Privacy Policy

Last updated: August 2026

The short version

KnotQ is local-first. Your workspace data stays on your device unless you choose to enable optional KnotQ account sync. Google Calendar access is optional and read-only. KnotQ uses Google Calendar data only to show your selected calendars inside KnotQ and keep those imported calendars up to date. Payments for optional sync subscriptions are handled by the store you buy through — Apple on iOS, Google Play on Android, or Lemon Squeezy on web and desktop.

Scope of this policy

This policy explains how KnotQ handles data in the KnotQ desktop and mobile apps, the KnotQ website, optional KnotQ account sync, and the optional Google Calendar integration.

Data storage

By default, schemes, folders, tasks, calendar entries, imported calendar entries, embedded media such as images, and settings are stored locally on your device in KnotQ's application data directory. If you enable optional KnotQ account sync, the workspace records needed to synchronize your workspace are transmitted to KnotQ's sync backend and associated with your KnotQ account.

Accounts and sync

If you create a KnotQ account, we store your email address, a password hash, account identifiers, authentication session metadata, and the workspace sync records needed to provide the service. We do not store plaintext passwords.

Authentication sessions use bearer tokens issued by the sync backend. You should keep those tokens private because they grant access to your synced workspace data until they expire or are revoked.

Payments and subscriptions

How an optional KnotQ sync subscription is billed depends on where you buy it:

• iOS app: purchases are processed by Apple through In-App Purchase. Apple handles payment, billing, taxes, and refunds under its own terms, and the subscription is managed in your Apple Account settings. KnotQ's backend verifies the purchase with Apple to enable sync; KnotQ does not receive your payment details.
• Android app: purchases are processed by Google through Google Play Billing. Google handles payment, billing, taxes, and refunds under its own terms, and the subscription is managed in your Google Play account. KnotQ's backend verifies the purchase with Google to enable sync; KnotQ does not receive your payment details.
• Web and desktop: checkout and billing are handled by Lemon Squeezy. KnotQ passes your account email address and internal account identifier to Lemon Squeezy checkout so a successful subscription can be associated with your KnotQ account. Lemon Squeezy processes payment details, billing information, taxes, invoices, subscription lifecycle events, and refund or chargeback handling under its own terms and privacy policy.

KnotQ does not receive or store full card numbers from any of these providers.

Google Calendar data accessed

KnotQ offers an optional Google Calendar integration. The integration is read-only. KnotQ requests only read-only Google Calendar scopes and does not request permission to create, edit, or delete events in your Google account.

When you connect Google Calendar, KnotQ may access, collect, or interact with the following Google user data:

• Your Google account identifier and email address, so KnotQ can show which account is connected and match imported calendars to the correct account.
• OAuth access tokens, refresh tokens, token expiry times, and granted scope strings, so KnotQ can keep the read-only connection working without asking you to sign in every time.
• Calendar list metadata, including calendar IDs, names, display colors, selected or hidden state, deleted state, and primary-calendar status.
• Calendar event metadata needed to render events in KnotQ, including event IDs, recurring event IDs, event titles, start and end dates or times, recurrence rules, cancellation or deleted status, and updated timestamps.
• Google Calendar incremental sync tokens, so KnotQ can request only changes after the first import when Google's API allows it.

How KnotQ uses Google user data

KnotQ uses Google user data only to provide the Google Calendar features you choose to enable:

• Authenticate your Google account through Google's OAuth flow.
• Import selected Google calendars into KnotQ as read-only calendar schemes.
• Display Google Calendar events alongside your local KnotQ tasks, reminders, assignments, and events.
• Refresh imported Google Calendar data periodically while KnotQ is open and, where supported by the operating system, during background refresh.
• Deduplicate and update imported Google Calendar schemes across your KnotQ workspace.

KnotQ does not use Google user data for advertising, analytics, tracking, sale, or AI/ML model training. KnotQ does not write changes back to your Google Calendar.

Google user data sharing

KnotQ does not sell Google user data and does not share Google user data with advertisers, data brokers, analytics providers, or unrelated third parties.

Google user data may be handled in these limited ways:

• Google: KnotQ communicates with Google only to authenticate your account and request read-only calendar data through Google APIs.
• Your devices: Imported calendar entries are stored on devices where you use KnotQ.
• KnotQ sync backend: If you enable optional KnotQ account sync, imported Google Calendar event data and calendar metadata that are part of your KnotQ workspace may be synced through KnotQ's backend so your KnotQ workspace is consistent across your devices. Google OAuth access tokens and refresh tokens are stored locally on the device that connected Google Calendar and are not synced through the KnotQ workspace sync backend.
• Cloudflare: Cloudflare is KnotQ's hosting partner for the optional sync backend. Cloudflare is the only third-party hosting provider with access to synced KnotQ account and workspace data, including imported Google Calendar data that you choose to include in your synced workspace. Cloudflare processes this data only as needed to host and operate KnotQ's sync service.
• Lemon Squeezy: Lemon Squeezy processes optional sync subscription checkouts, payments, taxes, invoices, subscription management, and billing webhooks. KnotQ uses those webhook events to update whether a KnotQ account has sync access.

