We Times Privacy Policy

Effective date: October 9, 2026

NimbleClear (Korean business name: 님블클리어; the "Service Provider") operates We Times for users in different countries. Applicable privacy rights depend on your location and the processing involved. This Privacy Policy explains what personal information the shared calendar app We Times (the "App") processes, why, for how long, and how it is shared, transferred and protected.

1. Information We Process

Required

The following is needed to provide accounts, shared calendars and event notifications.

Optional or feature-dependent

The following is processed only when you use the feature or give consent. The basic calendar features work without it.

2. How We Use Information

• Sign-up, sign-in, identifying you and processing account deletion
• Shared calendars, events, attendance answers, comments and attachments
• Notifications about changes, invitations and comments, and event reminders
• Paid subscriptions and the free trial, purchase restoration, refunds and disputes
• Ads for free users
• Error analysis, abuse prevention and stability improvements
• Customer support and legal obligations

2a. Legal bases

Where applicable law requires a legal basis, we rely on performance of the service contract for core account/calendar functions; legal obligations; legitimate interests in security, diagnostics and abuse prevention balanced against your rights; or consent where required. For consent-based processing, you may withdraw consent through the available controls or by contacting us.

3. Sharing With Third Parties

Invitation Links and Previews on Other Services

To validate invitations, we process a token hash, the linked calendar and creator, permissions, expiration time and join count. The original token is stored on the creating device and processed when a link is requested. Daily IP hashes and request counts used to limit preview abuse become eligible for automatic deletion after approximately one day; deletion may be delayed by processing. Server and provider operational records are covered in Sections 4 and 5.

• Public information: Anyone with a valid invitation link can access the calendar name, inviter’s nickname, member count, invitation role and expiration information before signing in. These details are returned in the invitation page HTML or preview API response and may also be accessed by people receiving a forwarded link or services that fetch it. The link alone does not provide event titles, times, locations or notes, member lists or emails, comments, attachments or profile photos. Personal information entered into a calendar name or nickname may nevertheless be visible.
• Sharing outside We Times: When you send a link through KakaoTalk, another messenger, email or a social service, that service and the recipients receive the link. The service may automatically fetch and process the page to generate a preview, check security or provide its related features. Our preview tags contain the calendar name, app name and icon, and a generic invitation description. Other public invitation details may be present in the page response even when they are not displayed on the preview card.
• Joining and controls: A person receiving a forwarded link may join with the invitation’s permissions after signing in, verifying their email and confirming participation. Consider the recipients and channels you choose, and avoid putting information you do not want disclosed in calendar names or nicknames. Owners can disable or replace a link. Our service stops new invitation previews and joins through expired or revoked links. Revoking a link does not remove people who already joined.
• External copies: We return invitation HTML with a no-cache storage instruction, but cannot automatically erase previews retained by external services, forwarded messages, screenshots or other copies. Their processing purposes, locations, retention and deletion procedures are governed by their own policies. You may delete messages you shared or contact the relevant service about deletion. This does not limit our applicable data protection obligations or your statutory rights.

We process information for the purposes described in this policy. Calendar members can see your nickname, profile photo and shared events, responses, comments and files. The providers below process information to operate the Service; advertising providers may also process ad-related information according to consent and device settings. We may disclose information in response to lawful requests or where necessary to meet legal obligations and protect rights. We do not operate a business selling personal information for money. Where advertising disclosures qualify as a sale or sharing under local law, you may exercise applicable opt-out rights through available advertising privacy choices or by contacting us.

Optional place search and travel estimates

When you choose to search, your query is sent through our Firebase server to the provider selected by the app language: Kakao for Korean and Google Maps for other languages. When you request a travel check, we process the two selected place queries, identifiers and coordinates, travel mode and the scheduled departure time where needed. Driving requests go to Kakao Mobility; walking and transit requests go to Kakao. We do not collect device GPS/current location or send event titles, notes, participants, email addresses or account IDs to map providers. Personal information you type into a search query can be transmitted.

When a Pro or Max user expands a map, we resolve the selected place identifier or search query to coordinates, and the native map SDK on the device requests map content from Kakao or Google. The displayed coordinates or map area, IP address, and app, device and SDK technical information may be sent to the provider. Maps start collapsed and no map display request is made until expanded. Results are reused within the same screen, although interacting with the map may cause additional requests. We Times does not request GPS permission or transmit the device’s current location for this feature. The provider’s privacy policy also applies.

Your entered place label and selected place identifier are saved with the event, shared with calendar members and follow event retention/deletion rules. Provider addresses, coordinates and route results are processed temporarily, not stored in our database. Providers may retain operational/security records under their own policies. Account request-rate records prevent abuse, are replaced on subsequent requests and deleted upon account deletion. You can save a place as text without searching. For Google Maps travel checks, selected place identifiers, travel mode and departure time where needed are sent to Google Routes API. The Google Privacy Policy also applies to Google Maps features. External-LLM AI event analysis remains disabled.

