Privacy Policy

Last updated: 22 August 2026

This policy is for people who sign in to Tukio and connect a Google account. Visitor-only event pages are covered by the visitor privacy policy.

Tukio is operated by Regolith GmbH, Schottenfeldgasse 8/5, 1070 Vienna, Austria. Contact: hello@tukio.xyz.

Tukio’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data

When you sign in with Google, Tukio requests these scopes only:

• openid, profile, and email — to create your account (name, email, profile photo)
• https://www.googleapis.com/auth/calendar.readonly — to list calendars you can access
• https://www.googleapis.com/auth/calendar.events.readonly — to read events on the calendar you link to a page

We do not currently request Google Drive access or any write access to your calendar.

How we access it. You authorize Tukio through Google’s OAuth consent screen. We store Google access and refresh tokens so we can keep your public event page in sync after you leave.

How we use it. We use Calendar data only to provide Tukio’s user-facing features: you pick a calendar, we publish an event page from that calendar, and visitors can view those events. We do not use Google user data for advertising, credit scoring, or selling insights.

How we store it. We store your Google account identifiers and tokens, the calendar you linked (calendar_id and calendar metadata), and a cached copy of events for that page so the public site can load without calling Google on every visit. Tokens live in our database on hosted Postgres (Supabase).

How we share it. Events you publish on a Tukio page are public to anyone with the page URL (and on a custom domain, if you set one). We do not sell Google user data. We do not transfer Google user data to other apps except the processors below, and only to run Tukio.

Limited Use. Google user data is used only to provide or improve user-facing features that are visible in Tukio. We do not allow humans to read this data unless you ask us to, it is required for security or legal reasons, or the data is aggregated and cannot identify you.

Other information we collect

• Account. Name, email, and profile photo from Google sign-in.
• Pages you create. Name, subdomain or domain, branding, tags, and settings.
• Payments. If you subscribe, Stripe processes the card. We store a Stripe customer id and subscription status, not full card numbers.
• Usage. Page views and product actions via analytics (for example Mixpanel or PostHog). We use this to fix bugs and improve Tukio, not to advertise with your Calendar data.
• Support mail. If you email us, we receive whatever you send.

Processors

We use vendors only to operate Tukio:

• Google — sign-in and Calendar APIs
• Supabase — database
• Vercel — hosting
• Stripe — subscriptions
• Resend — transactional email
• Sentry — error reports
• Mixpanel / PostHog — product analytics
• Uploadthing — files you upload (logos)

Each vendor processes data under its own terms.

Your choices

• Disconnect Tukio in your Google Account permissions. We will no longer be able to refresh your calendar.
• Delete a page in Tukio to remove that page and its cached events.
• Email hello@tukio.xyz to delete your account and associated Google tokens. We will delete or anonymize personal data unless we must keep a record for tax, billing, or law.
• Opt out of marketing email using the link in the message. We do not send marketing that uses your Calendar contents.

Retention

We keep account, token, page, and cached event data while your account is active. After a deletion request, we remove Google tokens and personal account data within 30 days, except records we are legally required to keep (for example invoices).

Security

We use HTTPS, restrict staff access, and store tokens in our database rather than in the browser. No method is perfectly secure.

Children

Tukio is not directed at children under 16.

Changes

We will update the date at the top when this policy changes. Material changes will be noted on tukio.xyz.

Contact and GDPR

Regolith GmbH is the controller for Tukio personal data. You may request access, correction, deletion, or a copy of your data, or object to processing, by writing to hello@tukio.xyz. You may also complain to the Austrian Data Protection Authority (Datenschutzbehörde).