Google user data storage and protection

Google OAuth tokens are stored locally in KnotQ settings on the device where you connected Google Calendar. Imported calendar data is stored locally in your KnotQ workspace. If KnotQ account sync is enabled, imported calendar entries and calendar metadata may also be stored in the KnotQ sync backend as part of your synced workspace.

KnotQ encrypts data in transit using HTTPS/TLS for network requests to Google APIs, KnotQ sync services hosted by Cloudflare, and Lemon Squeezy checkout. KnotQ also protects data by storing passwords only as password hashes, using authentication tokens for account sessions, and limiting backend access to the data needed to provide sync. You are responsible for protecting your device, operating system account, and any KnotQ account credentials.

Google user data retention and deletion

Google OAuth tokens and imported Google Calendar data remain on your device until you disconnect Google Calendar, remove the imported calendar schemes, reset your KnotQ workspace, delete the app's local data, or uninstall KnotQ in a way that removes app data.

If optional KnotQ account sync is enabled, imported Google Calendar entries that are part of your synced workspace remain in the sync backend until you remove them from the synced workspace, disable/delete the synced workspace data, delete your KnotQ account, or request deletion. Disconnecting Google Calendar stops future API access by removing the local credentials, but previously imported events may remain in your local or synced KnotQ workspace until you remove those imported calendar schemes or delete the workspace/account data.

You can delete your KnotQ account from inside the app: open the KnotQ Sync settings, choose Manage, then Delete Account, and confirm. Account deletion is scheduled with a 14-day grace period — signing back in within those 14 days cancels the deletion — and your local workspace stays on your device either way. You can also request deletion of KnotQ account data or synced workspace data by emailing knotq@googlegroups.com and stating that you want account or sync data deleted. Do not send passwords, OAuth tokens, or other secrets by email. We may ask you to verify ownership of the account before deletion.

Website analytics

The KnotQ website uses Cloudflare Web Analytics to understand aggregate traffic, such as page views and referrers. It is privacy-first and cookieless: it does not use cookies or local storage, does not fingerprint or track you across sites, and does not collect personal data. KnotQ also records aggregate counts when someone clicks a desktop download, an App Store link, a Google Play link, or begins or completes a checksum-verified desktop app update. These counts are grouped by day, platform, device class, and release version. KnotQ does not store an account identifier, cookie, device identifier, IP address, or raw browser user agent with these events.

If you arrive at KnotQ from a Reddit ad and click a desktop download, App Store, or Google Play link, KnotQ may send Reddit the Reddit-provided ad click identifier and the link-click event through Reddit's server-to-server Conversions API, solely to measure that ad's conversion. KnotQ does not store that click identifier. This reporting is disabled for visitors located in the United Kingdom and European Union. Reddit's use of data is governed by its own privacy policy.

The account page stores the current website sync session in browser session storage so the page can show your signed-in state. Lemon Squeezy's checkout script is loaded on pages that offer subscription checkout so the checkout can open in an overlay on KnotQ.

Third-party services

KnotQ communicates with Google only as needed for optional Google Calendar access. For optional KnotQ account sync, Cloudflare is KnotQ's hosting partner for synced account and workspace data, and Cloudflare also provides cookieless web analytics and aggregate download/update analytics for the KnotQ website and app. Reddit receives eligible Reddit-ad desktop-download conversion events as described above. Subscription billing is handled by Apple In-App Purchase in the iOS app, Google Play Billing in the Android app, and Lemon Squeezy on web and desktop. If push notifications or background sync are enabled on a supported platform, KnotQ uses Apple Push Notification service (on iOS) and Firebase Cloud Messaging, a Google service (on iOS and Android), to process device push tokens so KnotQ can wake your app to refresh local data; silent background notifications do not include Google Calendar event contents. KnotQ uses Firebase only for push messaging, not for analytics.

Google API Services User Data Policy

KnotQ's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Changes to this policy

If we make changes to this privacy policy, we will update this page and note the date of the last revision above.

Contact

If you have questions about this privacy policy, Google Calendar data, deletion requests, or KnotQ support, email knotq@googlegroups.com.