與 Google 日曆的同步透過加密連線，直接在你的 iPhone 和 Google 的伺服器之間進行。同步不經過我們的伺服器，伺服器也拿不到你的 Google 登入權杖；行事曆內容只會在第 4 節說明的情況下經過我們的伺服器。權杖存在 iOS 鑰匙圈，只會送到 Google（用來更新或撤銷授權），匯出資料時也不會包含。如果你在「新增 Google 帳號」頁面輸入 email，這個地址只會傳給 Google 的登入頁，用來預先選好那個帳號。
App 不會直接連到 Gemini，也不含任何 API 金鑰。請求先送到我們的伺服器（Cloudflare Worker），伺服器確認請求來自真正的 App（見第 6 節）後，用我們自己的 API 金鑰把請求內容原封不動轉給 Google。轉送前會移除你的 IP 位址、裝置和語言標頭以及任何 cookie，所以 Google 看到的是我們的伺服器，不是你的裝置。我們的伺服器不會保存或記錄請求和回覆的內容。
Google 怎麼處理
Google LLC 收到請求後產生回覆。我們以付費服務使用 Gemini API：依 Google 對付費服務的條款，Google 不會用你的提示或回覆來改善它的產品，並依其資料處理條款處理；Google 會保留一段有限的時間（目前為 55 天），只用來偵測違反其使用政策（Prohibited Use Policy）的行為，以及法律要求的揭露；若被判定為可疑的濫用，可能由 Google 授權人員審閱。
為了防止我們的 API 金鑰和伺服器被濫用，App 會用 Apple 的 App Attest 服務證明自己是真正的 Smart Schedules。你允許 AI 資料分享時，App 會在 iPhone 的安全隔離區（Secure Enclave）產生一把加密金鑰，由 Apple 認證。我們的伺服器以金鑰 ID 為索引，保存這把金鑰的公開部分、使用次數計數器、App 識別碼和建立時間。這筆記錄不含任何內容，也沒有能指出你是誰的資訊；它目前沒有固定的到期時間，「清除這台裝置上的所有資料」也不會刪除它：App 會刪除自己手上的金鑰，但我們的伺服器目前沒有刪除這筆記錄的方式。之後的每個請求都會用這把金鑰簽署。
Google LLC：Gemini API（AI 請求，只有在你允許時）。Google 依其處理者資料處理附錄（Data Processing Addendum for Products Where Google is a Data Processor）和付費服務條款作為我們的處理者，這些條款不允許它用你的請求改善自己的產品（見第 4 節）。另外，Google 日曆和 Google 登入是你直接使用的 Google 服務，適用 Google 隱私權政策。
Apple Inc.：App Attest、App Store、Siri 和語音辨識，適用 Apple 自己的條款。
Google（Google Workspace）：客服信箱 support@smart-schedules.com 使用的 Gmail，接收和保存客服信件，也用來寄出我們的回信（第 9 節）。Google 依 Google Workspace 適用的雲端資料處理附錄（Cloud Data Processing Addendum）作為我們的處理者。
Your calendar goes straight between your iPhone and Google. The Smart Schedules server never gets your Google sign-in tokens and does not sync your calendar.
The AI assistant sends nothing until you tap Allow. After that, your request and related calendar details go through our server to Google's Gemini API to be understood. Our server passes them on without keeping them. The calendar details the app adds do not include your Google account email addresses.
Live Activities in the Dynamic Island and on the Lock Screen are created on your iPhone: your events don't leave it for them, and our server keeps none of your events.
No ads, no tracking, no analytics, and we never sell your data.
You can stop sharing, remove a Google account, and export or erase your data in the app at any time.
1. Who we are
Smart Schedules (the iPhone app, including its Live Activities, Control Center control, notification extension, Siri and Shortcuts actions) and this website, www.smart-schedules.com, are provided by [開發者名稱 / Developer name] ("we", "us"). We are responsible for the processing described in this policy (in the terms of the UK GDPR and similar laws, the controller). Contact: support@smart-schedules.com.
Smart Schedules has no accounts of its own. To use your real calendar you connect a Google account. You can also tap "Try without signing in" to use demo mode. Demo mode uses sample calendars, never contacts the AI and sends none of your calendar data. (If you allowed AI data sharing earlier, the app still renews its session with our server in demo mode; see section 6.)
2. Data stored on your iPhone
Smart Schedules keeps the following on your device. Except as described in sections 3 and 4, it does not leave your iPhone:
A copy of your events (from 7 days ago to 120 days ahead, plus any other dates you open): title, times, location, video-call link, notes, colours, identifiers and suggested notes. Guest lists are not stored.
Your connected Google accounts (email addresses), their calendar lists and your settings for each calendar.
Changes waiting to be sent to Google while you are offline.
