Clew Privacy Policy

Last updated October 12, 2026

This policy covers Clew, the student planner at clewplanner.com and app.clewplanner.com. It explains what data Clew accesses (including Google user data), how it is used, stored, shared and protected, how long it is kept, and how to delete it. Clew is built so that your schedule stays with you.

1. Google user data Clew accesses

You can use Clew without Google, by signing up with your email. If you choose to sign in with Google or connect Google Calendar, Google asks you to allow these permissions, and Clew accesses only the following data:

Basic profile (scopes openid, email, profile): your name, email address, profile picture and Google account ID.
Google Calendar, read-only (scope calendar.readonly): the list of your calendars (their names and IDs), and for the calendars you choose to sync, each event’s title, start and end time, description, location and its link back to Google Calendar.

Clew cannot create, change or delete anything in your Google account. It does not access your Gmail, Google Drive, contacts or any other Google data.

2. How Clew uses Google user data

Clew uses Google user data only to provide the planner’s features to you:

your name, email and picture to show who is signed in, and your Google account ID to keep each person’s planner separate;
your calendar list so you can choose which calendars to show and how each is used (for example, “Assignments”);
your events to show them in your week and month views, and to turn assignments from your school system’s calendar into tasks with due dates you can check off.

Clew does not use Google user data for advertising, does not sell it, and does not use it for any purpose other than providing and improving the planner’s features you use.

No AI or machine learning training. Clew does not use, retain or transfer data obtained through Google Workspace APIs (including the Google Calendar API) or any other Google APIs to develop, improve or train generalized or non-personalized artificial intelligence or machine learning models. Clew does not use your Google user data to train any AI or machine learning model at all.

Clew’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. Where your data is stored

Your calendar content stays on your device. Clew reads your calendar from Google directly in your browser and keeps a copy in your browser’s local storage, so the planner loads quickly. Event and assignment titles, descriptions and locations are never sent to or stored on Clew’s servers. The only exception is the due times of assignments you get reminders for, as described under Reminders below.

Your Clew account. If you sign up with your email, or choose to save your planner to your Clew account after signing in with Google, the following is stored in your account so your planner is the same on every device:

the tasks and events you create yourself in Clew;
your categories, classes and settings, including the ID of each Google calendar and how you’ve set it up (for example, “Assignments”);
your changes to synced assignments, such as marking one done or giving it a class. These are stored with Google’s ID for the assignment only, never its title or other content;
your email address, your Google account ID if you signed in with Google, and when you last opened Clew.

If you sign in with Google and don’t save your planner to a Clew account, everything stays in your browser only.

Reminders. Reminders are off until you turn them on in Settings, and they need a Clew account. When they’re on, your Clew account also stores your upcoming reminders: when each should arrive and what it says.

For tasks you add yourself, that’s the task’s title, due time and class.
For assignments from Google Calendar, it’s only “An assignment is due” with the due time and the class you gave it, never the assignment’s title, description or other details. The due time comes from your Google Calendar, so it is Google user data, and it is used only to send you the reminder.
For each device you turn notifications on for, the push address your browser creates for that device.

Clew works out your reminders in your browser and saves only this list. Finishing or deleting a task removes its reminders.

Google sign-in tokens. When you sign in with Google, Clew’s server trades the one-time sign-in code from Google’s popup for two tokens. The access token, which reads your calendar and expires within an hour, goes to your browser and is kept only in the open tab’s memory; it is never saved to your device or sent anywhere except to Google. The refresh token lets Clew get a new access token when the old one expires, so your calendar keeps syncing without signing in again every hour. It is encrypted (AES-256-GCM) and stored on Clew’s server, readable only by Clew’s server and never sent to your browser. It gives the same read-only calendar access you approved, and is used only to get new access tokens when your planner syncs. No calendar content is stored with it.

We do not sell, rent or trade your data, and we do not share, transfer or disclose Google user data to anyone except as described here:

Supabase (database and sign-in provider) stores Clew account data as described in section 3, including your Google account ID, calendar IDs and assignment IDs. It also sends sign-in code emails.
Vercel (website hosting) serves the Clew website and app. Your calendar content does not pass through Vercel.
Your browser’s push service (Apple, Google or Mozilla, depending on your browser) delivers reminders to your devices if you turn them on. Each reminder is encrypted before it leaves Clew’s server, so the push service passes it along without being able to read it.

