# Privacy Policy

TimeToLeave is designed to keep user data local where possible. The app does not include third-party analytics or advertising trackers.

## Data Stored Locally

- Web events and reminder settings are stored in browser `localStorage`.
- Mobile events, origin station, notification settings, theme, and selected native calendars are stored in `AsyncStorage`.
- Mobile notifications are scheduled locally through Expo notifications.

## Data Sent to External Services

Some features require network calls to calculate routes or import calendars:

| Data | Sent to | Purpose |
| --- | --- | --- |
| Destination text or address | Nominatim | Convert a place into coordinates. |
| Coordinates | OSRM | Calculate bike and walking routes. |
| Station IDs, dates, and times | ÖBB HAFAS | Search stations and live public-transport journeys. |
| Coordinates or stop IDs | Wiener Linien | Find nearby stops and live departures. |
| Calendar URL | TimeToLeave backend, then the calendar host | Fetch and parse remote ICS feeds. |
| Google Calendar authorization code and tokens | Google and the TimeToLeave backend | Connect and sync Google Calendar on web. |
| Device calendar event fields | Local mobile app process | Import native calendar events with locations. |

Remote ICS imports are restricted by server-side URL validation. Private and reserved hosts are blocked.

## Google Calendar

Google Calendar sync is optional. When connected on the web app, OAuth tokens are stored in HTTP-only cookies and used only to fetch calendar events. Disconnecting Google Calendar deletes the token cookie.

## Location

Location access is optional and used to find nearby stations or calculate routes. Coordinates may be sent to route, geocoding, or transit APIs only when the corresponding feature is used.

## Calendar Data

Only events with locations are useful to TimeToLeave. Imported events are normalized to title, destination, event time, source, and ID. The app stores those normalized events locally.

## Data Retention

Local data remains until the user clears app/browser storage, deletes events, disconnects Google Calendar, or uninstalls the app. Server-side proxy routes are intended for request handling and do not provide application-level persistent event storage.

## Changes

This policy may be updated as the app changes. Updates are made in this repository.