Privacy Policy

1. Who we are

Tribly is operated by Tribe Dot. For privacy questions, email hello@tribedot.com.

2. Information we collect

Host Account Details

• Name, work email, password (stored as a one-way salted hash), timezone, optional phone
• Organization name and public booking slug
• Email verification and password-reset one-time codes (hashed, expire in 10 minutes)

Guest Bookings

• Name, email, optional phone and notes
• Chosen appointment time, timezone, and meeting location (for example Google Meet)

3. Google user data

Connecting Google is optional. Hosts connect Google Calendar from Dashboard → Integrations. Guests do not connect Google. Tribly’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We request these Google Calendar scopes: https://www.googleapis.com/auth/calendar and https://www.googleapis.com/auth/calendar.events.

How Tribly uses Google user data

We access, use, and store Google user data only to provide Tribly’s scheduling features that the host turned on:

• List the host’s Google calendars and read Free/Busy times so the public booking page hides times that are already busy (prevents double-booking).
• Create, update, and delete Google Calendar events for Tribly bookings, including reschedule and cancel.
• Create a unique Google Meet conference on each one-to-one Meet booking and attach that join link to the calendar event and confirmation emails.
• Store encrypted OAuth access and refresh tokens so Tribly can keep the calendar in sync after the host leaves the consent screen.
• Cache busy intervals (start and end times only) so slot checks still work if Google is briefly unavailable.

We use Google user data solely to provide or improve these user-facing features. We do not use Google user data for advertising, retargeting, credit decisions, selling to data brokers, or training general AI models.

Limited Use compliance

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Tribly’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

AI and machine learning

Tribly does not transfer Google Calendar or other Google Workspace or Photos user data—raw, aggregated, or derived—to any third-party AI or machine learning service. We do not use Google user data to create, train, or improve foundational or generalized AI/ML models. We do not operate self-hosted or offline models on Google user data.

Optionally, Business-plan hosts may see a short insight written from Tribly’s own booking counts (number of bookings, cancellations, and no-shows stored in Tribly). That prompt does not include Google Calendar event titles, attendees, notes, Free/Busy details, or OAuth tokens. If that insight feature is enabled, the provider is xAI (Grok chat completions API). Google user data is isolated from that call.

With whom we share, transfer, or disclose Google user data

We do not sell Google user data. We do not share or transfer Google user data to advertising platforms, data brokers, or information resellers. We disclose Google user data only as follows:

• Back to Google: we write booking events and Meet links to the host’s own Google Calendar, and Google may email attendees through Calendar’s invite delivery.
• Host and guest: confirmation and reminder emails include the meeting time and, when applicable, the Google Meet join link. Email is sent through our email processor (Resend).
• Infrastructure processors: encrypted tokens and busy-time cache are stored in our database (Neon) and processed by our application host (Vercel) only to run Tribly.
• Legal, security, or a sale of the business: we may disclose data if required by law, to investigate abuse or a security incident, or as part of a merger, acquisition, or sale of assets after obtaining explicit prior consent from the user where Google’s Limited Use policy requires it.

Tribe Dot staff do not read a host’s Google Calendar contents in ordinary operations. A human may access Google user data only with the user’s agreement for a support request, to investigate a bug or abuse, or to comply with law.

Retention and deletion of Google user data

• OAuth access and refresh tokens are kept only while Google Calendar stays connected. We retain them so Tribly can refresh busy times and write booking events.
• Cached busy intervals are replaced on each sync and removed when the Google connection is deleted.
• The Google Calendar event ID stored on a Tribly booking is kept with that booking record so we can update or delete the matching Google event. It is removed if you delete the booking or your Tribly account.
• To stop access and delete Google tokens and the busy-time cache, use Disconnect on Dashboard → Integrations. You can also revoke Tribly in your Google Account permissions.
• To request deletion of remaining Google user data we hold, email hello@tribedot.com. We delete it unless a longer period is required or permitted by law (for example, a pending legal hold).

3b. Zoom user data

Connecting Zoom is optional. Hosts connect from Dashboard → Integrations. We request meeting create, update, and delete access plus the host’s Zoom email. We use that data only to create a unique Zoom meeting for each Tribly booking, update it on reschedule, delete it on cancel, and label the connection. We store encrypted OAuth tokens while Zoom stays connected. We do not sell Zoom user data or use it for ads. Disconnect in Integrations or remove Tribly in the Zoom Marketplace to delete tokens. See Zoom documentation.

4. Security & Encryption

All passwords are cryptographically salted and hashed. Sensitive PII fields, including Google OAuth tokens, are encrypted at rest. Sessions use secure httpOnly cookies. Data is transmitted over HTTPS.