WeTimes Privacy Policy

Effective date: October 23, 2026

NimbleClear (Korean business name: 님블클리어; the "Service Provider") operates WeTimes for users in different countries. Applicable privacy rights depend on your location and the processing involved. This Privacy Policy explains what personal information the shared calendar app WeTimes (the "App") processes, why, for how long, and how it is shared, transferred and protected.

1. Information We Process

Required

The following is needed to provide accounts, shared calendars and event notifications.

Optional or feature-dependent

The following is processed only when you use the feature or give consent. The basic calendar features work without it.

Content reports and safety

Calendar owner requests retain the sender identifier, request and reply text, content recorded at submission, and handling status. Only the sender and the calendar’s current owner may view them; a new owner takes over after ownership transfer. A sender who leaves or is removed loses access to calendar requests. These requests are separate from reports to the service operator.

Related photos or attachments selected when reporting content or notifying the owner may be copied into private R2 storage for review after the original is edited or deleted (up to 3 files totaling 50 MB per submission). General inquiries do not automatically copy original files. Service-report evidence is available only to authorized service operators; owner-request evidence is available only to the sender and current calendar owner. Access lasts up to 90 days from submission, followed by asynchronous deletion of files and records. Preservation may fail if originals have already expired or been deleted, or copying fails; the status is shown. Viewing or replying does not extend retention. These copies do not count toward personal or shared plan storage.

When you report a calendar, event or comment, we process your account identifier, the target identifiers, reason, optional explanation, necessary text and metadata recorded at submission, and review/action/notification records. Authorized operators may inspect related photos and files that remain available when necessary to review a report. We do not disclose the reporter’s identity to the reported person or other members. Report and action records have a 90-day retention period from submission, followed by asynchronous deletion. Rate-limit records expire two days after their last update. Separate legal retention obligations, where applicable, take precedence.

Operator email notifications contain only the report reference, category, time and administration link, not original content, photos or the reporter’s identifier. Following review, we may remove content or restrict access. You may contact nimbleclear@gmail.com with questions or appeals.

Bug diagnostics keep at most 30 error codes from the past 30 minutes in device memory and are sent only when you opt to attach them to a submitted request. Automatic diagnostics exclude calendar content, comments, emails and authentication tokens. You select screenshots explicitly; original image location metadata is removed before upload. Only the requester and authorized service operators can access in-app support requests.

Operators may ask the current calendar owner to address reported content and respond by a specified date without disclosing the reporter’s identity. Deleting a closed report initiates deletion of its records, actions, linked remediation request and retained evidence, without deleting original calendars or events. A content-free hashed identifier and expiry date may be kept for up to 90 days to prevent duplicate processing.

2. How We Use Information

• Sign-up, sign-in, identifying you and processing account deletion
• Shared calendars, events, attendance answers, comments and attachments
• Notifications about changes, invitations and comments, and event reminders
• Paid subscriptions and the free trial, purchase restoration, refunds and disputes
• Ads for free users
• Error analysis, abuse prevention and stability improvements
• Customer support and legal obligations

2a. Legal bases

Where applicable law requires a legal basis, we rely on performance of the service contract for core account/calendar functions; legal obligations; legitimate interests in security, diagnostics and abuse prevention balanced against your rights; or consent where required. For consent-based processing, you may withdraw consent through the available controls or by contacting us.

3. Sharing With Third Parties

Invitation Links and Previews on Other Services

To validate invitations, we process a token hash, the linked calendar and creator, permissions, expiration time and join count. The original token is stored on the creating device and processed when a link is requested. Daily IP hashes and request counts used to limit preview abuse become eligible for automatic deletion after approximately one day; deletion may be delayed by processing. Server and provider operational records are covered in Sections 4 and 5.