Firebase App Check processes app/installation and device-integrity signals and attestation tokens to reduce automated abuse, using Google Play Integrity on Android and Apple DeviceCheck in supported Apple release environments. Development builds use separately registered test tokens. We do not include event content or GPS location in this verification.

4. Processors and International Transfers

The Service is intended for users internationally. The providers below may process information outside your country of residence. We use encrypted connections for transfers. Cross-border transfers require a lawful basis and safeguards under applicable law; contact us for information about the transfer arrangements that apply to your data.

Core account and calendar functions depend on their service providers. Processing for attachments, subscriptions and ads depends on the features used and applicable choices. See Section 6 for your rights and controls.

• Firebase privacy
• Cloudflare Privacy Policy
• RevenueCat Privacy Policy
• Google AdMob privacy

5. Retention and Deletion

• Account deletion: After verifying a request, we begin deleting the account, profile, push tokens, attendance responses, comments and calendars used only by that account. Some processing, including related file cleanup, completes asynchronously. There is no 30-day recovery grace period or restoration by signing up again. Cancel store subscriptions separately.
• Shared records: Where possible, a calendar with remaining members is transferred to another member and kept. Events, attachments, some change records and the author’s account ID may remain as shared records. Names or other information typed into Content are not automatically removed by deleting an account; edit them before leaving or contact us.
• Calendar deletion: We do not provide a recovery grace period for deleted calendars and their related data. Save copies you need beforehand.
• Files: Attachments become eligible for deletion after 1 year for Plus or 2 years for Pro, Max and new shared uploads; comment photos after 90 days. Processing can depend on scheduled jobs and providers. The App displays applicable retention information.
• Operational and legal records: We retain operational records for their necessary purposes and delete expired records. We may retain limited records for legal obligations, disputes or abuse prevention. Where Korean electronic-commerce rules apply, relevant contract/payment records are retained for 5 years and consumer complaint/dispute records for 3 years. Records in other jurisdictions follow the applicable requirements and necessary retention periods.
• Providers and backups: Transaction records independently held by Apple, Google, RevenueCat or other providers may remain under their own legal obligations and policies. Restricted backup and security records may remain after active-system deletion until their retention cycles expire.

6. Your Rights

• Depending on applicable law, you may request access, correction, deletion, portability or restriction of processing, object to processing and withdraw consent. These rights do not apply identically to every location or activity.
• Edit your profile and Content in the App. Request deletion under Settings → My account → Delete account, or use our account deletion instructions.
• Manage notifications in app/device settings and advertising choices through the available privacy-options screen. Withdrawing consent does not affect processing that was lawful before withdrawal.
• Email [email protected]. We may verify your identity to protect the account, and respond within applicable legal deadlines. We explain any lawful restriction or extension that applies.
• You may complain to your local data-protection or consumer-protection authority. If you are in the EEA or UK, you may contact the competent data-protection supervisory authority. Exercising a right will not result in unlawful discrimination.

7. Automatic Collection

The App and integrated SDKs use device/app identifiers and storage needed for authentication, diagnostics, notifications and advertising. Google AdMob and its consent tools process advertising settings. Where required, we provide consent and privacy choices. Declining personalization or resetting an advertising identifier does not stop every advertising or security-related processing activity. Access to tracking identifiers on iOS is subject to operating-system permissions and applicable law.

8. Children

The Service is not directed to children under 14. A higher local age requirement or parental-consent requirement also applies where required by law. If you believe we are processing information from a child who does not meet the applicable requirements, contact [email protected]. After verification, we take appropriate steps such as restricting access or deletion. Before adding information about family members, ensure you are entitled to share it.

9. Security

• We apply reasonable safeguards including HTTPS transmission, provider storage encryption, membership and editing checks, and private file storage.
• Files are delivered through time-limited links issued after permission checks. Members may retain downloaded copies or share a still-valid link; consider this when sharing Content.
• Our error-reporting code is designed not to intentionally attach event titles, notes, emails or account IDs. SDKs may process technical device, app and crash information.
• No system offers absolute security. We investigate incidents and take protective and notification steps required by applicable law.

10. Privacy Officer

Privacy contact: NimbleClear
Email: [email protected]

Including your country of residence and the nature of your request helps us identify the relevant process. Please do not send passwords or sensitive information that is unnecessary for your request.

11. Changes to This Policy

We update this policy as processing, features or legal requirements change. We publish the revision date and provide appropriate notice of material changes. Any notice period, consent or other protection required by applicable law takes precedence.

View We Times Terms of Service