Privacy Policy

Information we collect

Google account details. When you sign in with Google we receive your name, email address, and profile picture. We use these to create and identify your DESPO account.

Profile and matching information. Details you enter during onboarding and profile editing — such as your background, skills, what you are looking for in a co-founder, and your availability — are stored so we can suggest and manage matches.

Google Calendar data (optional). If you choose to connect your calendar, we request the calendar.freebusy and calendar.events scopes. We read only your free/busy times (never the contents of your existing events) to find a mutually open slot with a matched founder, and we create a single calendar event with a Google Meet link for that call. You can decline this connection and still use the rest of the app.

Activity within the app. Match requests you send or receive, their status, and meetings booked through DESPO.

How we use Google user data

DESPO’s use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Google user data is used only to authenticate you, find mutual availability, and create the first-call calendar event. We do not use Google user data for advertising, do not sell it, and do not allow humans to read it except with your consent, for security purposes, or to comply with law.

How your data is stored and protected

Data is stored in a PostgreSQL database hosted with Supabase in Sydney, Australia (AWS ap-southeast-2); the application itself runs on Vercel in the same region. Google OAuth refresh tokens are encrypted at rest with AES-256-GCM before they reach the database. Sessions are server-side database sessions. Access to production systems is limited to the operator.

Sharing

We do not sell personal information and we do not serve ads. Data is shared only with the service providers that run the app — Supabase (database hosting), Vercel (application hosting), and Google (sign-in, Calendar, and Meet) — and with other users to the extent you choose: your profile is visible to other signed-in founders as part of matching, and accepting a match shares the booked call details with the other founder.

Retention and deletion

We keep your data while your account is active. You can disconnect DESPO’s calendar access at any time from your Google Account permissions page. To delete your account and associated data, email pranav@dhoolia.com from the address you signed in with — we will action deletion requests within 30 days.

Your rights

We handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles. You may request access to, correction of, or deletion of your personal information by contacting us at the address below.

Changes and contact

If we make material changes to this policy we will update this page and its effective date. Questions or requests: pranav@dhoolia.com.