Operational notice

Privacy & Security

Can We Meet is designed to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and to follow privacy-by-design principles. This page is our operational privacy and security notice - it is not legal advice. Last updated 30 October 2026.

1. Who we are

Can We Meet ("we", "us") provides the meeting coordination service available at canwemeet.me. We act as the data controller for the personal data described in this notice.

If Can We Meet is not yet operated through an incorporated company, the current operator/controller is the individual project owner. We have not appointed a formal Data Protection Officer; our privacy contact is reachable at Hello@canwemeet.org.

2. What data we collect

• Meeting details you or invitees enter: names, email addresses, meeting title, location, times and availability, notes, and invite status.
• Account data if you sign in: email address, authentication identifiers, and basic profile info.
• Technical data: IP address (short-term, for security and abuse prevention), browser/device type, error events.
• Cookie and local-storage entries needed to run the service (see Cookies).
• Optional diagnostic snapshots you actively choose to share.

3. Why we collect it

• To let you create, share and confirm meetings and to send invites and calendar events.
• To keep the service secure, prevent abuse and comply with legal duties.
• To improve reliability through privacy-safe Labs diagnostics.
• To respond to your questions and privacy requests.

Calendars and contacts

Calendar connections are optional. You can connect Google Calendar or Outlook by signing in to that provider. In the Can We Meet iPhone app, you can also enable iPhone Calendar and grant device permission. The website cannot read calendars that exist only on your phone.

• Reading: Google and Outlook events are read live for a bounded date range, at most 62 days per request. The iPhone host-chat path reads up to 30 days and 150 events. Titles, times, calendar names, all-day flags and availability status may be passed to our meeting AI for that host turn. Provider reads can include event locations, but the current host-chat projection does not send those locations to the AI.
• Whose diary: host AI calendar context requires the authenticated organiser’s identity. It is not supplied to invitee replies, privacy-mode turns, or turns representing another person’s diary.
• Writing: Google permissions include calendar reading and event creation; Outlook uses delegated calendar read/write permission. We use writing to add agreed meetings when you enable “Add meets I agree to” or choose an add-to-calendar action. Device writing requires iPhone permission. These are calendar permissions, not Google or Microsoft contacts permissions.
• Contacts: the iPhone contact picker shares the person you select, with their name, phone numbers and email addresses. We do not upload your whole address book or edit contacts. Selected contacts remain in the sharing screen; details you submit as meeting participants can become part of the meeting. Messages and WhatsApp sharing open a composer for you to send yourself.

Raw calendar events are context for a request, not saved calendar copies in messages, summaries or operation journals. Accepted meeting information and availability can be stored as part of the plan. Invitee and calendar-export views use offered times without private diary explanations or interval labels; the intended meeting purpose remains visible.

For Google and Outlook we store provider account/connection details, granted scopes, preferences, expiry information and encrypted access/refresh tokens. Tokens are protected server-side with AES-256-GCM encryption and a server-held key. Decrypted tokens are used for provider requests, not returned to the assistant. The iPhone calendar switch is a local preference, not a saved provider token.

Go to Settings > Calendars and choose Disconnect to remove a Google or Outlook connection and its saved encrypted tokens. We attempt provider revocation too, but it may fail; you can also remove Can We Meet in your provider’s account permissions. Turn off iPhone Calendar in the app and revoke device permission in iPhone Settings to stop device access. Disconnecting does not delete events already added or existing meeting records.

Connection records remain while connected, until disconnection or account deletion. Raw event context is discarded after the request. Accepted meeting and participant details follow the retention rules below.

Using Can We Meet from AI assistants

Connecting Claude, ChatGPT, Google Gemini, Meta Muse or Grok requires signing in to Can We Meet and approving delegated OAuth access. The assistant receives results from the meeting tools it calls: replies, meeting IDs, summary details including participants and your stated availability, response status, questions, bookable times, confirmed times, and meeting or invitation links. Share only information you want that assistant to receive. Raw calendar entries, calendar-provider tokens and organiser capability tokens are not returned by these tools.

The six meeting tools act on meetings owned by the signed-in caller. Privacy-mode meetings are hidden from the meeting list. Invitations are not sent automatically: the connector returns a link and message for you to share, and booking requires an explicitly selected bookable time.

Remove or disconnect Can We Meet in your assistant’s connection settings to stop using it there. To request revocation of the Can We Meet authorisation itself, email Hello@canwemeet.org. There is not currently an in-app list of assistant grants. Disconnecting does not erase information the assistant already received; Claude, ChatGPT, Google Gemini, Meta Muse and Grok have their own conversation privacy and retention rules. Each assistant’s own privacy policy also applies.

Assistant requests use the same meeting storage, operation journal and deletion rules as website requests. Prepared changes and exact results are journalled for reliable retries; private payloads and results are removed when the meeting is purged.

4. Our lawful basis under UK GDPR

We rely on more than one lawful basis depending on the purpose. Consent is used only for optional cookies, optional marketing, or diagnostic snapshots you actively choose to share.

5. How Normal Mode works

Normal Mode is the default flow. You (or invitees) type into the chat; we store the meeting record so you can come back to it, share it, receive replies and confirm a time. Titles and locations remain as you enter them. We keep this data only as long as it is useful for Recents, editing and support - see Retention.

