Privacy Policy

Last updated: June 2026

The short version

KnotQ is local-first. Your workspace data stays on your device unless you choose to enable optional KnotQ account sync. Google Calendar access is optional and read-only. KnotQ uses Google Calendar data only to show your selected calendars inside KnotQ and keep those imported calendars up to date. Payments for optional sync subscriptions are handled by Lemon Squeezy.

Scope of this policy

This policy explains how KnotQ handles data in the KnotQ desktop and mobile apps, the KnotQ website, optional KnotQ account sync, and the optional Google Calendar integration.

Data storage

By default, schemes, folders, tasks, calendar entries, imported calendar entries, and settings are stored locally on your device in KnotQ's application data directory. If you enable optional KnotQ account sync, the workspace records needed to synchronize your workspace are transmitted to KnotQ's sync backend and associated with your KnotQ account.

Accounts and sync

If you create a KnotQ account, we store your email address, a password hash, account identifiers, authentication session metadata, and the workspace sync records needed to provide the service. We do not store plaintext passwords.

Authentication sessions use bearer tokens issued by the sync backend. You should keep those tokens private because they grant access to your synced workspace data until they expire or are revoked.

Payments and subscriptions

If you subscribe to optional KnotQ sync, checkout and billing are handled by Lemon Squeezy. KnotQ passes your account email address and internal account identifier to Lemon Squeezy checkout so a successful subscription can be associated with your KnotQ account. Lemon Squeezy processes payment details, billing information, taxes, invoices, subscription lifecycle events, and refund or chargeback handling under its own terms and privacy policy. KnotQ does not receive or store full card numbers.

Google Calendar data accessed

KnotQ offers an optional Google Calendar integration. The integration is read-only. KnotQ requests only read-only Google Calendar scopes and does not request permission to create, edit, or delete events in your Google account.

When you connect Google Calendar, KnotQ may access, collect, or interact with the following Google user data:

• Your Google account identifier and email address, so KnotQ can show which account is connected and match imported calendars to the correct account.
• OAuth access tokens, refresh tokens, token expiry times, and granted scope strings, so KnotQ can keep the read-only connection working without asking you to sign in every time.
• Calendar list metadata, including calendar IDs, names, display colors, selected or hidden state, deleted state, and primary-calendar status.
• Calendar event metadata needed to render events in KnotQ, including event IDs, recurring event IDs, event titles, start and end dates or times, recurrence rules, cancellation or deleted status, and updated timestamps.
• Google Calendar incremental sync tokens, so KnotQ can request only changes after the first import when Google's API allows it.

How KnotQ uses Google user data

KnotQ uses Google user data only to provide the Google Calendar features you choose to enable:

• Authenticate your Google account through Google's OAuth flow.
• Import selected Google calendars into KnotQ as read-only calendar schemes.
• Display Google Calendar events alongside your local KnotQ tasks, reminders, assignments, and events.
• Refresh imported Google Calendar data periodically while KnotQ is open and, where supported by the operating system, during background refresh.
• Deduplicate and update imported Google Calendar schemes across your KnotQ workspace.

KnotQ does not use Google user data for advertising, analytics, tracking, sale, or AI/ML model training. KnotQ does not write changes back to your Google Calendar.

Google user data sharing

KnotQ does not sell Google user data and does not share Google user data with advertisers, data brokers, analytics providers, or unrelated third parties.

Google user data may be handled in these limited ways:

• Google: KnotQ communicates with Google only to authenticate your account and request read-only calendar data through Google APIs.
• Your devices: Imported calendar entries are stored on devices where you use KnotQ.
• KnotQ sync backend: If you enable optional KnotQ account sync, imported Google Calendar event data and calendar metadata that are part of your KnotQ workspace may be synced through KnotQ's backend so your KnotQ workspace is consistent across your devices. Google OAuth access tokens and refresh tokens are stored locally on the device that connected Google Calendar and are not synced through the KnotQ workspace sync backend.
• Cloudflare: Cloudflare is KnotQ's hosting partner for the optional sync backend. Cloudflare is the only third-party hosting provider with access to synced KnotQ account and workspace data, including imported Google Calendar data that you choose to include in your synced workspace. Cloudflare processes this data only as needed to host and operate KnotQ's sync service.
• Lemon Squeezy: Lemon Squeezy processes optional sync subscription checkouts, payments, taxes, invoices, subscription management, and billing webhooks. KnotQ uses those webhook events to update whether a KnotQ account has sync access.

Google user data storage and protection

Google OAuth tokens are stored locally in KnotQ settings on the device where you connected Google Calendar. Imported calendar data is stored locally in your KnotQ workspace. If KnotQ account sync is enabled, imported calendar entries and calendar metadata may also be stored in the KnotQ sync backend as part of your synced workspace.

KnotQ encrypts data in transit using HTTPS/TLS for network requests to Google APIs, KnotQ sync services hosted by Cloudflare, and Lemon Squeezy checkout. KnotQ also protects data by storing passwords only as password hashes, using authentication tokens for account sessions, and limiting backend access to the data needed to provide sync. You are responsible for protecting your device, operating system account, and any KnotQ account credentials.

Google user data retention and deletion

Google OAuth tokens and imported Google Calendar data remain on your device until you disconnect Google Calendar, remove the imported calendar schemes, reset your KnotQ workspace, delete the app's local data, or uninstall KnotQ in a way that removes app data.

If optional KnotQ account sync is enabled, imported Google Calendar entries that are part of your synced workspace remain in the sync backend until you remove them from the synced workspace, disable/delete the synced workspace data, delete your KnotQ account, or request deletion. Disconnecting Google Calendar stops future API access by removing the local credentials, but previously imported events may remain in your local or synced KnotQ workspace until you remove those imported calendar schemes or delete the workspace/account data.

You can request deletion of KnotQ account data or synced workspace data by emailing knotq@googlegroups.com and stating that you want account or sync data deleted. Do not send passwords, OAuth tokens, or other secrets by email. We may ask you to verify ownership of the account before deletion.

No analytics or tracking

KnotQ does not include advertising tracking. The account page stores the current website sync session in browser session storage so the page can show your signed-in state. Lemon Squeezy's checkout script is loaded on pages that offer subscription checkout so the checkout can open in an overlay on KnotQ.

Third-party services

KnotQ communicates with Google only as needed for optional Google Calendar access. For optional KnotQ account sync, Cloudflare is KnotQ's hosting partner for synced account and workspace data. Lemon Squeezy is KnotQ's payment and subscription billing provider for optional sync subscriptions. If push notifications or background sync are enabled on a supported platform, platform push services may process device push tokens so KnotQ can wake your app to refresh local data; silent background notifications do not include Google Calendar event contents.

Google API Services User Data Policy

KnotQ's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Changes to this policy

If we make changes to this privacy policy, we will update this page and note the date of the last revision above.

Contact

If you have questions about this privacy policy, Google Calendar data, deletion requests, or KnotQ support, email knotq@googlegroups.com.