What Avly collects, and why

Avly (avly.app) is a scheduling service. An account holder connects one or more Google calendars and shares a booking link; people who open that link pick a time, and Avly creates the meeting on the account holder’s Google Calendar. This policy covers both the account holder and the people who book time with them.

When you sign in or connect a Google account, Avly asks Google for permission to:

• See your basic profile — your email address, name, and profile photo. Used to identify your account and to show your name on your booking page.
• See your calendars — the list of calendars on the account and, for the calendars you switch on, the times you are busy. Avly reads only free/busy intervals. It does not read the titles, descriptions, locations, or attendees of your existing events.
• Manage events — used solely to create the events for bookings made through Avly, and to delete those same events when a booking is cancelled or rescheduled. Avly does not modify or delete events it did not create.

To keep this working without asking you to sign in again, Avly stores the OAuth tokens Google issues for each connected account.

Someone booking a meeting provides their name, email address, timezone, and any notes they choose to add. Avly stores these with the booking, includes them in the calendar event so both sides receive the invitation, and uses them to generate a private manage link for rescheduling or cancelling. Booking does not require an account.

• To compute the times you are available and show them on your booking page.
• To create, reschedule, and cancel meetings on your Google Calendar.
• To send calendar invitations — these are sent by Google Calendar, not by Avly.
• To keep you signed in, using a single session cookie.

Avly does not use your data for advertising, does not sell it, does not build profiles from it, and does not run third-party analytics or tracking on its pages.

Avly’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google user data is used only to provide the scheduling features described here, is never transferred to third parties except as needed to provide those features or as required by law, is not used for advertising, and is not read by humans except with your explicit consent, for security or legal reasons, or after being aggregated and anonymised.

Data is stored in a database hosted on Netlify in the United States and is transmitted only over HTTPS. Google receives the events Avly creates, and the people you meet with receive calendar invitations containing the meeting details. No other third party receives your data.

• Disconnecting a Google account from the Calendars page deletes its stored tokens and calendar records immediately and revokes Avly’s access at Google.
• You can also revoke access at any time from myaccount.google.com/permissions, after which Avly can no longer read that account.
• Cancelling a booking deletes the calendar event. The booking record is kept so the cancellation can be shown on your manage link and dashboard.
• To delete your account and everything associated with it, or to ask for a copy of your data, email edltech@gmail.com. Requests are handled within 30 days.

Avly sets one cookie to keep the account holder signed in, and a short-lived cookie during Google sign-in to protect against request forgery. Neither is used for tracking, and no cookies are set for people who only visit a booking page.

If this policy changes in a way that matters, the effective date above changes with it. Questions go to edltech@gmail.com.