Privacy

Scone.Link lets people publish a link page and take bookings against their own hours. This page explains what we collect to do that, why, and who else handles it. Questions and requests go to hello@scone.link.

Hosts

If you have a Scone.Link account, we keep:

• your name, email address, username and, if you signed in with Google, your photo;
• what you put on your page: headline, bio, links, calendars, hours and meeting types;
• the bookings people make with you;
• for each signed-in session, the IP address and browser it came from, so you stay signed in and we can spot misuse;
• your plan, and whether your subscription is active.

If you sign up with an email address, we store your password as a one-way hash and never see the password itself.

Guests

When you book time with a host, we keep your name, email address, the time you chose, and any answers or notes you give. The host sees all of it. We use it to hold the slot, email you a confirmation, and let you reschedule or cancel. We do not add guests to mailing lists.

Google

You can sign in with Google. We then receive your name, email address and profile photo, and nothing else.

Hosts can also connect Google Calendar from the Time tab. That asks Google for two permissions:

• See when you are busy on your main calendar. We read free and busy times only, never event titles, descriptions or attendees, so guests cannot book over something already in your diary. Busy times are fetched when a guest opens your booking page and are not stored.
• Create and change events you own. When someone books you, we add the booking to your main calendar, and move or remove it if the guest reschedules or cancels. We do not touch events created by anyone else.

Scone.Link’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to provide the features described here. We do not sell it, use it for advertising, use it to train AI models, or let people read it except where you ask us to for support, where the law requires it, or to investigate abuse.

You can remove our access at any time from your Google account. Google sign-in and calendar access tokens are stored encrypted in our database and deleted with your account.

Payments

Paid plans are sold by Paddle, which acts as the merchant of record and handles your card details, billing address and tax. We receive your subscription status and plan, never your card number. Paddle’s own privacy notice covers what it does.

Who else handles your data

• Cloudflare runs the app and sends our emails.
• Neon hosts the database, in Frankfurt.
• Google for sign-in and, if a host connects it, their calendar.
• Paddle for payments.

Each processes data only to provide its service to us. Some of them operate outside the UK. Where they do, the transfer is covered by the UK International Data Transfer Addendum or an equivalent safeguard.

Cookies

We set one cookie, which keeps you signed in. Your light or dark choice is saved in your browser and never sent to us. There are no advertising or tracking cookies.

Why we are allowed to

Under UK GDPR, we process host data to perform our contract with you, and guest data because it is needed to make the booking the guest asked for. Session records and abuse checks rest on our legitimate interest in keeping the service secure.

How long we keep it

We keep your account data while your account is open. If you ask us to delete your account, we remove it, your page and your bookings within 30 days. Paddle keeps billing records for as long as tax law requires.

Your rights

You can ask to see, correct, export or delete the data we hold about you, or object to how we use it. Email hello@scone.link and we will reply within a month. If you are unhappy with our answer, you can complain to the Information Commissioner’s Office.

Changes

If we change this policy in a way that affects you, we will email account holders before it takes effect. The date at the top shows the latest version.