Privacy Policy

Overview

Carnet is a personal note-taking and task management application. This privacy policy explains how we handle your data.

What Data We Collect

Information You Provide

• Email address - Used for account authentication
• Notes and tasks - Content you create in the application
• Pages and blocks - Your organizational structure

Google Calendar Integration

When you connect your Google Calendar:

• Calendar events - We read your calendar events (title, time, location, attendees)
• Email address - To identify which calendar account is connected
• Profile information - Your name from your Google account

We request read-only access to your calendar. We cannot modify or delete your calendar events.

Strava Integration

When you connect your Strava account:

• Activity data - We read your activities (type, distance, duration, pace, elevation)
• Activity details - Route data, heart rate, splits, and performance metrics
• Profile information - Your athlete name and ID from Strava

We request read-only access to your activities. We cannot modify or delete your Strava activities.

How We Use Your Data

• Display calendar events in your daily journal pages
• Display Strava activities in your daily journal pages
• Link calendar attendees to people pages in your workspace
• Show activity statistics and performance trends
• Sync events and activities automatically to keep your journal up-to-date
• Store locally on our servers to provide the service

Data Storage

• All data is stored securely on our servers
• Calendar events and Strava activities are cached locally to improve performance
• We use industry-standard encryption for data in transit (HTTPS)

Data Sharing

• No advertising networks
• No analytics companies
• No data brokers
• No partners or affiliates

Your calendar data, Strava activities, notes, and personal information stay private and are only accessible by you.

Third-Party Services

We connect to third-party APIs to read your data:

Google Calendar API

• We only read your calendar events
• Google does not receive data from Carnet
• You can revoke access at any time in your Google account settings

Strava API

• We only read your activity data
• Strava does not receive data from Carnet
• You can revoke access at any time in your Strava account settings

Your Rights

You can:

• Disconnect your calendar or Strava integration at any time
• Delete your account and all associated data
• Export your data (contact us for assistance)
• Revoke access via Google or Strava account settings

Data Retention

• Calendar events and Strava activities are stored as long as your integration is connected
• If you disconnect an integration, cached data remains in your journal but won't update
• Deleting your account permanently removes all data

Security

We take security seriously:

• OAuth 2.0 for secure authentication with Google and Strava
• HTTPS encryption for all connections
• Secure token storage
• No passwords stored (we use OAuth)

Changes to This Policy

We may update this privacy policy occasionally. We'll notify you of significant changes via email.

Contact

Questions about privacy? Contact us at: jlfenaux@gmail.com

Third-Party API Compliance

Google API Services

Carnet's use of information received from Google APIs adheres to Google API Services User Data Policy, including the Limited Use requirements.

Strava API

Carnet's use of information received from Strava API adheres to the Strava API Agreement.