These providers process data only on our behalf, to run Clew, and may not use it for their own purposes. We may also disclose data if required by law, or to protect against fraud, abuse or security threats. If Clew were ever merged or acquired, we would tell you before your data became subject to a different privacy policy. No one at Clew reads your Google user data unless you ask us to (for example, to help with a problem), it is needed for security reasons, or the law requires it.

5. How we protect your data

We treat Google user data and account data as sensitive data and protect it with these measures:

Encryption in transit: every connection between Clew, Google and our providers uses HTTPS (TLS).
Encryption at rest: Clew account data is stored with Supabase, which encrypts stored data with AES-256.
Data minimisation: your calendar content is never stored on our servers (reminders for assignments keep only a due time, never the assignment itself), and Clew requests read-only calendar access only.
Protected Google tokens: Google’s access token is kept in memory only, expires within an hour, and is never stored. The refresh token is encrypted with a key that only Clew’s server holds, is stored where only the server can read it, and never reaches your browser. No secret keys are included in the app.
Access control: our database enforces row-level security, so a signed-in person can read and change only their own data and requests without a valid sign-in can read nothing. Only Clew’s maintainer has administrative access to our hosting and database, and only to operate the service.
No passwords: Clew signs you in with a one-time email code or with Google, so there are no passwords to steal.
Browser protections: the app only runs code from Clew and Google’s sign-in service (enforced with a Content Security Policy), which helps stop malicious scripts from reading your data.

No system is perfectly secure. If we learn of a security incident that affects your data, we will notify affected users by email without undue delay.

6. Data retention and deletion

Calendar data in your browser is kept until you sign out and remove it, or clear your browser’s site data. Synced events are refreshed from Google on each sync, and events you delete in Google disappear from Clew on the next sync.
Google’s access token is discarded when you close the tab, and expires within an hour.
Google’s refresh token is kept until you sign out (which also ends Clew’s access to your Google account), delete your Clew account, or remove Clew’s access in your Google Account, after which it is deleted the next time Clew tries to use it.
Clew account data is kept for as long as you have a Clew account, so your planner is there when you return.
Reminders are deleted 7 days after they are sent. Turning reminders off deletes all upcoming ones. Turning notifications off on a device, or signing out there, deletes that device’s push address.
Finished tasks stay until you delete them, or, if you turn on auto-delete in Settings, until the number of days you choose has passed since you marked them done.
Contact-form messages are kept only as long as needed to reply to you.

You can delete your data at any time:

In the planner, open the account menu and choose Sign out and remove my data from this device. This deletes everything Clew stored in that browser, including your calendar data.
If you have a Clew account, choose Delete my Clew account in the account menu. This immediately and permanently deletes your account and everything stored in it from our database.
Remove Clew’s access to your Google account at any time on your Google Account permissions page. Clew then can no longer read your calendar.
Or ask us to delete your data through the contact form or by email at clewplanner@gmail.com, and we will do so within 30 days.

7. Other data: Clew accounts and the contact form

We use your email address only to sign you in and, if needed, to contact you about your account or this policy, never for marketing. Other Clew users can never see your account. We don’t show ads or use advertising or analytics trackers.

If you send a message through the contact form, your name, email address and message are delivered to Clew’s maintainer by email using the email service Resend. They are used only to reply to you and are not added to any mailing list.

Like any hosting provider, Vercel and Supabase may briefly log technical details of requests, such as IP addresses, for security and reliability.

8. Children

Clew is meant for students who are old enough to have their own Google account. If you are under 18, please check with a parent or guardian before using it. We don’t knowingly collect information from children under 13. If you believe a child under 13 has given us data, contact us and we will delete it.

9. Changes to this policy

When this policy changes, we update the date at the top of this page. If we change how Clew accesses, uses, stores or shares Google user data, we will tell you in the app and by email before the change takes effect, and ask for your consent where required.

10. Contact

Questions about privacy, or a request about your data? Use the contact form or email clewplanner@gmail.com.