• Public information: Anyone with a valid invitation link can access the calendar name, inviter’s nickname, member count, invitation role and expiration information before signing in. These details are returned in the invitation page HTML or preview API response and may also be accessed by people receiving a forwarded link or services that fetch it. The link alone does not provide event titles, times, locations or notes, member lists or emails, comments, attachments or profile photos. Personal information entered into a calendar name or nickname may nevertheless be visible.
• Sharing outside WeTimes: When you send a link through KakaoTalk, another messenger, email or a social service, that service and the recipients receive the link. The service may automatically fetch and process the page to generate a preview, check security or provide its related features. Our preview tags contain the calendar name, app name and icon, and a generic invitation description. Other public invitation details may be present in the page response even when they are not displayed on the preview card.
• Joining and controls: A person receiving a forwarded link may join with the invitation’s permissions after signing in, verifying their email and confirming participation. Consider the recipients and channels you choose, and avoid putting information you do not want disclosed in calendar names or nicknames. Owners can disable or replace a link. Our service stops new invitation previews and joins through expired or revoked links. Revoking a link does not remove people who already joined.
• External copies: We return invitation HTML with a no-cache storage instruction, but cannot automatically erase previews retained by external services, forwarded messages, screenshots or other copies. Their processing purposes, locations, retention and deletion procedures are governed by their own policies. You may delete messages you shared or contact the relevant service about deletion. This does not limit our applicable data protection obligations or your statutory rights.

We process information for the purposes described in this policy. Calendar members can see your nickname, profile photo and shared events, responses, comments and files. The providers below process information to operate the Service; advertising providers may also process ad-related information according to consent and device settings. We may disclose information in response to lawful requests or where necessary to meet legal obligations and protect rights. We do not operate a business selling personal information for money. Where advertising disclosures qualify as a sale or sharing under local law, you may exercise applicable opt-out rights through available advertising privacy choices or by contacting us.

Optional place search and travel estimates

When you choose to search, your query is sent through our Firebase server to the provider selected by the app language: Kakao for Korean and Google Maps for other languages. When you request a travel check, we process the two selected place queries, identifiers and coordinates, travel mode and the scheduled departure time where needed. Driving requests go to Kakao Mobility; walking and transit requests go to Kakao. We do not collect device GPS/current location or send event titles, notes, participants, email addresses or account IDs to map providers. Personal information you type into a search query can be transmitted.

When a Max user expands a map, we resolve the selected place identifier or search query to coordinates, and the native map SDK on the device requests map content from Kakao or Google. The displayed coordinates or map area, IP address, and app, device and SDK technical information may be sent to the provider. Maps start collapsed and no map display request is made until expanded. Results are reused within the same screen, although interacting with the map may cause additional requests. WeTimes does not request GPS permission or transmit the device’s current location for this feature. The provider’s privacy policy also applies.

Your entered place label and selected place identifier are saved with the event, shared with calendar members and follow event retention/deletion rules. Provider addresses, coordinates and route results are processed temporarily, not stored in our database. Providers may retain operational/security records under their own policies. Account request-rate records prevent abuse, are replaced on subsequent requests and deleted upon account deletion. You can save a place as text without searching. For Google Maps travel checks, selected place identifiers, travel mode and departure time where needed are sent to Google Routes API. The Google Privacy Policy also applies to Google Maps features. External-LLM AI event analysis remains disabled.

Firebase App Check processes app/installation and device-integrity signals and attestation tokens to reduce automated abuse, using Google Play Integrity on Android and Apple DeviceCheck in supported Apple release environments. Development builds use separately registered test tokens. We do not include event content or GPS location in this verification.

4. Processors and International Transfers

The Service is intended for users internationally. The providers below may process information outside your country of residence. We use encrypted connections for transfers. Cross-border transfers require a lawful basis and safeguards under applicable law; contact us for information about the transfer arrangements that apply to your data.

Core account and calendar functions depend on their service providers. Processing for attachments, subscriptions and ads depends on the features used and applicable choices. See Section 6 for your rights and controls.

• Firebase privacy
• Cloudflare Privacy Policy
• RevenueCat Privacy Policy
• Google AdMob privacy

5. Retention and Deletion

Personal event order: To sync your preferences across devices, we store calendar IDs, dates, ordered event IDs and update times for your account. These preferences are private and are removed when you delete your account. Personal event order is retained for one year from the calendar date it applies to. After that, only the personal ordering preference becomes eligible for automatic deletion. Expired dates use the shared order; events and shared ordering are not deleted. Physical deletion may take additional time to complete. Your choice of personal or shared view is stored per account on your device.

