Privacy notice

Updated 2026-10-31

This notice describes the current operation of orBit, a personal administration application operated by Rodrigo Alves.

Data accessed and stored

• Google sign-in: the permitted administrator email and verified Google account ID are stored to restrict administration. Login requests basic OpenID identity and email access. The ID token is verified on the server and is not retained; login access tokens and refresh tokens are not stored.
• Google account authorization: OAuth client credentials and access/refresh tokens, stored on the server in a private database.
• Calendar data: the names, IDs and access roles of calendars you choose to load are cached privately on the server; local calendar/event display-color preferences; busy intervals and, within protected administration, event titles, dates, descriptions, locations and attendees returned by Google Calendar.
• Meeting requests: the visitor’s name, email address, meeting title, optional message, proposed dates and times, their grouping as alternatives, submission time and approval decisions.
• Operational data: administrator sessions, rate-limit records and server access logs, which can include IP addresses, request paths, timestamps and response status.

How the data is used

Data is used to display availability, review meeting requests, create approved Google Calendar events, and let the administrator view and edit events. A shared Google connection is available to authorized systems within this personal instance.

orBit does not use Google user data for advertising or to train AI models, and does not sell it or transfer it for unrelated purposes.

Sharing

Only calendars selected for public visibility appear on the public calendar. Their entries are labelled Busy by default. The administrator can explicitly enable Event title for an individual public calendar, publishing labels in the form Calendar name - Event title. Events marked private or confidential keep their names hidden; private free events are not published. Calendars selected solely for orBit are used only by the private event browser. Event descriptions, locations, attendee lists, Google record IDs and authorization tokens are not exposed to visitors. All-day events never block bookings, on any calendar. Free timed events also do not block bookings. Display colors can be customized locally without changing Google Calendar or notifying guests. Google receives API requests needed to perform the authorized calendar operations. When one proposed time is approved, its remaining alternatives are closed, the requester is added as a guest and Google sends a calendar invitation. Saving event changes can notify existing guests.

The application does not include third-party advertising or analytics scripts. The application server stores its local database and operational logs.

Retention and deletion

Meeting requests and local records remain until the operator removes them; no automatic request-retention schedule is configured. The administrator can disconnect a Google connection to remove its stored access and refresh tokens. Disconnecting does not automatically delete previously created Google events, meeting requests, OAuth client configuration or other local records.

You can revoke authorization in your Google Account’s third-party connections. Contact the operator to request removal of local meeting-request information. Changes or deletion of events already stored in Google Calendar must also be managed there.

Access controls

Administration requires the permitted Google identity or the recovery password. The application uses HTTPS, protected session cookies, request-origin and CSRF checks, and a private server-side database outside the web root. Account credentials and tokens are not returned to the administration browser.

Contact

Rodrigo Alves · rasalvescz@gmail.com