Your settings, "What the assistant remembers" (including the words you used to change a setting) and suggestions learned from your habits.
Your chat history with the assistant: at most the last 200 messages, kept for 30 days by default (you can choose 7 days, 30 days or forever). Chat history is never sent anywhere; the assistant only sees the current conversation (see section 4).
Google sign-in tokens, in the iOS Keychain.
Your answer to the AI data-sharing question.
These files are protected by iOS data protection and shared only among the app's own parts (the app, its Live Activity and Control Center extension and its notification extension). Event details also appear on your device in notifications and Live Activities; reminders are local notifications created on your iPhone. App data can be included in your iCloud or computer backups, which you control.
3. Google Calendar and your Google account
When you connect a Google account, you sign in on Google's own page; we never see your password. The app asks Google for these permissions:
openid and email: to know which Google account you connected and to show its address.
calendar.events: to show your events, and to create, change and delete events when you (or the assistant, at your request) do so.
calendar.calendarlist.readonly: to list your calendars, with their names and colours, so you can choose which to show and where new events go.
Syncing with Google Calendar happens directly between your iPhone and Google's servers over encrypted connections. Our server is not involved in syncing and never receives your Google sign-in tokens; calendar details reach our server only as described in section 4. Tokens are kept in the iOS Keychain, are sent only to Google (to refresh or revoke access) and are never included in an export. If you type an email address on the Add Google account page, it is passed only to Google's sign-in page, to pre-select that account.
What Smart Schedules writes to Google Calendar:
Events the assistant creates begin their description with "由 Smart Schedules 智慧助理自動排程：" ("scheduled automatically by the Smart Schedules assistant:") followed by your request. Anyone who can see the event, including guests and people you share the calendar with, can read it.
If your request includes someone's email address, the assistant may add them as a guest, and Google then emails them an invitation.
A few hidden markers the app uses (such as the event type or the plan it belongs to) are stored in the event's private properties.
Your Google Calendar data stays in Google: removing an account or erasing data in Smart Schedules does not delete anything from Google Calendar. Google's handling of your account is covered by the Google Privacy Policy.
4. The AI assistant (Google Gemini)
Smart Schedules uses Google's Gemini API to understand requests in everyday language (for example "lunch with Joe tomorrow at noon"). This is the only feature that sends your calendar data outside Google Calendar.
Only with your permission
Nothing is sent to the AI until you tap Allow in the "Use the AI assistant?" dialog (you can also allow it in Settings › AI & privacy). This applies everywhere the assistant works: the chat, Quick Capture, Siri and Shortcuts, replies from a reminder notification, and AI suggestions on an event page. Demo mode never contacts the AI.
The explanation in the app (the consent dialog, and Settings › AI & privacy › What is sent) reads:
To understand your requests, Smart Schedules sends them to Google's Gemini API. This includes:
What you type or say to the assistant (spoken requests as text), including any names or email addresses you mention
Titles, times, notes and Google event IDs of up to 40 events in the 14 days from today, and of the event whose reminder you reply to
For AI suggestions on an event: that event only, including its location
Your calendar names and assistant settings, but not your Google account email addresses
Your time zone and language
Recipient: Google, through the Gemini API. Requests pass through the Smart Schedules server, which doesn't keep them.
It also explains that Apple turns speech into text (see section 8). The full details follow.
What a chat request contains
What you type, or what you say transcribed to text, including any names or email addresses in it (except the addresses of the Google accounts you connected; see below).
Your local date and time, time zone and device language.
Your assistant settings.
The names of the calendars you can add events to, and which one new events go to by default. They do not include your Google account email addresses: with several Google accounts, the accounts are told apart by names such as "Account 1" and "Account 2" (in the order you added them), and a calendar whose name is an email address (such as a calendar someone shared with you) is called "Shared calendar".
Up to 40 of your events in the 14 days starting today: Google's event ID, title (first 60 characters), start and end, whether it is all-day, repeating or part of a plan, its calendar's name, whether you can edit it, and its notes (up to 300 characters). Locations, guests and video-call links are not included.
When relevant: events waiting for your confirmation ("Ask me first"), the event a reminder is about, and a long-term plan you are reviewing.
The last few turns (up to 6) of the current conversation, including the results of the assistant's actions (such as the title and time of an event it just created) and error messages. These are held in memory only; your saved chat history is never sent.
For AI suggestions on an event page, only that event is sent: its title, date, time and duration, location, notes (up to 300 characters), whether it is a video call, your time zone, today's date, language and the suggestions already shown.
If the address of a Google account you connected appears in what you type or say, in an event's title, location or notes, or in an error message sent back to Gemini, the app replaces it with a placeholder such as "[account email]" or "[Account 2 email]" before sending; any other email address in an error message becomes "[email address]". When Gemini's answer uses these placeholders, your iPhone puts the address back before it writes to Google Calendar or shows you the answer. The rest of what you type or say is sent as it is, including other people's email addresses.
