Privacy Policy
Last updated: October 31, 2026
Summary: CubiPal is built on a local-first architecture. The CubiPal Desktop Companion App connects directly to your CubiPal hardware over your local Wi-Fi. We run no central cloud servers that store, process, or view your calendar events. Your credentials stay in your operating system's secure keychain, and your meeting data never leaves your home or office network.
1. Overview
This Privacy Policy describes how CubiPal ("we", "us", or "our") handles personal information when you visit our website (cubipal.com), sign up for our waitlist, or use the CubiPal Desktop Companion App with a physical CubiPal hardware device.
2. CubiPal Desktop Companion App & Calendar Integrations
The CubiPal Desktop Companion App (for Windows and macOS) allows you to sync your upcoming meetings and countdown timers to your CubiPal desk pet.
A. Information Accessed via OAuth
When you sign in with your Google Account or Microsoft 365 / Outlook Account, the app requests read-only calendar access:
- Google: Scope
https://www.googleapis.com/auth/calendar.readonly(View events on all your calendars). - Microsoft: Scope
Calendars.Readandoffline_access(Read user calendars and maintain access).
The application requests only the minimum data required to show upcoming events: meeting start time, end time, and meeting summary/title.
B. How Calendar Data is Used
- The app queries your connected calendar provider to identify your next upcoming events.
- The app transmits only the next two events directly across your local Wi-Fi network to your CubiPal hardware device via local HTTP.
- Your CubiPal displays visual countdown indicators on its eyes and sounds a reminder chime prior to your meeting.
- Private Mode: If you enable "Private Mode" in the app's settings, event titles are automatically replaced with the word "Busy" before transmission, ensuring event names are never sent to or displayed on the device.
C. Local Storage & Credential Security
- OAuth Tokens: OAuth refresh tokens are stored exclusively in your operating system's native secure credential vault (Windows Credential Manager on Windows, Apple Keychain on macOS). They are never saved to plain-text files or transmitted to CubiPal servers.
- Local Hardware Memory: The physical CubiPal device holds the next two events in volatile RAM. No meeting data is written to permanent flash storage, and all data is cleared whenever the device restarts or loses power.
- Revocation & Deletion: You can disconnect your calendar or unpair your device at any time through the app settings, which immediately purges all tokens from your OS keychain and removes cached events.
D. Google API Services User Data Policy Compliance
CubiPal's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:
- We do not transfer or disclose Google user data to any third party.
- We do not use Google user data for serving advertisements, retargeting, or personalized marketing.
- We do not use Google user data to train, fine-tune, or develop artificial intelligence (AI) or machine learning (ML) models.
- Human staff cannot view your calendar data; all transfers are strictly automated and localized between your computer and your local CubiPal device.
3. Website Visitors & Waitlist
When you visit cubipal.com:
- Waitlist Submissions: If you choose to enter your email address to join the CubiPal waitlist, we store your email address in a secure Cloudflare D1 database. We use your email exclusively to send major milestone announcements, testing opportunities, and launch notifications. We will never sell, rent, or distribute your email address to third parties.
- Cloudflare Turnstile: We use Cloudflare Turnstile on our sign-up form to prevent automated spam. Turnstile evaluates non-invasive browser signals without tracking cookies across the web.
- No Tracking Cookies: Our website does not use tracking cookies, cross-site trackers, or third-party behavioral analytics scripts.
4. Third-Party Services
We work with trusted infrastructure providers solely to host our website and facilitate calendar synchronization:
- Cloudflare: Hosts the
cubipal.comstatic site, Workers, and database. - Google APIs: Used by the desktop app when you authorize Google Calendar synchronization.
- Microsoft Graph: Used by the desktop app when you authorize Microsoft Outlook / 365 synchronization.
5. Data Retention & User Rights
Because calendar data is processed in real time and never retained on any cloud server, there is no cloud database of user meetings to delete. You retain complete control over your data:
- You may revoke calendar permissions at any time via your Google Security Settings or Microsoft Account Permissions.
- To request removal of your email from our waitlist, simply email us at the contact address below and we will permanently remove your record within 48 hours.
6. Changes to this Policy
We may update this Privacy Policy from time to time as new features are released. Any modifications will be posted to this page with an updated revision date.
7. Contact Us
If you have questions or concerns regarding this Privacy Policy or CubiPal's data practices, please reach out to: