Privacy Policy

This Privacy Policy covers the Just In Time macOS application ("the app") and this website. It explains what the app accesses, why, where it goes, how long it is kept, and your rights.

The data controller (in Israeli law, the database owner) is Michael Milstein, Tel Aviv, Israel. Just In Time is run by an individual, not a company. For any privacy question or request, contact michael.milstein10@gmail.com.

The beta. Just In Time is currently a beta, available to testers we approve individually and, from the Mac App Store, to anyone in the countries where it is offered. It is not offered in the European Economic Area or the United Kingdom for now. There is no charge during the beta, so we hold no billing or payment data. If that changes, this policy will be updated before any such data is collected.

Just In Time connects to Google Calendar using the https://www.googleapis.com/auth/calendar.readonly OAuth scope, which is read-only. The app never creates, edits, or deletes anything on your calendar. It asks Google only for the following fields, and nothing else:

• From your list of calendars: each calendar's name, identifier and display colour, so you can choose which ones to follow. The identifier of your primary calendar is your Google account email address; it is shown in Settings so you can see which account is connected.
• From the calendar you choose: event titles, start and end times, descriptions, locations, video-call links, attendees (name, email address, RSVP status, and whether the entry is you), the event type, the identifier of the recurring series an event belongs to (if any), the identifier shared by copies of the same meeting on different calendars (so a meeting that appears on two of your calendars is alerted once), and who organized it (the organizer's email address, and whether that is you), for events in roughly the next day and a half.

This is used only to show you your upcoming meetings: in the menubar, in the soft-nudge alert, and in the full-screen hard-block alert, and to keep your punctuality record on the Stats page. Meeting details are held in the app's memory while it runs and are never transmitted anywhere; the punctuality record keeps only times (see Section 3).

Google API Services User Data Policy. Just In Time's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, your Google user data is:

• used only to provide the app's meeting alerts and punctuality stats to you;
• never sold, and never used for advertising;
• never used to develop, improve, or train generalized artificial-intelligence or machine-learning models;
• never read by a human; and
• never sent to Sentry, Aptabase, or any server of ours.

Just In Time has no backend server. The following is stored on your Mac, and only there. Your calendar choice and punctuality record are kept separately for each Google account you sign in with, in a file of their own named after a fingerprint of the account's email address; the address itself is stored inside that file, so the app can list it for you in Settings. Signing in with a second account starts a second record, and the first one is left as it was.

• Your Google OAuth refresh token, encrypted using macOS Keychain (via Electron's safeStorage) before it is written to disk.
• Your settings, and, for each Google account, which calendars you chose (their identifiers, which for your primary calendar is your email address).
• Your meeting exceptions and rules, for each Google account: which meetings or recurring series you chose not to be blocked for (stored with the meeting's title and start time so the list in the app is readable), and any rules you set up (for example, by title, attendee, or time of day). They stay on your Mac and are never sent anywhere; only anonymous counts of how often they are used are sent (see Section 4).
• The people you have met, for each Google account: the email addresses and display names of other attendees on your recent meetings, how many meetings you shared, and when you last met, so the rule editor can suggest them. It keeps at most 500 people, deletes anyone you have not met for 90 days, and is erased when you sign out. People you've met are listed on your Mac to suggest rules. They are never uploaded.
• A record of which alerts have already fired or been snoozed, stored by Google event identifier. It contains no titles or other event details.
• Your punctuality record, which powers the Stats page and the weekly summary: for each meeting, its start and end time, whether it had a video-call link, and how you answered its alert — when you joined and how (from the app, another device, the meeting room or in person), whether you said you were on your way or not going, whether you snoozed it, and your check-in answer if you gave one. It also keeps the date the record began and your best streak. It contains no titles, attendees, links or other event details, is never sent anywhere, and entries older than 90 days are deleted automatically.
• A random install identifier (see Section 4).
• A diagnostic log file. It records what the app did and when, and a summary of every report the app sends. It does not contain meeting titles or other calendar content. It is capped at 2 MB, after which older entries are discarded.

If a future version introduces server-side functionality, this policy will be updated first and you will be notified in the app.

Crash reports (Sentry). When something goes wrong, the app sends a crash report containing the error, a stack trace of our own code, which part of the app it came from, your app, macOS and Electron versions, your CPU architecture (Intel or Apple silicon), and your time zone. Alerts run on local time, so the time zone often explains an alert at the wrong moment. Reports do not include your computer's model, hardware details, or hostname. Before a report leaves your Mac, quoted text, email addresses, links, and your macOS account name are masked in the error message. The app never uploads a memory dump, because memory can hold calendar content.

Crash reports carry a random identifier generated on your Mac. It is not derived from your Google account, your email address, or your computer, and it lets us tell that four crashes came from one install rather than four. Because it links reports from the same install, crash reports are pseudonymous rather than anonymous.

Usage signals (Aptabase). The app sends fixed labels describing how it is used, for example that an alarm fired, that a snooze was used, or that a calendar sync failed. Each signal contains the event name, a few fixed labels, your app and macOS version, your system language setting, the Chromium and analytics-library versions, a timestamp, and a session number that resets after an hour of inactivity. Signals carry no install identifier. No meeting title, description, attendee, email address, or calendar identifier is ever included, under any setting.

Some signals also carry a few numbers about how the app is used: how many days ago it was installed, and, once a day, how many meetings you have that day and whether full-screen blocking is switched on. When you join a meeting, or tell the app how you are joining (another device, the meeting room, in person, or on your way), the signal says which screen you answered on, which of those it was, and how many minutes early or late — not which meeting it was, its link, or its start time. When you say you are not going, the signal names only the screen. When you open the Stats page, the signal says whether you looked at the week or the month, never the numbers on it. When you change a setting, the signal names the setting, not what you changed it to. When you use meeting exceptions or rules, the signal says only that one was set, removed or created, which screen it came from, and how many conditions a rule has — never a meeting title, a person, a time or the rule itself.

