Privacy

Effective 18 October 2026

DOFOTT adds travel-time blocks to your Google Calendar™. This page says exactly what it reads, what it keeps, who else sees it, and how you make it forget you. It is written to be read, not skimmed; it is short because DOFOTT keeps little.

Who is responsible

DOFOTT is operated by Yakup Bayrak, a sole proprietorship in Türkiye, who is the data controller. Contact: help@dofott.com.

What DOFOTT asks Google for

When you connect, Google asks you to grant three permissions. DOFOTT uses each of them only as described here.

• Your email address (openid, email): to know which account is yours and to show it on the settings page.
• See the list of your calendars (calendar.calendarlist.readonly): to list the calendars you can write to, so you can tick the ones DOFOTT may use. This scope does not give access to events.
• See and edit events (calendar.events): to read events in the calendars you ticked and to insert, move and remove DOFOTT's own travel blocks in them.

For events DOFOTT reads only these fields: the event's identifier, start, end, location, whether you declined it, whether it has a video-meeting link, and DOFOTT's own private tag. DOFOTT asks Google not to send titles, descriptions or attendee lists, and it only looks at the next sixty days.

Travel blocks are written as private events. Someone you share your calendar with sees them only as busy, even if you share every detail; only someone you allow to edit your calendar sees what is in them.

What DOFOTT stores

• Your email address and an encrypted copy of the Google token that lets DOFOTT act on your calendar between visits.
• Your settings: starting address and its coordinates (an optional second address and its hours), travel mode, buffer, return trip, smart travel, block colour, reminder choice, language, which calendars are ticked.
• For each travel block it wrote: the identifier of the event it belongs to, the identifier of the block, the block's times, and a checksum of the inputs.
• A note for each block you deleted, so it does not come back; a note for each event you changed from the "change this trip" link.
• A cache of travel durations keyed by a one-way hash; the addresses themselves are not in it. Entries expire within seven days.
• Technical identifiers for Google's change notifications.
• Where the visit that made your account began: the campaign tags in the link you followed, or else the name of the site that linked here (such as google.com), and the page of this site you arrived on. The page keeps this for the visit in the tab's session storage, not a cookie, and the sign-in hands it to DOFOTT's server, which keeps it with a new account. It is used to see which pages and links bring people; PostHog's counts (below) carry it too, and it goes to no one else. It is not kept if your browser sends Do Not Track or Global Privacy Control.

DOFOTT does not store event titles, descriptions, attendees, calendar names, or any event without a location. Server logs contain counts and error codes, never event data.

Who else sees anything

• Google. Your starting address and the locations of your events are sent to Google's Geocoding and Routes APIs to compute travel time, and the blocks are written to Google Calendar™. Google's own privacy policy applies to Google's services.
• TomTom (tomtom.com) is asked why the road is slow. When today's traffic makes a drive longer than planned, DOFOTT's server sends TomTom the trip's starting address and the meeting's location, as written, and the departure time, and gets back whether there is an accident, a closure, roadworks or similar on the way; that becomes one line in the block. Nothing else goes with them: not your name, not your email address, not the event's title, not an identifier for your account. It happens only for those trips, on the server, never on these pages. Neither Google's map data nor its routes are passed to TomTom. TomTom's own privacy policy applies to TomTom's services.
• Supabase hosts DOFOTT's database and server code, in the European Union.
• Cloudflare serves these web pages and forwards Google's change notifications.
• Customer.io sends DOFOTT's own emails — the welcome note, a reminder if you connected but never set an address, a warning if the Google connection drops, a note the day after you sign up on what DOFOTT can do, one last letter if you cancel your subscription asking why (the reason you pick is kept with your account, and goes with it), one goodbye letter if you delete your account from the settings page, and now and then news of a new feature, which the link at the foot of that letter stops — from servers in the European Union. It is given your email address, your language and time zone, which features you have switched on, whether an address is set (yes or no, never the address itself), how many calendars you ticked, how many blocks DOFOTT has written for you, which plan you are on, and how many of your meetings with a place got a trip: on the day you set your address, this month and last month — a number each, never which meetings. If your Google connection drops, it is also given a link that deletes your account, so that its letter can offer it. If you delete your account and pick a reason in the delete dialog, it is given that reason, so that the goodbye letter can thank you for it; anything you write yourself never reaches it. Nothing read from your calendar reaches it: no locations, no event times, no calendar names. It runs on DOFOTT's server only, never on these pages, and the emails carry no tracking pixel and no wrapped links. Deleting your account deletes the profile there too: within the hour if you delete from the settings page, so that the goodbye letter can still reach you, and at once otherwise.
• Polar (polar.sh) takes the payments as merchant of record, on servers it operates itself. When you subscribe it is given your email address and DOFOTT's own identifier for your account; you give your card details to Polar's checkout page, and DOFOTT never sees or stores a card number. In a month where you pass the free twelve, one thing is sent: that this account went over — a single unit, with no number of meetings, no dates, no places. Invoices, renewal notices and payment-failure emails come from Polar. Deleting your account cancels the subscription: it is not renewed, and it runs to the end of the period already paid for.
• PostHog (eu.i.posthog.com) counts page views, clicks and how far a sign-in gets, without cookies or identifiers; see below.
• Reddit is told when a click on one of DOFOTT's ads on Reddit became an account. Such a click arrives with an identifier Reddit itself put in the link; this page keeps it for the visit (in the tab's session storage, not a cookie — it is gone when the tab closes, and it is not kept at all if your browser sends Do Not Track or Global Privacy Control), and if you sign up in that visit, DOFOTT's server sends Reddit that identifier, the time, and a random number made for that one message so that Reddit counts it once. Nothing else: not your email address, not your IP address, nothing from your calendar. There is no Reddit pixel or script on these pages. If you did not come from a Reddit ad, nothing is sent.
• Inputly (inputly.byako.dev) provides the "Feedback" button on every page. Loading it shows Inputly your IP address and browser like any web request; what you type into it goes to Inputly, not to DOFOTT's database. Nothing else on the page is shared with it.

