Privacy

Centers plans your week around the time you actually have. The work you put into it is yours, and this page says plainly what leaves it and what does not.

Your work never leaves Centers

Task titles, notes, time block names and the contents of your calendar are never sent to any analytics service, and none of them ever leaves Centers except back to you. When we measure how the product is used we count things — how many tasks a schedule placed, whether a refresh succeeded — and never what they were called. This is enforced in the product's own rules, not left to good intentions.

What we collect

Your account. An email address, and a display name if you join a team. Your password is held by Amazon Cognito and we never see it.

What you create. Tasks, notes, time blocks, schedules and their history. This is the content the service exists to hold.

Your calendar, if you connect one. See the section below.

How you use it. Which screens you open and which actions you take, as counts and event names. Your email address is attached so that we can help you when you write to us.

Payment. Handled entirely by Stripe. We never see or store your card number; we keep only the identifier Stripe gives us and the state of your subscription.

Google Calendar, and Google's Limited Use rules

If you connect a Google Calendar, Centers requests read-only access to it and nothing more. We use it for one purpose: to see when you are already busy, so that the schedule does not place work on top of a meeting. Centers never writes to your calendar and never creates, changes or deletes an event.

What we read from each event is its start time, its end time, whether it is marked busy or free, and its title. The title is shown to you, on your own schedule, so a block of busy time says what it is rather than sitting there unexplained. It is never written to our database, never sent to our analytics, and never shown to anybody else — not even to teammates who can see the rest of your schedule. We do not read event descriptions, guest lists or locations at all.

Nothing from your calendar is stored. The busy times are fetched from Google each time your schedule is built and are gone when the request finishes.

Centers' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not transfer this data to others except as necessary to provide the feature you asked for, we do not use it for advertising, we do not sell it, and we do not allow humans to read it except with your explicit consent, to resolve a problem you have reported, for security purposes, or where the law requires it. We do not use Google user data to train machine learning models, and we do not transfer it to any third-party AI service. Centers does use an AI assistant for other parts of the product; nothing read from your calendar — raw, aggregated or derived — is ever given to it. The section below says precisely what it is given.

You can disconnect a calendar at any time in Settings, which deletes the stored credential, and you can revoke Centers' access directly from your Google account.

How we protect it

In transit. Everything between your browser and Centers, and between Centers and every service it uses, travels over TLS. There is no unencrypted path in or out.

At rest. Every database table is encrypted with AWS-managed keys, and every one has point-in-time recovery enabled so that a mistake can be undone rather than survived.

Your Google credential specifically. The token that lets Centers read your calendar is held in a table that is deliberately not part of the product's API. There is no query, for you or anyone else, that returns it — the only thing that can read it is the single server function that refreshes your busy times, and that function returns times, never the credential. It is deleted when you disconnect, and Centers also asks Google to revoke it rather than merely forgetting it.

Who can reach what. Every record is keyed to the identity that created it and is read through that key, so one account cannot read another's rows even by asking directly. Operations that affect somebody other than yourself — inviting a person, changing a role, anything to do with billing — additionally require two-factor authentication.

Us. The internal console we use to run Centers cannot read your content at all: it can see that an account exists and what it pays, and no task, note, block or calendar entry. Administrative actions are written to an append-only audit log that the service itself is denied permission to alter.

The assistant, and what it is not allowed to see

Centers has an optional assistant. It can explain why something could not be scheduled, suggest which day a task might move to, and make small edits you ask for in words. It runs on Amazon Bedrock, using Anthropic's Claude models, inside our own AWS account.

Nothing from your Google Calendar is ever sent to it. Your calendar is read for one purpose — when you are busy — and those busy intervals are used by a deterministic scheduler that is ordinary code with no model in it. Event titles are shown back to you on your own schedule and go nowhere else. The assistant is given your task titles, durations and time block names, and never anything that came from Google.

Your data is not used to train anything. Amazon Bedrock does not use inputs or outputs to train any model, and does not share them with the model provider. Bedrock's model invocation logging is switched off in our account, so prompts are not retained even by us. We do not use aggregators, gateways or model hubs; Bedrock is the only AI service Centers talks to, and one small module is the only code in the product that talks to it.

What we measure, and with what

On this website we use Google Analytics to understand how people find us, and PostHog to understand how the product is used. Neither runs until you agree to it here; if you decline, neither is loaded at all.

Once you have an account, PostHog records which screens you open and which actions you take, so that we can see where the product is confusing or slow. Your email address is attached to that record. PostHog stores this in the United States.

Who else touches your data

We use a small number of providers to run Centers, and no others: Amazon Web Services for hosting, databases, sign-in and email; Stripe for payments; Google for calendar access when you connect it, and for website analytics when you agree to it; and PostHog for product analytics.

We do not sell your data, we do not share it for advertising, and we do not use your content to train machine learning models. When the assistant acts on a request you make, the text it needs for that one request is sent to Amazon Bedrock, inside our own AWS account — see the section above for exactly what it is given and what it is never given.

Where it lives, and for how long

Your data is stored in the United States. We keep it while your account exists. When you delete your account we remove your content and revoke any calendar access; backups age out within 35 days. Records we must keep for tax or accounting reasons, such as invoices, are kept for as long as the law requires.

What you can ask for

Write to info@usecenters.com from the address on your account and you can ask us for a copy of your data, a correction, or its deletion. We will answer within 30 days. If you are in the UK or the EU you have these rights under data protection law and may also complain to your local supervisory authority.

Cookies and similar storage

Before you answer the consent question, this website stores nothing at all and contacts no other company — the typefaces are served from this domain for that reason. After you agree, these are everything it stores, and you can check for yourself in your browser:

• centers_consent — your answer, and when you gave it.
• centers_anon — a random identifier for this browser, with no name or address in it. The website and the app share it, so a pricing page read and a sign-up a few minutes later count as one person rather than two.
• centers_engaged — a flag noting this visit has been counted as engaged once. It is cleared when you close the tab.
• _ga and _ga_… — Google Analytics’ own cookies, set by Google once you agree.

The app stores what it needs to keep you signed in, which is not optional and is not analytics. You can withdraw consent at any time by clearing this site’s storage in your browser; you will be asked again on your next visit.

Children

Centers is not intended for anyone under 16, and we do not knowingly collect their data.

Changes

If we change this policy materially we will email account holders before it takes effect and update the date at the top of this page.

Contact

Privacy questions go to info@usecenters.com.