Version checks (our website). When it starts and about every six hours, the app downloads a small file from our website to find out whether your version is still supported. It sends no identifier, no account information, and nothing about your calendar. If a version is being retired, the app warns you well in advance. If our website cannot be reached, the app carries on working normally. The version installed from the Mac App Store does not make this request.

Updates (GitHub). When it starts and about every six hours, the app checks GitHub for a newer version. When one is available, it downloads it and installs it the next time you quit the app. These requests send nothing about you or your calendar. The version installed from the Mac App Store does not check GitHub: Apple delivers its updates, under Apple's own privacy policy.

IP addresses. Like any internet connection, each of these requests reveals your IP address to the service receiving it. We have configured Sentry not to store IP addresses, and we do not use IP addresses to identify you.

You can verify this yourself. Every report the app sends is also recorded in the local log file, reachable from the menubar via Reveal Logs… and from the Diagnostics section of Settings.

We use these service providers, and only these:

• Sentry: crash reports. Data is stored in the European Union. See Sentry's privacy policy.
• Aptabase: usage signals. Data is stored in the European Union. See Aptabase's privacy policy.
• Netlify (United States): hosts this website and the version-check file. See Netlify's privacy policy.
• GitHub (United States): hosts app downloads and updates. See GitHub's privacy statement.

None of them receives your calendar data or your email address. We do not sell your data, use advertising networks or cross-site trackers, record your screen, or make automated decisions or profiles about you.

• Meeting data: held only in memory, and discarded when you quit the app or disconnect your calendar. The exception is your punctuality record (Section 3), which keeps only meeting times and is deleted automatically after 90 days.
• Disconnecting (menubar or Settings) revokes the app's access at Google and deletes from your Mac the stored token and the record of fired and snoozed alerts. Your stats and calendar choice stay, for when you reconnect. To remove them, use Forget this account in Settings, which deletes that account's stats and calendar choice from your Mac, or Delete all data… in the Privacy section of Settings, which deletes every account's data, your settings and the log file from your Mac, and restarts the app. Neither removes the Keychain item or the system caches listed under Uninstalling below. You can also remove the app's access at any time from your Google Account permissions.
• Crash reports: deleted automatically by Sentry after at most 90 days.
• Usage signals: carry no identifier that could tie them to you, so they are kept in aggregate for as long as we develop the app.
• Log file: stays on your Mac. If you choose to send it to us for support, we use it only to fix your issue and delete it within 30 days.
• Uninstalling: deleting the app from Applications does not remove its data. Use Delete all data… in Settings first, or disconnect your calendar and delete these yourself: ~/Library/Application Support/JustInTime, ~/Library/Logs/JustInTime, ~/Library/Preferences/com.justintime.app.plist, ~/Library/Caches/com.justintime.app*, and the Keychain item "JustInTime Safe Storage" (in Keychain Access).

To ask us to delete crash reports linked to your install, email us the install identifier, which is shown in the Diagnostics section of Settings, and we will act on it within 30 days.

• Reading your calendar is necessary to provide the service you asked for, which is alerting you before your meetings. You are not legally required to provide this access, but the app cannot work without it.
• Crash reports and usage signals are how we find failures that are otherwise invisible, above all an alarm that never appears. We rely on our legitimate interest in keeping the app working. Both are on by default, and you can switch either off in Settings at any time, independently, with immediate effect. Switching them off does not affect how the app works for you.
• Version checks are how we reach you if a released version turns out to be unsafe to keep using. They carry no identifier and cannot be switched off.

You can ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct inaccurate or incomplete data;
• delete your data, including data held by the service providers above;
• restrict our processing of it.

You can also object to crash reports and usage signals directly, without contacting us, by switching them off in Settings. Email michael.milstein10@gmail.com for anything else; we reply within 30 days.

Israel. Under the Protection of Privacy Law, 5741-1981, you have the right to review the information about you held in our database and to request that it be corrected or deleted if it is inaccurate, incomplete, unclear, or out of date. If you are not satisfied with our response, you can complain to the Privacy Protection Authority.

Elsewhere. If you live in a country or state with its own privacy law, you have the rights that law gives you, and you may complain to your local data protection authority. We do not sell or share personal information for advertising, and we do not treat anyone differently for exercising their rights.

We protect personal data under our control using reasonable measures: the token is encrypted with macOS Keychain, all network traffic uses HTTPS, and diagnostic reports are scrubbed before they leave your Mac. No system is perfectly secure, but we use reasonable efforts to prevent misuse, loss, or alteration.

Because your settings and token live on your Mac rather than on our servers, the strongest protection available to you is your device itself. Use a password or Touch ID and keep FileVault turned on.

We are based in Israel. Crash reports and usage signals are stored in the European Union. Netlify and GitHub are based in the United States, and receive only the request details described in Section 4. Any transfer abroad is made only as applicable privacy law permits.

This website currently sets no cookies and runs no analytics or advertising trackers. If that changes, we will update this section first.

Just In Time is intended for adults aged 18 or over, and is not directed at children. We do not knowingly collect personal data from children. If you believe a child is using the app, contact us and we will delete any related data.

We may update this policy to reflect changes in the law, in the app, or in how we handle data. We will update the date at the top of this page and, for material changes, notify you in the app before they take effect.

Questions: michael.milstein10@gmail.com.