Privacy Policy

Pantheon is operated by Ashwin Kuppahally. Contact: ashwin.kuppahally@gmail.com.

Pantheon is a single-user, personal app. It is protected by a password and is used only by its owner. It is not offered to the public, has no sign-ups, and does not serve any other users.

Pantheon only accesses accounts that the owner explicitly connects in Settings:

• Google Calendar (scope https://www.googleapis.com/auth/calendar): the list of calendars and their names and colors, and calendar events (title, time, location, description, attendees, and recurrence) so they can be shown, created, edited, and deleted.
• Microsoft Outlook calendar via Microsoft Graph (scopes Calendars.ReadWrite, User.Read, offline_access): calendars and events, with the same uses as above.
• TickTick: lists, folders, and tasks (title, notes, due dates, priority, and completion status).
• Basic profile (openid, email, profile): the email address and display name of each connected account, used only to label the connection in Settings.
• OAuth tokens issued by these providers, so Pantheon can call their APIs on the owner’s behalf.

Pantheon does not use analytics, tracking pixels, or advertising cookies. The only cookie is a signed session cookie that keeps the owner logged in.

Data is used solely to provide Pantheon’s user-facing features to the owner: displaying his own calendar events and tasks, and creating, editing, completing, or deleting them when he asks the app to. Pantheon does not use the data for any other purpose.

• No data is sold, rented, or shared with third parties.
• No data is used for advertising, including personalized, retargeted, or interest-based ads.
• No data is used to develop, improve, or train artificial intelligence or machine learning models.
• No data is used to determine creditworthiness or for lending purposes.
• No human reads the data, except the owner himself, or where required to comply with law or for security purposes.

Pantheon’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, Google user data is used only to provide or improve the user-facing calendar features described above, is not transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition, is not used to serve advertisements, and is not used to train generalized AI or ML models.

• Pantheon runs on Vercel. Connection details (OAuth access and refresh tokens, account email, and calendar settings) are stored in a private Supabase (PostgreSQL) database, which encrypts data at rest.
• All traffic between your browser, Pantheon, Supabase, and the provider APIs is encrypted in transit with HTTPS/TLS.
• OAuth tokens are kept server-side only. They are never sent to the browser, logged, or exposed to any other party. The database is accessible only to Pantheon’s server.
• To keep the calendar fast, a working copy of the connected calendars’ events (title, time, location, description, and a link back to the original) is cached in the same database and refreshed from Google and Microsoft. Tasks are fetched live from TickTick and are not stored. Small app preferences (such as folder names and the default calendar) are also stored.

• Tokens, account details, and cached events are kept only while an account is connected.
• Disconnecting an account in Pantheon’s Settings immediately deletes its stored tokens, its calendars, and all cached events from the database.
• You can also request deletion of all data held by Pantheon by emailing ashwin.kuppahally@gmail.com. Requests are completed within 30 days.
• Deleting data in Pantheon never deletes your events or tasks at Google, Microsoft, or TickTick.

You can revoke Pantheon’s access at any time, independently of the app:

• Google: visit myaccount.google.com/permissions, select Pantheon, and choose “Remove access”.
• Microsoft: account.live.com/consent/Manage (personal accounts) or myapps.microsoft.com (work or school accounts).
• TickTick: remove the connected app in TickTick’s account settings, or regenerate the API token.

Pantheon is not directed at children under 13 and does not knowingly collect data from them.

If this policy changes, the updated version will be posted on this page with a new effective date. Material changes will not apply to data already collected without consent.

Questions or requests about privacy: Ashwin Kuppahally, ashwin.kuppahally@gmail.com.