Privacy policy

Only what you type into the booking form:

• Name and email — required, to confirm the meeting and send the calendar invite.
• Company and role — optional. They tell me who I'm talking to before the call.
• What's keeping you up at night — optional free text. This is the useful part; it's what I read to prepare.
• Your timezone — detected by your browser so times are shown in your own clock rather than mine.

There is no analytics, no advertising, and no tracking on this site. No cookies are set for visitors — the only cookie the application issues is my own administrator sign-in session, which you will never receive.

This is the part most likely to matter to you, so it is specific.

The connected Google Account is mine, not yours. You do not sign in with Google to book, and I never receive access to your calendar or your Google Account.

My own account grants this application a single, deliberately narrow scope: https://www.googleapis.com/auth/calendar.app.created. That permits access only to a separate calendar the application creates for itself. It cannot see, edit, or even list my own calendars, and it has no access to anyone else's.

It is used for one purpose: creating an event on that dedicated calendar so Google issues a Meet link, updating it if the meeting moves, and deleting it if the meeting is cancelled. Nothing else.

The event created on my calendar carries the meeting name, the time, your name and email as the attendee, and — if you provided them — your company, role, and the note you wrote. If you would rather that note did not reach Google, leave the field blank and tell me on the call instead.

The application cannot read my calendar at all. The scope makes it technically impossible, not merely a policy I promise to follow. It never reads or stores calendar entries belonging to anyone else. Access and refresh tokens are encrypted at rest with AES-256-GCM under a key held in Google Secret Manager, separate from the database.

Mycelial Ventures' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

I use a small number of services to run this. Each receives only what it needs to do its job.

• Neon — the database holding bookings. Hosted in the United States.
• Resend — sends your confirmation and calendar invite. Receives your name, email and meeting details.
• Google Cloud Run — hosts the site.
• Google Calendar — as described above.
• Stripe — payment, and only for paid sessions. Stripe collects and holds your card details directly; they never pass through this site, and I never see them.

I do not sell your information, share it for advertising, or pass it to anyone beyond the services listed here.

Booking records are kept while there is a business reason to have them — a meeting history, an ongoing engagement, or a tax or accounting record. I do not keep them indefinitely for their own sake.

A booking that expires unpaid is released automatically and retains nothing beyond the row itself.

Email kristof@mycelialventures.com and ask. You can request a copy of what I hold about you, ask for it to be corrected, or ask for it to be deleted. I will action deletion unless I am required to retain something for tax or legal reasons, and I will tell you if that applies.

There is no form and no process to navigate. It is one person reading the email.

If this changes materially, the date at the top changes with it. The revision history is public in the site's source repository.