Your data, handled with care.

reachout is operated by the reachout team. For anything about this policy or your data, email hello@reachout.bio.

Owners (people with a reachout link).

• Account details from Google sign-in: your name, email address and profile picture.
• Everything you add to your profile: headline, bio, links, sections, availability, and files you upload such as a profile picture, cover, portfolio images, videos or documents.
• How you train your assistant: the forms, meeting types and settings you configure.
• Settings and usage information such as the pages you open and when, used to run and improve the service.

Visitors (people who reach an owner through a link).

• What you submit: your name, email address, the message or form answers, and any meeting time you request. This goes to the owner you contacted.
• A privacy-preserving view count. We derive a hashed, salted identifier from your connection to count views and clicks without storing your IP address, and we never build a profile of you across sites.

Owners can connect Google Calendar. If you do, reachout uses the Google Calendar API with your permission to:

• Read when you are busy (free/busy times only), so visitors are not offered times you already have.
• Create a calendar event for a meeting you confirm, with the visitor as a guest, and remove that event if the meeting is cancelled.
• Read the email address of the Google account you connected, so you can see which account is linked.

We store the access and refresh tokens Google issues, encrypted at rest with a key only the application holds. We do not store your calendar events or their contents. Calendar data is never used for advertising, never sold, and never shared with anyone other than the service providers listed below that host the application. No person at reachout reads your calendar data, except with your explicit consent to resolve a support request, or where the law requires it.

You can disconnect at any time from Availability in your dashboard, or from your Google Account under Security → Third-party access. Disconnecting deletes the stored tokens immediately.

reachout's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• To run the service: show your profile, deliver visitors' messages and meeting requests to you, and keep your availability accurate.
• To keep the service safe: prevent spam and abuse, rate-limit requests and protect accounts.
• To improve the product, using aggregated statistics that do not identify individuals.
• To contact you about your account, such as a new message or a confirmed meeting, when you have turned those notifications on.

We do not sell personal data and we do not use it for third-party advertising.

Your data is processed by providers that host and run reachout on our behalf, under contracts that limit what they may do with it:

• Vercel (application hosting), Supabase (database), Google Firebase (sign-in), Cloudflare (file and image storage), and Google (Calendar API, when you connect it).

Owners see what visitors send them. Visitors see what owners choose to publish. We may disclose data if required by law, or to protect the rights and safety of people using the service.

We use one essential cookie to keep owners signed in. We do not use advertising or cross-site tracking cookies. When a visitor types their name and email on a profile, those two values are kept in the browser's session storage only until the message is sent, so they do not appear in links or history.

• Owner data is kept while the account exists. Owners can export their data and delete their account from Settings; deletion removes the profile, messages, meeting requests, uploaded files and stored calendar tokens.
• Unfinished uploads and orphaned files are cleaned up automatically.
• Visitors can ask the owner they contacted, or us at hello@reachout.bio, to delete what they submitted.

Depending on where you live, you may have the right to access, correct, export, restrict or delete your personal data, and to object to certain processing. Most of this is available directly in your dashboard; for anything else, email us and we will respond within 30 days. You can also complain to your local data protection authority.

Data travels over HTTPS, sign-in is handled by Google, owner actions are verified on our servers on every request, and calendar tokens are encrypted at rest. No system is perfectly secure, so if you believe your account has been compromised, contact us right away.

reachout is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has provided us data, email us and we will delete it.

We will post any changes here and update the effective date. For material changes we will also tell owners by email or in the dashboard. Our terms of service describe the rest of the relationship.