DreamKid Studio
Privacy Policy
Effective September 16, 2026 · Updated September 28, 2026 · DreamKid Studio (dreamkid.org)
DreamKid Studio builds and operates software for small businesses, including scheduling and booking tools that a business owner connects to their own Google Calendar. This policy covers what that software stores, why, and how to remove it.
Google user data
Our scheduling software can connect to a business owner's Google Calendar, and only ever at their instruction. Connecting is done by the owner, in their own browser, through Google's consent screen. We never ask for or receive a Google password.
Scopes we request. calendar.events, to write confirmed bookings onto the owner's calendar, and calendar.readonly, to read busy times so that appointments already on their calendar stop us offering those slots to clients. We request nothing else, and we do not read the contents of unrelated calendar events.
What we store. The refresh token Google issues, plus the email address of the connected Google account so the owner can see which calendar is linked. Both are held in our server-side database, reachable only by the application server's own credentials, and are never sent to a browser or embedded in any web page. Our database provider encrypts stored data at rest.
What we do with it. We call the Google Calendar API on the owner's behalf for exactly two purposes: creating an event when a client books, and checking free/busy times when deciding which slots to offer. Nothing else.
How we protect Google user data
Security procedures are in place to protect the confidentiality of Google user data and the other sensitive data our software holds:
Encryption in transit. Every connection is encrypted with TLS (HTTPS) — between the owner's browser and our software, between our servers and Google's APIs, and between our servers and our database.
Encryption at rest. The Google refresh token and the connected account's email address are stored in a database that is encrypted at rest (AES-256) by our database provider, Supabase.
Access controls. The table that holds the token has row-level security enabled and grants no access to public or signed-in database roles; only the application server, using a credential kept in our hosting environment, can read it. The token is never sent to a browser, written into a web page, or included in logs we produce. The admin area where a calendar is connected or disconnected requires the business owner to sign in.
Protected connection flow. Connecting a calendar uses Google's standard OAuth consent screen, with a one-time verification value on every request so a connection cannot be forged or redirected to another account.
Least access. We request only the two Calendar permissions described above, read busy times rather than event contents when deciding availability, and do not copy the owner's calendar into our database. Access to production systems is limited to DreamKid Studio personnel who need it to operate the service.
Revocation. Disconnecting revokes the token at Google and deletes our copy, so a removed connection cannot be used again.
Limited Use
DreamKid Studio's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not transfer it except as needed to provide the features described above, do not use it for advertising, and do not use it to train generalized artificial-intelligence or machine-learning models. No human reads Google user data except where required for security, to fix a fault the owner has reported, or where the law requires it.
Other data our software holds
Business records. For a booking business, this includes appointments, services and hours, and the contact details a client enters when booking — name, mobile number and email. That information belongs to the business that operates the site. We process it on their behalf so their software works, and for nothing else.
Payments. Where a business collects payment, it connects its own payment provider account and money flows directly to that business. We store a reference to their account and a record of what was charged. Card numbers never reach our servers.
Operational logs. Standard server logs — timestamps, request outcomes, error details — retained briefly by our hosting provider for debugging and abuse prevention.
What we do not do
We do not sell personal data to anyone. We do not share it with third parties for their own purposes, use it for advertising, or use it to train models. We do not combine one business's data with another's.
Third parties involved
Google (sign-in and the Calendar API, under Google's privacy policy), Supabase (our database), Vercel (hosting), and the payment provider a business chooses, such as Stripe or Square, under their own policies.
Retention and deletion
A connected Google account stays linked until it is disconnected. Disconnecting inside the software revokes the token with Google and deletes our copy. An owner can also revoke access at any time at myaccount.google.com/permissions — the stored token stops working immediately. To have records deleted entirely, email us and we will do it within 7 days, except where we are required to keep accounting records.
Contact
Michael@dreambuild.dev — we answer privacy questions and deletion requests directly.