Google API Limited Use Disclosure

Last updated: 19 July 2026

Dukara's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What Dukara requests

Scope	Why
`openid`, `email`, `profile`	Sign the trainer in and show their name and picture in the app.
`https://www.googleapis.com/auth/calendar.app.created`	Create a calendar dedicated to Dukara and manage only the events Dukara itself created on it.
`https://www.googleapis.com/auth/calendar.freebusy`	Read busy time blocks, so conflicts are visible before a session is booked.

Clients who choose to share their availability grant calendar.freebusy only.

What Dukara deliberately does not request

Dukara does not request calendar, calendar.events, calendar.readonly, or calendar.events.readonly — every scope capable of reading event titles, descriptions, guests, locations, or attachments.

The consequence is worth stating plainly: Dukara cannot read the contents of your calendar events, and this is enforced by Google rather than promised by us. Even if the application's code were wrong or compromised, the tokens it holds cannot retrieve that information.

Similarly, calendar.app.created can reach only the calendar Dukara created. Your personal, work, and shared calendars are outside its reach entirely.

Limited Use commitments

Data obtained through Google APIs is used only to provide and improve the features the user asked for — showing availability when booking, and keeping session events in step with the app. Specifically, Dukara:

does not transfer Google user data to third parties, except as necessary to provide these features, to comply with applicable law, or as part of a merger or acquisition following notice to users;
does not use Google user data for advertising, ad targeting, personalisation, or profiling of any kind;
does not sell Google user data under any circumstances;
does not use Google user data to develop, improve, or train generalised or non-personalised artificial-intelligence or machine-learning models; and
does not allow humans to read Google user data, unless you have given explicit consent for specific data, it is necessary for security purposes such as investigating abuse, it is required by law, or the data has been aggregated and anonymised for internal operations.

Storage and revocation

Access tokens are stored in a server-only area of the database that no application client can read. They are deleted as soon as the calendar is disconnected or the account is deleted.

You can revoke Dukara's access at any time from the app, or directly at myaccount.google.com/permissions. Revoking stops all calendar reading and writing. Events Dukara already created remain in your calendar, under your control, until you delete them.