6. How Protected Meeting Mode works

• The organiser can arm privacy deletion. Calendar context and durable personal-fact learning are disabled for privacy-mode turns.
• After confirmation, sensitive data is scheduled for deletion following a 60-minute correction window. A material correction unlocks the meeting; confirming again sets a new deletion window.
• Purging clears meeting summaries, titles, locations, final times, participant names and availability, chat messages, organiser/share/invite tokens, and private operation payloads and results. A scrubbed row may remain to record that deletion occurred.
• Privacy-mode meetings are hidden from Recents and the connector’s meeting list. Information you already shared outside Can We Meet cannot be removed from those other services by our purge.

Once deleted, sensitive meeting information cannot be recovered.

7. Labs diagnostics and product improvement

Labs helps us find bugs, understand failure patterns and improve the product. Labs learns from structure, errors and outcomes - not raw private meeting content.

• In Protected Meeting Mode, Labs must not store exact titles, exact addresses, participant names or emails, calendar event titles, free-text notes, full invite URLs, invite tokens, or precise IP addresses beyond what is briefly needed for security.
• In Normal Mode, Labs still avoids unnecessary raw personal data and prefers pseudonymous or aggregated events.
• If you actively share a diagnostic snapshot, we will tell you what may be included and how long we will keep it.

Can We Meet uses AI to help draft messages and extract meeting details. We do not use raw Protected Meeting content for AI training or Labs learning by default, and we do not sell user data to third parties or provide it for training external AI models.

8. Cookies and similar technologies

We keep cookies and local-storage entries to a minimum. There are three groups:

• Essential. Always on. Needed to run meetings, keep you signed in, remember basic choices and prevent abuse.
• Internal analytics. First-party diagnostics that stay on our systems. On by default but you can turn them off below.
• Optional external analytics. Off unless you accept them. Never active on Protected Meeting pages.

9. Data retention and deletion

• Privacy-mode meetings: sensitive data is scheduled for purge 60 minutes after confirmation. Scheduled jobs process due purges; this is not a guarantee of removal at an exact second.
• Empty drafts: the retention sweep purges drafting meetings older than 14 days that have no messages and no confirmed start. This is not a universal 14-day expiry for all drafts.
• Other meetings: records remain for continued access unless purged or deleted. The current cleanup code does not enforce a universal 12-month inactivity limit; we do not promise one.
• Operation journals and links: private journal payloads/results are deleted on meeting purge, and organiser/share/invite tokens are cleared. A journal may otherwise remain with its meeting for reliable replay.
• Calendar connections: encrypted tokens and connection preferences remain while connected and are removed when the connection is deleted. Raw calendar context is not retained as a calendar copy.
• Selected contacts: the sharing screen keeps your selected contacts locally while it is open. Participant details you submit to a meeting follow that meeting’s deletion rules.
• Product improvement records: the current sweep removes learning-candidate rows older than 180 days and rewrite-log rows older than 60 days. Other operational and security records may have different retention; contact us for details about data relating to you.

Disconnecting an assistant or calendar does not itself erase existing meetings or information already sent to external services. You can request access, correction or deletion using the contact details below.

10. Who we share data with / subprocessors

We do not sell personal data. We use these categories of subprocessors:

• Cloud hosting and edge compute - running the web application.
• Managed database and authentication - storing meeting records and handling sign-in.
• Transactional email delivery - sending invites, confirmations and account emails.
• AI provider(s) - used to draft messages and extract meeting details from what you type. Not used to train external models on your data.
• Error logging - capturing sanitised error events for reliability.

A current subprocessor list is available on request from Hello@canwemeet.org. We only list providers we actually use.

11. International transfers

Some subprocessors may process data outside the UK/EEA. Where that happens, we rely on appropriate safeguards (such as the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses) where required. We do not make unsupported claims about exact data location.

12. Security measures

• HTTPS/TLS for data in transit.
• Managed database with access controls and Row Level Security policies where used.
• Random non-guessable invite and share tokens.
• Token expiry aligned with the retention rules above.
• Masking of sensitive fields in admin tools where practical, with admin reveal logging.
• Automated deletion and retention jobs.
• Deliberately limited Labs diagnostics, especially in Protected Meeting Mode.

13. Your rights

Under UK GDPR you can ask us to:

• Access the personal data we hold about you.
• Correct data that is wrong.
• Delete data (right to erasure), subject to lawful exceptions.
• Restrict or object to certain processing.
• Receive a copy of certain data in a portable format, where applicable.
• Withdraw consent for processing that relies on consent (such as optional analytics cookies).

Many users aren't signed in. To act on your request, we may need enough information to locate the relevant meeting - for example the meeting link or invite email. Once Protected Meeting data has been deleted, we may no longer be able to retrieve or identify it.

14. How to contact us

Email our privacy contact at Hello@canwemeet.org. Please put "Privacy request" in the subject line.

15. How to complain to the ICO

Please contact us first - we'd like the chance to put things right. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

16. Changes to this notice

We may update this notice as the service and our subprocessors change. Material changes will be highlighted at the top of this page.