No advertising on these pages, no tracking pixels, and no sale or sharing of data with anyone else. The pages load two third-party scripts, both listed above: the feedback button and PostHog analytics. PostHog counts page views, clicks and how far a sign-in gets — the button pressed, the Google screen reached, a connection finished — and, when you answer "Not on Google Calendar?", which calendar you chose (never your email address), so that the pages can be improved; it runs on servers in the European Union, stores nothing in your browser (no cookie, no identifier, so it cannot recognise you on your next visit), does not record sessions, and honours your browser's Do Not Track setting. It sees your IP address like any web request. Nothing about your calendar reaches it. One count goes to it from DOFOTT's server rather than from these pages: when you give a reason for leaving — in the delete dialog, the cancel letter or the payment provider's cancel form — the reason alone, where it was asked and the time, under a random identifier made for that one count and never reused, so it cannot be tied to you or to any other answer. Your email address, your account and anything you write yourself are not in it.

If you apply for the team pilot

The form on the DOFOTT for teams page asks for your work email, your company, how many people are on the team and how many of them go to meetings in person, your city, and, if you like, how you handle this today. It is kept in DOFOTT's database so that we can write back to you. The company name, the two numbers, the city and your email address are also posted to DOFOTT's own Slack workspace so that a new application is seen and answered the same day; what you wrote about how you handle it today is not. None of it is given to Customer.io or anyone else, and it is not used to send newsletters. Write to the address above and it is deleted.

If you tell us which calendar you use

The "Not on Google Calendar?" box on the home page asks for your email address and which calendar you use: Outlook, iCloud, or somewhere else, with its name if you like. It is kept in DOFOTT's database so that we can write to you once, when DOFOTT works with that calendar, and so that we can count how many people ask for each. The calendar you chose and your email address are also posted to DOFOTT's own Slack workspace. None of it is given to Customer.io or anyone else, and it is not used to send newsletters. It is deleted after that one email, or sooner if you write to the address above.

Google API Services User Data Policy

DOFOTT's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain words: calendar data is used only to compute and write travel blocks, is never used for advertising, and is never read by a person except with your permission for support or as required by law.

How long, and how to delete

Everything is kept only while your account exists. On the settings page, "Delete account and remove all DOFOTT blocks" removes every DOFOTT block from every calendar it wrote to, past ones included, deletes all of the data above, and revokes DOFOTT's access at Google. This happens immediately. You can also revoke access at any time from your Google account's third-party access page; DOFOTT then stops and writes to you with a link that deletes your account; your email address, your plan and how long the account has been open are posted once to DOFOTT's own Slack workspace, and once more if you connect again, so that we know whose connection dropped and how it ended. If you neither connect again nor use that link, the account and all of the data above are deleted 30 days after that letter. Blocks already in your calendar stay, since DOFOTT can no longer reach it. One thing is written down when an account is deleted, whichever way it goes: your email address, your plan, how long the account was open, how it was deleted and, if you answered the cancel letter or the delete dialog, the reason you picked are posted once to DOFOTT's own Slack workspace, so that we know who left and can learn from it. Nothing else is kept, and nothing about your calendar is in it.

Your rights

Under Türkiye's data protection law (KVKK) and, where it applies, the GDPR, you can ask what DOFOTT holds about you, have it corrected, or have it deleted. The settings page covers all of it; for anything else write to the address above.

Security

Traffic is encrypted in transit. The Google token is encrypted at rest with a key that is not stored with the data. Database access is restricted to DOFOTT's server code; the web pages never talk to the database directly.

Changes

If this page changes, the date at the top changes with it. Material changes are announced by email to connected accounts.

Google Calendar™ and Google Maps™ are trademarks of Google LLC.