SchedYOUall for Chrome — privacy

Capture: what gets sent, and when

Capture only ever sends something when you take an explicit action, and only sends what that action selects:

• Typed text — what you type into the popup's quick-add field.
• A screenshot — the exact region you drag-select on a page, cropped in your browser before anything leaves it.
• Selected text or an image — whatever you highlighted or right-clicked when you chose "Send selection to SchedYOUall" or "Send image to SchedYOUall."
• A page URL — only when you click "Send this page."

Forwarding an email into your queue still works the way it always has: you forward it yourself, from your own mail app, to your private SchedYOUall forwarding address. That is an ordinary email between you and SchedYOUall — the extension plays no part in it and never touches your mail. Nothing is captured passively: the extension doesn't read pages in the background, doesn't watch what you browse, and doesn't send anything until you click a button, drag a region, or choose to send.

Where captures go

Every capture is sent directly to SchedYOUall's authenticated capture endpoint (schedyouall.com/api/extension/capture), over HTTPS, with the bearer token created when you paired the extension. That token is the only credential the extension stores; it identifies your account and nothing else. Beyond it, the extension keeps a handful of local preferences in Chrome's own storage — your app origin, your private forwarding address, and the on/off state of the two feature toggles, plus the calendar show/hide list described below.

When you send a page URL, SchedYOUall's server fetches that URL itself to read the event off it — the extension doesn't hand over a screenshot for a URL send. If the server can't read the page (a login wall, for example), no data is stored at all — you get a prompt to capture a screenshot instead, which sidesteps the login wall entirely since it's just pixels you already had on screen. A right-clicked image is fetched by the extension in your browser (so it can be resized or converted if needed) and then sent to the same capture endpoint — it never goes anywhere else first.

How long captures live

Captured content is stored using the exact same retention rules as an email you forward to SchedYOUall directly, because internally it takes the same path:

• Once every event from a capture has been triaged (added to your calendar or dismissed), the original — text, screenshot, or fetched page content — is deleted on the next daily cleanup.
• If a capture's event date passes while it's still untriaged, it archives itself and the original is deleted the same way.
• A capture SchedYOUall couldn't date is kept at most 30 days before the same cleanup applies.
• Events you dismiss, or that age out without a decision, are kept for 30 days in their tab (Dismissed / Archived), then permanently deleted — or clear them yourself, sooner, with each tab's Clear button. Events you add to your calendar stay — they're yours.

The full, current version of this schedule lives at schedyouall.com/privacy, since the same service-side code enforces it for both captures and forwarded email.

The calendar panel: through SchedYOUall, like the dashboard

On Google Calendar's new-event page, the extension reads the start time, end time, title, and location you type into Google's own event form — locally, in your browser — so the panel can line up with the time you're choosing and decide whether to offer drive-time buffers. To show your existing calendar, the panel asks SchedYOUall's authenticated calendar endpoint, and SchedYOUall reads your calendar list and events from Google using the Calendar connection already on your SchedYOUall account — the same connection the dashboard uses. If you use the optional "Block for drive time" button, SchedYOUall creates buffer events on your primary calendar — and deletes them if you click Undo — through that same connection. The extension itself never signs in to Google.

The calendar you see in the panel is handled exactly the way the dashboard's own calendar view already handles it: read on demand for the window you're looking at, authenticated by the same pairing token used for capture, cached only briefly to stay within Google's rate limits, and not stored long-term — governed by the same retention and processor terms as the rest of the service. The extension holds no Google credentials of its own. One small preference — which calendars you've toggled to hide in the panel — is saved to Chrome's own sync storage; it holds only calendar identifiers, no event details.

Google Calendar access

This extension does not request any Google permissions of its own, and there is no separate Google sign-in for it. The calendar panel works through the Google Calendar connection already on your SchedYOUall account — the same one the dashboard uses to add events for you. That connection carries only Calendar access: reading your calendar list and events, and creating or deleting the drive-time buffers you explicitly ask for. Its exact scopes and handling are described at schedyouall.com/privacy.

No Gmail access is ever involved — SchedYOUall never authenticates to Gmail, the extension never runs on Gmail, and no message content is read through Google's API.

What the extension does not do

• No browsing history. The extension has no access to and keeps no record of the pages you visit; its activeTab and scripting permissions only act on the tab in front of you, and only when you trigger an action.
• No ambient page reading. Nothing on a page is read or sent unless you type it, drag-select it, right-click it, or explicitly choose to send the page. The calendar panel's reading of the Google Calendar event form is the one exception, and it stays local to your browser.
• No analytics added by the extension itself. The extension code contains no analytics, telemetry, or crash reporting of its own.
• No sale of data, and no remote code. We never sell your captured content or calendar data, and everything the extension runs — including the calendar rendering library — ships inside the extension package; nothing is fetched and executed at runtime.

Revoking access

Because the calendar panel uses your SchedYOUall account's Google connection, you revoke its calendar access the same way you revoke SchedYOUall's: disconnect Google from your SchedYOUall account, or remove SchedYOUall's access at myaccount.google.com/permissions — either one stops both the panel and the dashboard from reading your calendar. Unpairing from the extension's Options page clears your pairing token locally, which stops both capture and the calendar panel until you pair again. Uninstalling the extension removes it and its local preferences from your browser. To remove data already sent to SchedYOUall, use the account deletion described at schedyouall.com/privacy.