Privacy Policy — Schedule by McBride Method

Schedule ("Schedule," "we," "us") is a scheduling product operated by The McBride Method LLC. This policy explains what information Schedule collects, how we use and protect it, and the choices you have. It covers the Schedule web application at schedule.mcbridemethod.com.

Schedule is used by mentoring and nonprofit organizations ("Agencies") to coordinate meeting times between their staff and the people they serve. When an Agency uses Schedule, the Agency is the controller of the personal information it puts into the product, and Schedule acts as a service provider processing that information on the Agency's behalf and under its instructions.

Information we collect

Account information. When Agency staff create or join an account, we collect name, email address, and the Agency they belong to. Authentication is handled through email sign-in links and, optionally, Google sign-in.

Scheduling information. To run a scheduling poll, Schedule stores the meeting details an Agency provides: proposed times, meeting duration, location or method, and the names and contact details of the participants an Agency invites (which may include the people an Agency serves and their family members). Participants can respond to a poll through a private link without creating an account.

Google account information (only if you connect Google Calendar). If an Agency staff member connects their Google Calendar, Schedule requests permission to read free and busy times and to create, update, and delete calendar events on that calendar. We use this access only to:

• read availability (free and busy windows) so Schedule can suggest open times, and
• place temporary "hold" events while a poll is open, and create or remove the final event once a time is confirmed.

Schedule does not read the contents of your other calendar events, does not access email, contacts, files, or any other Google service, and requests no scopes beyond calendar access.

Usage and audit records. We keep audit logs of actions taken in the product (for example, a poll being confirmed or an integration being configured) for security, troubleshooting, and accountability.

How we use information

We use the information above only to provide and operate the scheduling service: to compute availability, run polls, place and clear calendar holds, confirm meetings, notify participants, and, where an Agency has configured it, send a confirmed meeting time to that Agency's own system of record. We do not use it for advertising, and we do not sell it.

Google user data

Schedule's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Specifically: Google Calendar data is used only to provide the scheduling features described above, is not transferred to others except as needed to provide those features or as required by law, is not used for advertising, and is not read by humans except where you explicitly ask us to for support, where required for security, or where required by law. OAuth tokens that let Schedule access your calendar are encrypted at rest.

Artificial intelligence features

Schedule offers optional AI-assisted time suggestions. When this is used, Schedule sends only the minimal scheduling context needed to rank options (candidate open time slots and the meeting duration) to our AI provider, Anthropic. The AI selects among times that Schedule has already computed on the server; it does not invent times and is not given access to your calendar or to participant contact details for this purpose.

How we store and protect information

Schedule runs on Supabase (database and authentication) and Vercel (application hosting). Each Agency's data is isolated so that one Agency cannot access another Agency's records. Google OAuth tokens are encrypted at rest using AES-256-GCM. Access to production systems is limited and logged. No method of storage or transmission is perfectly secure, but we take reasonable measures to protect your information.

Subprocessors

We use a small set of service providers to run Schedule: Google (calendar access and sign-in), Supabase (database and authentication), Vercel (hosting), Anthropic (AI time suggestions), Resend (transactional email), and Stripe (billing, where applicable). Each processes information only to provide its service to Schedule.

Sharing information

We share information only: with the Agency that owns it; with the subprocessors above to operate the service; with an Agency's own connected systems where that Agency has configured an integration; and where required by law or to protect the rights and safety of users. We do not sell personal information.

Data about the people Agencies serve, including minors

Agencies may enter personal information about the people they serve, who in some programs are minors. Schedule processes this information solely on behalf of the Agency and under the Agency's instructions. The Agency is responsible for having the appropriate legal basis and consents to collect and share that information and for its own obligations regarding minors. If you are a participant and have a question about your information, please contact the Agency that invited you.

Retention and deletion

We retain information for as long as an Agency's account is active and as needed to provide the service. When an Agency ends its use of Schedule, we will delete or de-identify its data within a reasonable period, except where we must retain limited records to meet legal, security, or accounting obligations. An Agency administrator can request export or deletion of the Agency's data by contacting us.

Revoking Google access

You can disconnect Google Calendar from within Schedule at any time, and you can revoke Schedule's access to your Google account at any time through your Google Account permissions at https://myaccount.google.com/permissions. Revoking access stops future calendar reads and event changes.

Your choices and rights

Depending on where you live, you may have rights to access, correct, or delete your personal information. Agency staff can update their account details in the product. For other requests, contact us using the details below, or contact your Agency if you are a participant.

Changes to this policy

We may update this policy as the product changes. We will post the updated version here and revise the effective date above. Material changes will be communicated to Agency administrators.

Contact us