Paid attachments: While subscribed, files are retained from upload for up to 1 year on Plus and 2 years on Max, including shared files. Cancelling renewal does not immediately end access. When attachment access (including a free trial) actually ends, new uploads stop. Files retained at that time remain available to view and download for 30 days from the end of access, then become eligible for automatic deletion. This grace period takes precedence over an earlier original file deadline. Resubscribing does not reset upload dates or shorten a download grace period already granted. Files are no longer accessible if you delete them or their calendar, or lose access permissions. This policy does not delete event or comment text. Physical deletion completes asynchronously. Shared files follow the current calendar owner’s Max access. Files retained when Max ends remain downloadable for 30 days, then become eligible for deletion. Pausing shared uploads alone does not end access. Resubscribing or transferring ownership does not reset upload dates or shorten an already granted grace period. Transferring a calendar with shared files requires the recipient’s acceptance, Max access and enough shared storage.

• Account deletion: After verifying a request, we begin deleting the account, profile, push tokens, attendance responses, comments and calendars used only by that account. Some processing, including related file cleanup, completes asynchronously. There is no 30-day recovery grace period or restoration by signing up again. Cancel store subscriptions separately.
• Shared records: Where possible, a calendar with remaining members is transferred to another member and kept. Events, attachments, some change records and the author’s account ID may remain as shared records. Names or other information typed into Content are not automatically removed by deleting an account; edit them before leaving or contact us.
• Calendar deletion: We do not provide a recovery grace period for deleted calendars and their related data. Save copies you need beforehand.
• Files: While subscribed, attachments have up to 1 year of retention on Plus or 2 years on Max and shared storage, subject to the 30-day download grace above. Comment photos have a separate 90-day period. Processing can depend on scheduled jobs and providers. The App displays applicable retention information.
• Operational and legal records: We retain operational records for their necessary purposes and delete expired records. We may retain limited records for legal obligations, disputes or abuse prevention. Where Korean electronic-commerce rules apply, relevant contract/payment records are retained for 5 years and consumer complaint/dispute records for 3 years. Records in other jurisdictions follow the applicable requirements and necessary retention periods.
• Providers and backups: Transaction records independently held by Apple, Google, RevenueCat or other providers may remain under their own legal obligations and policies. Restricted backup and security records may remain after active-system deletion until their retention cycles expire.

6. Your Rights

• Depending on applicable law, you may request access, correction, deletion, portability or restriction of processing, object to processing and withdraw consent. These rights do not apply identically to every location or activity.
• Edit your profile and Content in the App. Request deletion under Settings → My account → Delete account, or use our account deletion instructions.
• Manage notifications in app/device settings and advertising choices through the available privacy-options screen. Withdrawing consent does not affect processing that was lawful before withdrawal.
• Email nimbleclear@gmail.com. We may verify your identity to protect the account, and respond within applicable legal deadlines. We explain any lawful restriction or extension that applies.
• You may complain to your local data-protection or consumer-protection authority. If you are in the EEA or UK, you may contact the competent data-protection supervisory authority. Exercising a right will not result in unlawful discrimination.

7. Automatic Collection

The App and integrated SDKs use device/app identifiers and storage needed for authentication, diagnostics, notifications and advertising. Google AdMob and its consent tools process advertising settings. Where required, we provide consent and privacy choices. Declining personalization or resetting an advertising identifier does not stop every advertising or security-related processing activity. Access to tracking identifiers on iOS is subject to operating-system permissions and applicable law.

8. Children

The Service is not directed to children under 14. A higher local age requirement or parental-consent requirement also applies where required by law. If you believe we are processing information from a child who does not meet the applicable requirements, contact nimbleclear@gmail.com. After verification, we take appropriate steps such as restricting access or deletion. Before adding information about family members, ensure you are entitled to share it.

9. Security

• We apply reasonable safeguards including HTTPS transmission, provider storage encryption, membership and editing checks, and private file storage.
• Files are delivered through time-limited links issued after permission checks. Members may retain downloaded copies or share a still-valid link; consider this when sharing Content.
• Our error-reporting code is designed not to intentionally attach event titles, notes, emails or account IDs. SDKs may process technical device, app and crash information.
• No system offers absolute security. We investigate incidents and take protective and notification steps required by applicable law.

10. Privacy Officer

Privacy contact: NimbleClear
Email: nimbleclear@gmail.com

Including your country of residence and the nature of your request helps us identify the relevant process. Please do not send passwords or sensitive information that is unnecessary for your request.

11. Changes to This Policy

We update this policy as processing, features or legal requirements change. We publish the revision date and provide appropriate notice of material changes. Any notice period, consent or other protection required by applicable law takes precedence.

View WeTimes Terms of Service