COMPLIANCE

Google API Data Disclosure.

How Arena uses data obtained through Google APIs.

This page describes how Arena uses data obtained through Google APIs, in compliance with the Google API Services User Data Policy including the Limited Use requirements.

OAuth 2.0 Scopes Requested

Scope	Google description	Why Arena requests it
`https://www.googleapis.com/auth/calendar.events`	See, edit, share, and permanently delete all calendars you can access using Google Calendar	Required to create a single calendar event when a meeting is confirmed between two Arena members. Without this scope, Arena cannot write to a member's calendar.
`https://www.googleapis.com/auth/calendar.readonly`	See and download any calendar you can access using your Google account	Used to query the freeBusy endpoint to determine when a member is available for scheduling. No calendar content is read — only busy/free time intervals.

Note on scope breadth: Google's consent screen describes the maximum capability of each scope string, not Arena's actual usage. Arena only calls two Calendar API endpoints — see below.

API Endpoints Called

Arena's server-side code calls exactly two Google Calendar API endpoints:

1. freeBusy query

Used to determine a member's availability when suggesting meeting times. Arena calls this before presenting scheduling options to the other party.

POST https://www.googleapis.com/calendar/v3/freeBusy

Request body:
{
  "timeMin": "<ISO 8601 datetime>",
  "timeMax": "<ISO 8601 datetime>",
  "items": [{"id": "primary"}]
}

Response (all Arena receives):
{
  "calendars": { "primary": { "busy": [ {"start": "...", "end": "..."} ] } }
}

The freeBusy endpoint returns only start/end timestamps. It does not return event titles, descriptions, attendees, locations, video links, or any other event data. This is a property of the API itself — the response schema contains only time intervals.

2. Event creation

When both members confirm a meeting time, Arena creates one calendar event on each member's primary calendar.

POST https://www.googleapis.com/calendar/v3/calendars/primary/events

Fields written by Arena:
{
  "summary": "Arena: [Member A] & [Member B]",
  "start": {"dateTime": "...", "timeZone": "..."},
  "end": {"dateTime": "...", "timeZone": "..."},
  "attendees": [{"email": "..."}, {"email": "..."}],
  "conferenceData": { ...Zoom link... }
}

Arena does not read, edit, or delete any other events on the member's calendar, including historical events, recurring series, or events created by other applications.

Data Handling and Storage

Data type	Stored?	Shared with third parties?
OAuth access token	Yes — stored encrypted in Firestore to make API calls on the member's behalf	No
OAuth refresh token	Yes — stored encrypted in Firestore to refresh access tokens	No
freeBusy time intervals	No — used transiently to compute scheduling availability and discarded	No
Event content (titles, descriptions, attendees, etc.)	Never read	Never read
Created meeting event details	Meeting time, Zoom link, and participant names are stored in Arena's own database as part of the meeting record	No

Limited Use Compliance

Arena's use of data received from Google APIs is limited to the following, in accordance with the Google API Services User Data Policy Limited Use requirements:

Providing or improving user-facing features that are visible and prominent in Arena's UI
Transferring data only as necessary to provide the scheduling feature described above, or as required by law

Arena does not:

Use Google Calendar data to serve advertisements
Allow humans to read Google Calendar data except when a user explicitly requests Arena do so, or when required for security or legal compliance
Use or transfer Google Calendar data for credit-worthiness determinations or lending purposes
Transfer Google Calendar data to third parties
Use Google Calendar data for any purpose other than providing the Arena scheduling feature

Revoking Access

Members can disconnect Google Calendar at any time from Settings → Calendar inside the Arena app. Disconnecting immediately revokes Arena's access token — no further API calls will be made on the member's behalf.

Access can also be revoked directly from myaccount.google.com/permissions by removing Arena from the list of apps with Google Account access.