar, chat and connected features
The interactive calendar on this website uses sample events and tasks. Edits are held in the current page and reset when it is reloaded. Avoid entering sensitive information into a public demonstration.
If you grant Google Calendar access, Timebird reads your calendar list and events to show them in your signed-in calendar. When you create, move, edit, or delete an event in Timebird, that change is sent to the connected Google Calendar. You can connect more than one Google account and remove each connection from Your space → Accounts.
Google access and refresh tokens are encrypted in our database and used on the server to access the calendars you connected. Timebird’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We use Google data for the visible features you request, not advertising, selling data or training general-purpose AI models. Human access is limited to your specific permission, necessary security investigations or legal obligations. Removing a connection deletes its stored tokens from Timebird. You can also revoke access from your Google account. Removing a connection does not delete events, uploaded Drive files or previous assistant records.
App chat and Slack DMs send your message, recent conversation and relevant calendar, task and reminder context to OpenAI’s API. Assistant plans and results are stored to support retries and avoid duplicate actions. Linked Slack accounts also store DM processing records and reminder schedules; Slack processes delivered messages.
Optional file uploads pass through Timebird to your Google Drive. Event attachments keep links and metadata. Invitations and availability searches send the relevant guest and event information to Google. For the full explanation, read your data in Timebird.
Booking links store offered windows, guest names, verified email addresses, timezones, notes, answers and appointment status. Resend processes verification and booking emails. Google receives booking details for calendar invitations and Google Meet. Public links show offered slots without private calendar details; private signed links authorize guest cancellation and rescheduling. Expired verification records and rate counters are cleaned up daily; confirmed booking history has no fixed deletion period in this version.
05Why information is used
Information is used to provide account access, maintain sessions, show and manage your plans, answer questions, deliver reminders, respond to support requests, protect against abuse, and meet applicable legal obligations. The hosting and authentication services may process technical information, such as IP addresses, device information, and request logs, when delivering those services.
06Purposes and legal grounds
Where a law requires a legal basis, we process account, calendar, task, booking and billing information to provide the service you request and perform our agreement with you. Security, abuse prevention and responding to support requests support our legitimate interests in operating a reliable service, balanced against your rights. Tax, payment and lawful disclosure records may be processed to meet legal obligations.
Where consent is required, we ask for it separately and you can withdraw it for future processing. Granting a Google permission lets Timebird access that service; it is separate from agreeing to subscription charges. Calendar data may contain sensitive personal information: include only what is needed and avoid sensitive details in guest-facing titles, public link descriptions or assistant messages.
07Service providers
Supabase provides authentication and Timebird’s database. Vercel hosts the website and server routes. Google provides Calendar, optional Drive uploads and meeting features. Google and Apple process sign-in requests when chosen. OpenAI processes assistant requests, Resend delivers booking and verification emails, Creem handles checkout and subscription billing, and Slack processes bot messages when connected. Provider policies also apply: Supabase, Vercel, Google, Apple, OpenAI, Resend, Creem and Slack.
Hosting and authentication services may process information needed to deliver the website, verification messages and password recovery. Provider processing locations and retention practices vary. Information may also be disclosed when required by law or to protect the service against misuse.
08Sharing and public information
We do not sell personal information or share it for cross-context behavioural advertising. Service providers receive the information needed for their functions. Booking guests and hosts receive appointment and invitation details, and invited participants may see guest email addresses through Google Calendar. Hosts are responsible for their own use of guest details. Avoid including information you do not want invitees to see.
A published booking link can be opened by anyone who has its URL. It exposes the host’s chosen link title, description, display name, meeting method and bookable times, not their private calendar event titles. Treat verification and cancellation or rescheduling links as credentials and share them only with the intended person.
The footer’s AI-service buttons copy a fixed public comparison question and open the service you choose. They do not attach your calendar, chat history or account details, and do not submit a question for you. Anything you paste into another AI service is handled under that service’s terms.
09Processing across borders
Timebird is based in the United Arab Emirates. Our hosting, authentication, payment, email, calendar and AI providers may process information in the United Arab Emirates and other countries with different privacy laws. Your data’s location depends on the provider and the configured service.
Where applicable law requires safeguards for an international transfer, those safeguards must be in place. You can contact us for information about the providers, processing locations and safeguards applicable to your account. We do not describe every provider or transfer as covered by one certification.
10Cookies and browser storage
By default, Timebird keeps you signed in on the same browser for 30 days after you sign in, unless you sign out sooner. An essential session cookie marks that 30-day period; authentication cookies also let Supabase securely refresh access while you use Timebird. After the period ends, you will need to sign in again. Clearing cookies or changing browsers can end your session sooner.
The Mac app persists authentication in its webview storage, and device storage can also hold preferences and cached task information. To reopen calendars quickly, Timebird stores an account-scoped calendar snapshot with event titles, times, locations and notes on your device. It is refreshed in the background, expires after seven days, and is removed when you sign out. Disconnecting a calendar removes its saved events. The website uses Vercel Web Analytics for aggregate visits and Speed Insights for performance metrics. They receive page paths and technical measurements; URL query values and booking identifiers are removed before sending. They do not use advertising or analytics cookies. See the Cookie policy for storage names, purposes, expiry and controls.
11Retention and security
Account, task, assistant and Slack processing records are retained in Timebird’s database. Fixed retention periods, backup deletion schedules and account-deletion procedures are still being finalized. Deleting a task currently marks it as deleted rather than immediately erasing the record. Disconnecting a provider does not purge all previous history. Contact us about access or deletion requests. Signing out and cancelling a subscription do not delete your account. Legal, security and billing records may need to be retained after a deletion request; we will explain any applicable exception.
Session controls, server-side account checks, restricted database access and encrypted connection tokens help protect information. Timebird is not end-to-end encrypted: its servers and providers process the information needed for its features. No internet service can guarantee absolute security. Please use a unique password and keep verification links private.
12Your choices
You can choose whether to create an account and which sign-in method to use. You can withdraw third-party access through the relevant Google or Apple account settings.
Depending on where you live and which laws apply, you may have rights to access, correct, delete, or receive a copy of your personal information, or to object to or limit certain uses. Send requests to hello@timebird.space. We may need to verify your identity before handling an account request. Please send your account email and the request, not a password or full card number. We will respond within the time required by applicable law and explain any refusal. Where applicable, you can withdraw consent, appeal a denied request, or complain to your local privacy regulator. We will not discriminate against you for exercising a legal privacy right.
13Children’s information
Timebird is a general-audience planning service and is not directed to children under 13. Do not use the account or booking features if you are under 13 or below the higher minimum age required where you live. Minors need any legally required parent or guardian permission; subscription purchases require legal capacity or an authorised adult. If you believe a child’s information has been provided contrary to these requirements, contact hello@timebird.space so we can investigate and arrange appropriate removal.
14Questions and changes
This notice will be updated as the service develops. The date above identifies the current version. Material changes to how account information is used will be explained through an appropriate notice before the change takes effect where required.
For privacy questions, contact Timebird at hello@timebird.space.