Privacy Policy

What we process

• Connection data for integrations you choose to connect.
• Task and calendar metadata needed for app features, such as title, due date, source, and completion status.
• App settings and focus preferences.
• Ad consent choices and ad delivery data.
• Birth month and year stored on your device to determine age-appropriate ad eligibility. Nonlate does not send this value to advertising providers.
• Diagnostic data for reliability, such as crash reports.

Google user data

If you choose to connect a Google integration, Nonlate requests only the read-only Google scopes needed to import your deadlines and keep them updated. Depending on the Google service you connect, Nonlate may access the following Google user data:

• Google Classroom: active course identifiers, course names, sections, rooms, coursework titles, coursework descriptions, due dates, due times, links, work types, maximum point values, your submission status for coursework, and your Google Classroom email address or profile identifier for account matching.
• Google Calendar: calendar list metadata, such as calendar identifiers, names, selection status, primary status, and access role, plus events from synced calendars in the sync window, including event identifiers, summaries, descriptions, locations, statuses, links, start and end dates or times, time zones, organizer names or email addresses, and the calendar/account identifier used to route sync updates.
• Google Tasks: task list identifiers, task list names, task identifiers, task titles, notes, due dates, and completion status for incomplete tasks.
• Google OAuth data: access tokens, refresh tokens, token expiration times, provider account identifiers, and webhook or channel identifiers needed to sync connected Google services and deliver update notifications.

Nonlate uses Google user data only to sync connected Google Classroom, Google Calendar, and Google Tasks items into Nonlate, show reminders and focus features for those items, maintain the connection you requested, and support disconnect or deletion requests. Nonlate does not create, edit, or delete your Google Classroom, Calendar, or Tasks content. Nonlate does not sell Google user data, use it for advertising, or use it to develop, improve, or train generalized AI or machine learning models.

Nonlate’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we use this data

• Sync tasks and events from connected services.
• Show reminders and focus features.
• Serve ads and apply privacy choices for ad-consent data. Google user data is not used for advertising.
• Keep the app reliable and secure.

Advertising and privacy choices

Eligible adults using the free version of Nonlate may see compact native ads provided by Google AdMob. Ad personalization is optional. Where applicable, Nonlate asks for your advertising privacy choice only after you have used the app for a period of time rather than during onboarding.

• If you allow personalized advertising, Google may use permitted advertising identifiers and consent information to select ads.
• If you decline personalization, or applicable rules require it, Nonlate may request non-personalized or limited ads when Google’s consent system permits them.
• Paid users, users whose age is unknown, and users identified as under 16 do not receive ads or an advertising-personalization prompt from Nonlate.
• On iOS, Nonlate may show Apple’s tracking-permission prompt after an explanation when that permission is relevant. Declining that permission does not prevent you from using the app.
• Where required, you can review or change available advertising choices from the Ad privacy choices item in app settings.

Google user data imported through connected Google services is never used for advertising. For more information about how Google processes advertising data, see Google’s advertising privacy information.

Data protection

• Data in transit is sent over HTTPS/TLS.
• Google OAuth tokens stored on Android are kept in EncryptedSharedPreferences backed by the Android Keystore, using AES-256 key and value encryption schemes.
• Google OAuth tokens stored on iOS are kept in the Apple Keychain with this-device-only access while the device is unlocked.
• When the Nonlate OAuth proxy must retain tokens or webhook secrets for realtime sync, those secrets are encrypted at rest with AES-256-GCM before database storage in production.
• Synced task and calendar data is stored in app storage protected by the operating system sandbox. Production access to server-side systems is limited to authorized service providers and personnel who need access to operate, secure, or support Nonlate.
• Disconnecting a Google integration removes the stored Google OAuth credentials for that integration from the app, and Google token revocation is attempted where supported. You may also request deletion by email.

Sharing

Data may be shared with providers you connect and service providers needed to run the app, such as hosting, database, notification, crash-reporting, ads, and consent tools. Google user data is shared only as needed to operate connected Google sync features and is not shared with advertising providers. We do not sell personal data.

User controls

• Disconnect integrations in app settings.
• Review available advertising privacy choices in app settings.
• Uninstall the app to remove local app data on your device.
• Request data deletion by email.

Contact

For privacy requests, contact support@nonlate.app.