Security and data

What it reads, what it keeps, what it never touches.

Written from what Pensova actually does, not from a template. If something here stops being true, the page changes the same day the app does.

Reads

Which calendars you subscribe to.
When you are busy, each time it plans.
Text you type, say or paste, and any photo you add, when you do.

Stores

Your tasks, task blocks and drafts.
Working hours and calendar choices.
The keys to your calendar, which no user can read.
A record of your plan from Stripe.

Never touches

Your email, contacts or files.
Events it did not create.
Your card number.
Your data, for ads, selling or AI training.

Straight answers

The questions people ask before connecting a calendar.

In plain words. Everything below this section gives the same answers at full length.

Do you store my calendar?: No. Each time Pensova plans, it asks Google or Microsoft when you are busy, uses that to find free time, and forgets it. The only thing it keeps about your calendar is a short code that shows whether your schedule changed, so Pensova knows when to move your task blocks. The code cannot be turned back into your events.
Can Pensova read my email, contacts or files?: No. It asks Google or Microsoft for Calendar permissions and nothing else, and they show you the list before you approve. Google reviewed the app and verified it for those two permissions in September 2026.
What does it put on my calendar?: Only the time blocks it makes for your tasks. It edits and removes those blocks and never touches an event it did not create. You can delete or move a Pensova block like any other event, and Pensova respects that.
Can anyone at Pensova see my calendar?: No. The keys that let Pensova reach your calendar cannot be read by any signed-in person, including you, and there is no screen at Pensova that shows anyone's calendar. Pensova uses them only to plan.
Is my data used to train an AI?: No. When you type or say a task in plain words, paste meeting notes or add a photo of a schedule, it goes to Claude, Anthropic's AI, so it can be turned into tasks or events. Your calendar is not sent. Anthropic does not use it for training, and Pensova keeps only the drafts and events that come back, not the text or the picture.
Where does it live, and who else handles it?: It is stored with Supabase in the United States. Each person's data is walled off so only they can reach it. The app runs on Vercel. Cards and billing addresses go to Stripe and never reach Pensova.
How do I get out?: Remove Pensova from your Google or Microsoft account permissions and it can no longer see or touch your calendar; the blocks it made stay as ordinary events you own. To delete the account and everything stored, email privacy@pensova.com from your sign-up address; it is done within 30 days, usually the same day. A button for this is in development.
Can I use it with my work calendar?: If it is a Google or Microsoft 365 calendar and your employer allows third-party apps, yes, and you choose which calendars count as busy. Your employer's settings for its work accounts decide what gets in, which is as it should be.

Google

Two Calendar permissions, and nothing else.

See your calendars calendar.readonly: Lists the calendars you subscribe to and sees when you are busy. Needed because free time is not only about your primary calendar: a shared work calendar and a public-holiday calendar both occupy real time.
Create and change its own events calendar.events: Creates, moves and deletes the events Pensova itself makes for your tasks. It only ever changes events it created.

No Gmail, no contacts, no Drive. Google shows the full list before you approve, and you can revoke access at any time from your Google account permissions. Pensova’s use of Google data follows the Google API Services User Data Policy, including the Limited Use requirements.

Google verified Pensova for both Calendar permissions in September 2026, after reviewing the app, its home page, its branding and this policy. Sign-in shows Google’s ordinary permission screen with no warning.

Microsoft

Three permissions, all for the calendar.

Have full access to your calendars Calendars.ReadWrite: Lists your calendars, sees when you are busy, and creates, moves and deletes the events Pensova itself makes. Microsoft has no narrower permission that covers only an app’s own events, so this one reads as full access; Pensova still only ever changes events it created.
Read your mailbox settings MailboxSettings.Read: Your time zone and working hours, so blocks land at the right hours. Not your mail.
Maintain access to data you have given it access to offline_access: Lets Pensova keep your blocks up to date between visits, and move one when a meeting lands on it.

No mail, no contacts, no files. Microsoft shows the list before you approve, and you can revoke access from Apps and services you have given access to on a personal account, or My Apps on a work or school account. Microsoft verified Pensova Corp. as the publisher in October 2026, so the permission screen shows the verified mark. A work or school account whose organization approves apps first shows “Approval required” instead; that is their policy, and the help article says what to do.

Stored

What Pensova stores.

Stored with Supabase in the US. Each person’s data is walled off so only they can reach it.

Data	What exactly	Who can read it
Account	Email address and Google or Microsoft account id.	You, and Pensova.
Tasks	Title, duration, deadline, priority, status, repeat rule, split setting.	You, and Pensova.
Task blocks	The times chosen, and which calendar event belongs to each.	You, and Pensova.
Drafts	Tasks suggested from your own words or from meeting notes, until you add or dismiss them.	You, and Pensova.
Settings	Working hours and days, first day of the week, which calendars count as busy.	You, and Pensova.
Calendar change check	A short code made from when you are busy, so Pensova knows whether to move your task blocks. It cannot be turned back into your events.	Pensova only.
Calendar keys	Needed to reach your calendar between visits. Locked so that no signed-in person can read them.	Pensova only. No signed-in user, including you.
Subscription	Plan, status, trial and renewal dates, and Stripe's reference numbers for you and your plan.	You can read it. Only Stripe can update it.

Your calendar events are not copied into the database. Pensova checks when you are busy each time it plans, then forgets it. It keeps only a short code that shows whether your schedule changed since it last looked, so it knows when to move your task blocks. The code cannot be turned back into your events.

Processed, not stored

Typed tasks, photos and meeting notes.

A task typed or spoken in plain words, pasted meeting notes, or a photo of a schedule is sent to Claude, Anthropic’s AI, together with your name and email, so the AI can tell which items are yours. Your calendar is not sent. Anthropic does not use it for training.

The rule is read, then throw away: the text is not saved anywhere. What is stored is the drafts that come back, until you add or dismiss them. Typed, spoken and photographed tasks come back as a draft you check. A task said to Siri is added straight away, and Siri tells you where it landed.

Billing

Your card never touches Pensova.

Checkout and the billing portal are hosted by Stripe. Card numbers and billing addresses go to Stripe and are never seen by Pensova. Pensova keeps a record of your plan (plan, status, trial and renewal dates, Stripe’s reference numbers) that only Stripe can update. No user can change it, so nobody can upgrade their own plan.

Regulated data

An honest position for clinicians, lawyers and anyone under a compliance regime.

Pensova is not a HIPAA-compliant product today, and it does not claim to be. Becoming one requires a Business Associate Agreement with each covered entity and with every processor beneath us, plus audit logging, sign-in that a work account’s administrator approves once, and an independent security review. That is an enterprise track, and it is not built.

What holds now, and is designed to keep holding so that track can be built on it later: calendar events are never copied into our database; the keys to your calendar cannot be read by anyone signed in; and pasted text is read and thrown away rather than stored.

In practice, an employer’s Google or Microsoft work accounts are controlled by its administrator, who will not let an outside app in without review. That is correct. A clinician can use Pensova on a personal Google account for the non-clinical half of their week today.

Reporting

Found something?

Write to security@pensova.com before telling anyone else. Good-faith reports are welcome and answered. For account deletion and privacy questions, privacy@pensova.com. The full Privacy Policy and Terms say the same things at greater length.