Privacy, plainly.

What Wheremo stores, who can see it, and what you control.

Who runs Wheremo

Wheremo is operated by Ali Bauyrzhan. Contact ali.baurzhan.2004@gmail.com with privacy questions or requests.

Information we process

Your account: Google/Firebase sign-in information, including your email and authentication identifier, plus the name and handle you choose for your Wheremo profile.
Coordination: friend connections, published time slots and their visibility, meeting requests, messages, shared replies, request status, and notification records.
Agent connections: permissions, authorization records, credential hashes, connection expiry and revocation, and inbox acknowledgment. When you opt into supported event delivery, we also process the agent host’s callback address, protected signing credentials, subscriptions, and delivery attempts.
Invitations: invitation links and records of who joined, connected, or first made plans through an invitation. The inviter sees aggregate signup, connection, and meeting counts.
Technical and support information: our hosting and authentication providers process information such as IP addresses, request timestamps, browser information, and errors to operate their services. If you contact us, we receive your message and any attachments.

How we use it

We use this information to sign you in, find and connect friends, share availability, coordinate requests, authorize your agent, deliver opted-in events, understand invitation use, troubleshoot problems, and respond to support or privacy requests. Wheremo does not operate an advertising service or train an AI model on your scheduling data.

What is shared

People who can discover your exact handle can see your profile name and handle. Anyone holding a valid invitation link can see the inviter’s name. Accepted friends can see slots marked for friends. Private slots are available to you and an agent authorized to read your account. A meeting’s participants can see its times, message, shared reply, and status.

An agent you authorize receives the coordination data allowed by its permissions, including relevant friend and request information. Opted-in event delivery sends event information to that host. Your agent provider processes received information under its own policies. Wheremo cannot erase copies already received by friends or agent providers.

Service providers

We use Google Firebase for authentication, Supabase for application data and the API, and Vercel for the public website. The site also loads JavaScript libraries from Google and jsDelivr. These providers receive information needed to serve and operate the product. Depending on the provider and configuration, information may be processed outside your country. We may disclose information when legally required or necessary to address abuse or protect the service.

Google Calendar and location

Google sign-in includes an optional Calendar permission choice in the same popup. You can skip Calendar permission and still create and use your Wheremo account. You can also connect later in Account. We request access to events on calendars you own. Our integration uses your primary calendar to create and update your own copies of accepted Wheremo meetings, remove those copies after cancellation, and configure a calendar popup reminder. It does not scan your calendar for availability or read unrelated events. We store your linked Google account identifier, email, an encrypted refresh credential, reminder preference, and synchronization records. A short-lived Google credential is used in your browser to sign in to Firebase. Calendar synchronization runs on the server, and the offline refresh credential remains encrypted there. Google credentials are not shared with agents or friends.

Future accepted meetings already agreed in Wheremo are included when you connect. Trusted dummy-bot meetings are excluded. Calendar copies include the other participant’s display name, meeting times, and a Wheremo reference, but omit request messages and shared replies. We add no attendees or calendar invitation emails. Google handles device notifications. Disconnecting deletes our stored refresh credential and stops future updates; saved calendar copies remain in Google. You can also revoke Wheremo in your Google Account permissions. Google Calendar data is used only to provide this user-facing integration, not advertising, sale, or model training. Wheremo’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Wheremo does not access your address book, maps, microphone, or precise location. Your personal agent may use those through separately authorized services. Details you include in a meeting message or shared reply are stored and shared with the other participant.

Browser storage

Firebase uses browser storage to keep you signed in. Wheremo uses session storage to remember an invitation and whether you arrived from the ChatGPT directory. The current website does not include advertising trackers or a separate analytics SDK. Clearing browser storage can sign you out or remove pending invitation context.

Retention and deletion

We keep account and coordination records while operating your account. The beta does not currently apply a fixed automatic deletion schedule to all records. Invitation links and agent grants expire, but expiry does not itself delete their records. Provider backups and operational logs have separate retention periods.

You can remove availability, remove a friend connection, disable handle discovery, and disconnect agents in the app. For account deletion, a copy of your data, or a correction, email ali.baurzhan.2004@gmail.com from your sign-in address and include your handle. We handle these requests manually and may verify ownership. Deletion requests cover Wheremo account data and its Firebase identity; provider backups, legally required records, and copies held by other people or agent providers may remain.

Children and changes

Wheremo’s beta is intended for adults aged 18 and older. Contact us if you believe a child has provided personal information. We will update this page when our practices change and revise the effective date. Material changes will be communicated through the service or an available account contact.