The fine print, in large type

Your calendar is read, never kept.

What Wagon-Lit asks Google for

Two things, and nothing else. Who you are — your name and email address, from Google Sign-In (openid, email, profile) — so the host sees a real name on the roster and so your reply is tied to you rather than to whoever happens to hold the link. And when you are busy — Google's free/busy permission (calendar.freebusy), the narrowest calendar permission Google publishes: it returns blocks of time marked busy, and nothing else. Event titles, descriptions, locations, attendees and guest lists are not requested, not returned, and not something this app could read if it wanted to.

What it actually reads

Only the busy blocks inside the candidate evenings you were invited to consider — and, because the scoring is door-to-door, the drive on either side of them. Every check is a single call to Google's free/busy endpoint bounded to those windows. There is no call anywhere in this app that lists or opens a calendar event.

What it stores

Your name and email address as Google supplied them, the home address you type into the join form, the coordinates and drive time worked out from it, and your Google access and refresh tokens — encrypted (AES-256-GCM) before they touch the disk, and never sent to your browser. No calendar data is ever written down: availability is recomputed live on every check and discarded as soon as the page is rendered.

Who else sees your data

Your home address and the venue address are sent to Geoapify, which does the geocoding and the drive-time routing, to turn them into coordinates and a number of minutes. Nothing else goes to them: not your name, not your email, not your calendar. Your calendar data is never sent anywhere — it is read from Google, scored in memory, and dropped. When a host types a venue into the create form, what they type is sent to Google Places to suggest matching places; guests' details never go there. The app itself runs on Fly.io, which hosts the server and the disk the records sit on. Nothing is sold, and nothing is used for advertising, profiling, or training a model.

Google API Services User Data Policy

Wagon-Lit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How it ends

Hit "Withdraw me and delete my data" on the event page at any time: that deletes your whole record — name, email, home address, drive time, and the stored Google tokens — on the spot. Otherwise records are deleted 30 days after you joined; that sweep runs when the event page is next opened, so a dormant event is cleared on its next visit rather than on a timer. Locking in the date does not by itself delete anything. Separately, and independently of all of the above, you can withdraw Wagon-Lit's access to your Google account at myaccount.google.com/permissions, which stops any further calendar checks immediately.

Who sees what

The host sees, per evening, who is free and who is busy — never why someone is busy — along with the drive time your address works out to. Other guests see only the roster of names.

Questions, or want your record gone without opening the event page? Write to the conductor, Gavin N. Morgan, at morgan.gavin@gmail.com.