PRIVACY
POLICY.

01. Scope & operator

Iron Psalter Release Command (“Release Command,” “we,” or “the application”) is an independently operated, private planning tool for the Iron Psalter music project. Its public informational pages are separate from its authenticated publishing dashboard.

This policy applies to information handled by Release Command, including data obtained through Google's OAuth and Calendar APIs. It does not cover the independent privacy practices of Google, Vercel, or Supabase.

02. Information the application processes

• Account information: account email address and authentication information used to restrict access to the dashboard.
• Publishing information: album and song plans, due dates, task completion statuses, release notes, and related production records entered in the application.
• Google authorization information: OAuth refresh tokens, granted permission scopes, and connection metadata used to maintain authorized calendar synchronization.
• Calendar synchronization information: event titles, descriptions, dates, reminder settings, event IDs, and sync status for managed publishing events.
• Technical information: necessary authentication sessions, locally saved app state, and hosting or security logs generated in operating the service.

03. Google Calendar data

When an authorized user connects Google Calendar, Release Command requests the https://www.googleapis.com/auth/calendar.events.owned permission. This permission allows the application to view and manage events on calendars owned by the signed-in Google user.

The application uses that permission only to verify access to the user's selected calendar and to create, update, or delete events corresponding to publishing tasks under the application's management. It reads event metadata as needed to distinguish managed events from unrelated calendar entries and avoid duplicates.

The application does not use this permission to access Gmail, Google Drive, Google Contacts, or other Google services. Calendar information is not used to profile users or target advertising.

Limited Use: Use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including its Limited Use requirements.

04. Why information is used

Information is used to authenticate authorized users, save and restore their release plans, calculate publishing schedules, synchronize user-approved deadlines, prevent duplicate Google Calendar events, report synchronization status, and troubleshoot application failures.

Release Command does not sell Google user data, use it for advertising, or use it to train generalized artificial intelligence models.

05. Providers and disclosures

Release Command uses Supabase for authentication and private application records, Vercel to host the website and secure server functions, and Google Calendar to store events when synchronization is enabled. These providers process data to deliver their respective services.

We do not disclose Google user data to advertisers or data brokers. Information may be disclosed when required by applicable law or necessary to protect the security and integrity of the service.

06. Security and retention

The private dashboard requires authentication. Google refresh tokens are stored encrypted on the server; they are not intended to be exposed in browser-readable application data. Publishing records and event mappings are stored with user-specific access controls. We apply reasonable measures to limit access to sensitive information, but no online system is entirely risk-free.

Publishing records and authorization metadata are retained as needed to operate the service until deleted or otherwise removed. Revoking Google authorization prevents new authorized Calendar operations, but does not necessarily delete already synchronized events, existing publishing records, or stored authorization metadata automatically. A user may request their data be removed.

07. User controls

Authorized users can edit project data, change task dates and statuses, and disable automated synchronization. They can revoke access from their Google Account's third-party connections page. Existing events can also be managed directly in Google Calendar.

To request correction, access to, or deletion of stored application records or Google authorization data, contact the application operator using the user-support email address identified on its Google OAuth consent screen. Removing stored data may require manual administrative action.

08. Contact & updates

For privacy, access, or deletion questions, use the Iron Psalter Release Command user-support contact shown on the Google OAuth authorization screen. For general information, visit the public Release Command information page.

This policy may change when features, hosting arrangements, or data practices change. Updates will be published at this URL with a revised effective date.