Privacy Policy

Routebook is in early access, and this policy describes the whole service — including parts that are not switched on yet. Anything marked (planned) below is not running today and is processing no data of any kind; we update this page when it goes live.

Live today: Google sign-in, connecting a Google Calendar so we can read its events, computing drive-feasible slots, address suggestions as you type, showing an address as a pin on a map, and writing confirmed bookings to the technician's calendar. Notifications and billing are still in development.

• Account information. When a technician signs in with Google we receive their name, email address, Google account identifier, and profile picture URL.
• Google Calendar data. With the technician's explicit consent we read events from the calendars they connect: busy/free intervals, event start and end times, and event locations. Locations are what make drive-time feasibility possible — they are the anchor points we measure travel from and to. We also create the calendar events for bookings made through Routebook.
• Business configuration. Services and durations, working hours, buffer preferences, home base address, and service area, as entered by the technician.
• Customer booking details. When someone books an appointment we collect their name, email address, phone number, the service address, and any note they add. The technician is the party who requested that appointment; we hold this data on their behalf.
• Operational data. Standard server and security logs (IP address, user agent, timestamps, error traces) generated by our hosting provider.

We do not collect payment card numbers. We do not use advertising trackers or third-party analytics cookies.

• Computing drive-feasible slots — overlaying working hours and calendar busy times, then checking that the drive from the preceding appointment's location and to the following one actually fits. Addresses are sent to Google's Geocoding and Routes APIs to place them and compute travel times.
• Suggesting addresses as you type. The text typed into an address field — the technician's home base, or a customer's address on a booking page — is sent to Google's Places API as you type, so that a complete street address can be picked from a short list. The suggestions themselves are not stored or cached; the address that is picked then follows the address handling described on this page.
• Showing a map. A page that shows an address as a pin — the technician's home base, or a customer's address on a booking page — loads its map tiles directly from OpenFreeMap, which sees the visitor's IP address and which map area was requested. The address itself and the pin are never sent to OpenFreeMap; the pin is drawn in the visitor's own browser from the coordinates our server already resolved.
• Creating calendar events for confirmed bookings on the technician's connected calendar, and removing them when a booking does not go through.
• Sending notifications (planned) — booking confirmations, cancellations, and reminders to the technician and the customer.
• Operating and securing the service — authentication, debugging, abuse prevention, and billing once paid plans exist.

We do not sell personal information, and we do not use any of this data for advertising.

Routebook requests the minimum Google Calendar scope it can function with, and asks for calendar access as a separate step after sign-in, so a technician can use the account without granting it.

Routebook's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data obtained from Google APIs is:

• never sold to anyone, under any circumstances;
• never used for advertising, ad targeting, or personalization;
• never used to train generalized artificial intelligence or machine learning models;
• never read by a human, except with the user's explicit consent for a specific support request, when necessary for security purposes such as investigating abuse, or where required by law;
• never transferred except as necessary to provide or improve the drive-time-aware booking features described in this policy, to comply with applicable law, or as part of a merger or acquisition — and in the last case only with notice to affected users.

We use a small number of service providers ("subprocessors") to run Routebook. They process data only on our instructions and only as needed for the function listed. The second list below names providers we intend to use but have not switched on; they hold no data today.

In use today:

• Vercel — application hosting and server logs.
• Neon — the Postgres database where account, configuration, and booking data are stored.
• Google — sign-in, the Calendar API, and the Geocoding, Routes and Places APIs, which receive addresses (and the text typed into an address field) to place them, compute drive times and suggest addresses.
• OpenFreeMap — map tiles for the maps that show an address as a pin. Your browser fetches the tiles for the area around the address directly from OpenFreeMap, which sees your IP address and which map area was requested; the address itself and the pin never leave your browser.

Planned, and processing no data yet — listed so the eventual set is public in advance:

• Resend — transactional email.
• Twilio — SMS notifications.
• Stripe — subscription billing.

Beyond these, we disclose personal information only when required by law or valid legal process. This page is updated when a subprocessor is added or activated.

• Account and booking data is retained for as long as the technician's account is active.
• Deleting an account removes it. Deleting an account removes it from our live database immediately — the stored Google refresh token (which we also revoke with Google first, so access ends at once), the connected-calendar record, business configuration, and booking records — and it is purged from backups within 30 days. Calendar events already written to the technician's own Google Calendar stay on that calendar — it is theirs, not ours.
• Calendar data is not warehoused. Busy intervals are read on demand rather than copied into our database, and are never stored.
• Address lookups are cached for up to 30 days. To work out which appointment times a technician can physically reach, we ask Google where an address is and how long it takes to drive between two areas. Those answers are cached so the same address is not looked up repeatedly. The cache holds the address text as it was entered, the coordinates and canonical form Google returned, and drive times between coarse geographic areas — for up to 30 days for address lookups and 14 days for drive times, after which a scheduled job deletes them. The cache is keyed by the address itself and holds no name, email address, phone number, appointment or account: it can be asked “where is this address”, never “who lives here” or “what did this person book”. It is shared across technicians, because where an address is does not depend on who is asking.
• Server logs are retained by our hosting provider on a rolling basis, typically 30 days.

You can delete your account or download a copy of your data yourself, at any time, from your dashboard; deletion takes effect immediately. You can also email garrett@deschuteslogic.com and we will action it within 30 days. You can independently revoke Routebook's access to your Google account at any time at myaccount.google.com/permissions; doing so stops all calendar reads and writes immediately.

Customers who booked an appointment can ask the technician who serves them, or email us directly, to have their booking details removed.

• Google refresh tokens are encrypted at rest with AES-256-GCM using a key that is distinct per environment. They are never logged and never stored in plain text.
• All traffic to and from Routebook is served over HTTPS.
• Each technician's data is isolated at the query layer: every read of account-scoped data is filtered by technician on the server, never from anything the browser sends. A technician's public booking page is the deliberate exception — it serves the details a customer needs in order to book, to visitors who are not signed in.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you promptly.

Routebook is operated from the United States, and our providers process data in the United States. If you use Routebook from outside the US, you are sending your information to the US.

Routebook is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16.

We update this page when what we do with data changes, and revise the date at the top. Material changes are communicated by email to account holders before they take effect.

Questions, deletion requests, or privacy complaints: garrett@deschuteslogic.com. We are Deschutes Logic, Oregon, United States.