Privacy policy

Effective date: November 8, 2026

This policy explains what data Noonbell collects, why, how we keep it, and how you can delete it. It applies to the Noonbell service at noonbell.app and the Noonbell web app ("Noonbell", "we", "us").

If you run Noonbell on your own server (self-hosted), your data stays on your server. We do not receive it, and this policy does not apply to it. The person or business that runs that server is responsible for it.

Who uses Noonbell

• Businesses and their staff sign up, set up services and working hours, and can connect a calendar.
• Clients of those businesses book appointments. For client data, the business decides what to collect and why. We process it for the business, to run the booking.

Noonbell is not for healthcare. Do not put protected health information into Noonbell.

Data we collect

• Account data: your name, email address and password. We store a hash of the password, not the password. If you turn on two-factor sign-in, we store its secret encrypted.
• Business data: the workspace name, services, staff, working hours, settings, team invites and API keys. We store a hash of each API key, not the key.
• Booking data: the client's name, email address, phone number (if given), the service, the staff member and the time.
• Calendar data: see the Google Calendar section below.
• Technical data: server logs such as IP address, time and requested page, used to run and secure the service, and an audit log of changes inside each workspace.

We use one sign-in cookie to keep you signed in. We do not use advertising or analytics cookies, and we do not use tracking scripts.

Google Calendar data

A staff member can choose to connect a Google account to Noonbell. Noonbell then asks Google for these two permissions:

• https://www.googleapis.com/auth/calendar.calendarlist.readonly: to show the list of your calendars, so you can choose which ones count as busy and which one gets new bookings.
• https://www.googleapis.com/auth/calendar.events: to read when you are busy on the calendars you choose, and to add, change and remove the events for bookings made in Noonbell.

What we read and store

• The email address of the connected Google account.
• For each calendar: its ID, name, time zone and color.
• For events on the calendars you mark as busy: the event ID, start time, end time and status. We use this only to remove times you are busy from your booking page. We do not store event titles, descriptions, locations or guest lists.
• The access and refresh tokens Google gives us, so we can keep your calendar in sync.

What we write

When a client books, reschedules or cancels, Noonbell adds, changes or removes one event on the calendar you chose. The event shows the service, the client's name and the time.

How we use Google data

We use Google user data only to provide and improve the booking and calendar features that you can see in Noonbell. We do not use it for advertising. We do not sell it. We do not use it to train or improve AI or machine learning models. We do not share it with anyone, except as needed to provide those features, to follow the law, or as part of a merger or sale of Noonbell with notice to you. People at Noonbell do not read it unless you ask us to (for example, for support), it is needed for security, or the law requires it.

Noonbell's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Removing Google access

On your staff page in Noonbell, choose Disconnect. This deletes the connection, its tokens, the calendar list and all stored busy times right away. Events that Noonbell already added stay in your Google Calendar, because they are yours. You can also remove Noonbell's access at any time on your Google Account permissions page.

How we keep data safe

• All traffic uses HTTPS.
• Calendar tokens and two-factor secrets are encrypted with AES-256-GCM before we store them. They are not written to logs.
• Each business's data is kept apart in the database by row-level security.
• The audit log records changes and cannot be edited. It never stores tokens, passwords or keys.

Service providers

We use these companies to run Noonbell. Each one gets only the data it needs for its job.

• Railway: hosts the app and the database.
• Cloudflare: domain, network and sending email such as confirmations and reminders.
• Google: calendar sync, if you connect Google Calendar.

How long we keep data

• Account, business and booking data: while the account is open.
• Google Calendar data: until you disconnect, or until the account is deleted.
• Reminder emails stop when a booking is cancelled or has passed.

Your choices and deleting data

You can see and change your business data in Noonbell. To get a copy of your data or to delete your account and its data, email privacy@noonbell.app. We will delete it within 30 days, except where the law requires us to keep it. Clients of a business should contact that business first.

Children

Noonbell is a tool for businesses and is not for children under 13.

Changes

If we change this policy, we will update the date above. If a change affects how we use Google user data, we will tell connected users before it takes effect.

Contact

For privacy questions or requests, email privacy@noonbell.app.