Sked Privacy Notice
Effective 19 October 2026
This notice explains how Mantle, Inc. ("Mantle", "we") handles personal data in Sked, our scheduling service. It covers two groups of people: hosts, who create a Sked account and publish booking pages, and invitees, who book time with a host. Mantle's general Privacy Policy covers our website and other services.
1. Who is responsible
Mantle, Inc., 16192 Coastal Highway, Lewes, Delaware 19958, United States, operates Sked. For host account data, Mantle is the controller. For data that invitees submit when booking a host, the host decides why it is collected and Mantle processes it to provide the booking service on the host's behalf. Contact: privacy@mantlenow.com.
2. What we collect
Hosts:
- Name, email address, password (stored only as a salted Argon2 hash), booking address and timezone.
- Event types, availability schedules, questions you ask invitees, and webhook endpoints you add.
- If you connect Google Calendar: your Google account email, OAuth tokens (encrypted at rest), the free/busy times of the calendars you choose, and the calendar events Sked creates for your bookings.
Invitees:
- Name, email address, timezone, guest email addresses, the meeting time, and answers to the host's questions.
- A phone number, if the host offers a call and you choose it.
Everyone: IP addresses are used briefly to limit abuse (rate limiting) and appear in server logs.
3. How we use it
- To show available times, create and manage bookings, and prevent double-booking.
- To send confirmation, reminder, reschedule and cancellation emails with calendar invitations.
- To add bookings to, and remove them from, a host's connected calendar, including Google Meet links.
- To deliver booking notifications to webhook endpoints a host has configured.
- To keep accounts secure: email confirmation, password reset, sign-in rate limits and error monitoring.
We do not sell personal data, show advertising, or use Sked data to train AI models.
4. Google user data
When a host connects Google Calendar, Sked requests permission to read free/busy information, list the host's calendars, and create and delete events. Sked uses this data only to check the host's availability and to add or remove the meetings booked through Sked. Sked's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to others except as needed to provide this feature, for security, or as required by law; we do not use it for advertising; and no person reads it unless the host asks us to for support, it is needed for security, or the law requires it. Hosts can disconnect at any time under Integrations, which deletes the stored tokens, and can also revoke access in their Google account.
5. Who we share it with
- The host sees the details invitees submit for their meetings; invitees see the host's name and meeting details.
- Service providers acting on our instructions: Railway (application hosting and database), Resend (email delivery) and Google (calendar, only when a host connects it).
- Webhook endpoints that a host configures receive booking details for that host's meetings.
- Authorities or advisors where the law requires it, or to protect rights and safety.
Data may be processed in the United States and other countries where these providers operate.
6. How long we keep it
| Data | Kept for |
|---|---|
| Host account, event types, schedules, bookings and invitee details | While the host's account exists; deleted when the host deletes the account |
| Calendar connection tokens | Until the host disconnects the calendar or deletes the account |
| Sign-in sessions | Up to 30 days |
| Email confirmation and password-reset links | Until used or expired, then removed within 7 days |
| Booking request records used to prevent duplicate bookings | 7 days |
| Webhook delivery records | 30 days |
| Error reports | 90 days |
7. Security
Traffic is encrypted in transit, passwords are hashed, calendar tokens are encrypted with AES-256-GCM, links in emails are single-use and expire, and access to production systems is restricted. No system is perfectly secure; if a breach affects your data we will notify you and the relevant authorities as the law requires.
8. Your choices and rights
- Hosts can edit their profile and change or delete their account under Settings.
- Invitees can reschedule or cancel through the link in their confirmation email.
- Depending on where you live, you may have rights to access, correct, delete, restrict or port your data, or to object to processing. Email privacy@mantlenow.com. If you booked a host, we may pass your request to that host, who controls that data.
9. Cookies
Sked uses one strictly necessary cookie to keep hosts signed in, and a short-lived cookie during calendar connection to protect against forged requests. Sked does not use analytics or advertising cookies. Invitees can book without any cookie.
10. Children
Sked is not intended for anyone under 16, and we do not knowingly collect their data.
11. Changes
We will update the effective date when this notice changes, and tell hosts by email about material changes. See also the Terms of Service.
12. Contact
privacy@mantlenow.com · Mantle, Inc., 16192 Coastal Highway, Lewes, Delaware 19958, United States