Your requests and events may contain other people's information, such as names and email addresses you type, invitations from other people, or the names of calendars shared with you. Please share only what you are entitled to share.
How it travels
The app never contacts Gemini directly and contains no API key. Requests go to our server (a Cloudflare Worker), which checks that they come from the genuine app (see section 6) and passes the request content unchanged to Google with our own API key. First it removes your IP address, device and language headers and any cookies, so Google sees our server, not your device. Our server does not store or log the content of requests or answers.
What Google does with it
Google LLC receives the request and generates the answer. We use the Gemini API as a paid service: under Google's terms for paid services, Google does not use your prompts or the responses to improve its products, processes them under its data processing terms, and keeps them for a limited period (currently 55 days) only to detect violations of its Prohibited Use Policy and for legally required disclosures, which may include review by authorized Google staff if activity is flagged as possible abuse.
What comes back
The answer is shown to you, and the actions you asked for, such as adding, moving or deleting events or changing a setting, are carried out by your iPhone. Suggested notes stay on your iPhone until you add them.
Stopping
Settings › AI & privacy › Stop sharing stops the assistant from sending anything, immediately. What was already sent cannot be recalled from Google's abuse-monitoring logs (see section 13).
5. Dynamic Island and Live Activities
Live Activities (the countdown before an event in the Dynamic Island and on the Lock Screen) are created on your iPhone by the app, from the events already on it. This needs no AI data sharing, sends none of your event details to our server and uses no server push (Smart Schedules does not use the Apple Push Notification service):
iOS 26 and later: each time you open Smart Schedules, it schedules the Live Activities for the next two days on your iPhone. When one is due (your Dynamic Island lead time before the start, for example 30 minutes), iOS shows it even if the app isn't open.
iOS 18: iOS 18 doesn't let apps schedule Live Activities ahead, so an event appears only if you open Smart Schedules within the lead time before it starts or while it's under way. Once it appears, it stays after you close the app.
Reminders are local notifications created on your iPhone too (section 2). You can turn Live Activities off in Settings › Notifications › Dynamic Island › Show next event › Off.
6. App Attest, device identifiers and server security
To keep our API key and server from being misused, the app proves it is the genuine Smart Schedules app with Apple's App Attest service. When you allow AI data sharing, the app creates a cryptographic key in your iPhone's Secure Enclave, and Apple certifies it. Under the key's ID, our server keeps the key's public part, a usage counter, the app identifier and when it was created. This record holds no content and nothing that identifies you. It currently has no fixed expiry, and "Erase all data on this device" does not remove it: the app deletes its own copy of the key, but our server currently has no way to delete the record. Every later request is signed with this key.
The notification extension cannot use App Attest, so it uses a session token the app obtains for it. While AI data sharing is allowed, the app renews this session every few days, in the background or when you open the app, even if you don't use the assistant; each renewal is a signed request to our server. Our server keeps only a one-way hash of the token, with the key ID, for 7 days.
Rate limiting. To block abuse, our server counts requests per App Attest key and per IP address. IP addresses are reduced to a network block (an IPv4 address as is, or the first half, the /64, of an IPv6 address) and used only for this: as per-minute counts in Cloudflare's rate limiter and, after a successful App Attest check, in a daily count kept for up to 2 days. Request counts per key are kept for up to 2 days. IP addresses are never logged and never passed on to Google.
Logs. Our server writes short technical log entries (event types, App Attest key IDs, the app identifier, status codes, error messages and counts) to find faults and abuse. They are designed never to contain request content, event titles, tokens or IP addresses, and Cloudflare keeps them for up to 7 days. Cloudflare's automatic per-request logs are turned off.
Cloudflare, which runs our server, necessarily processes connection data such as your IP address to deliver traffic and protect its network.
7. Purchases
Smart Schedules 1.0 has no in-app purchases or subscriptions, and the app does not check your purchase history, so we receive and process no purchase or payment data. Apple handles downloads of the app through the App Store, under the Apple Privacy Policy. If a later version offers purchases, we will update this policy first.
8. Siri, speech input and other Apple services
Siri and Shortcuts: when you speak, Apple processes your voice and gives the app the text, which then follows the rules in section 4.
Speech input: when you tap the microphone button, or open Quick Capture with the microphone button in the expanded Dynamic Island, Apple's speech recognition turns what you say into text until you tap the microphone button again or send. By default this happens on your iPhone. If you turn off Settings › Assistant › On-device recognition, or your language has no on-device model, the audio is sent to Apple to be transcribed. Only the resulting text goes to the assistant.
App Attest: see section 6.
Analytics: if you have chosen to share with app developers (iPhone Settings › Privacy & Security › Analytics & Improvements), Apple may give us crash reports and usage statistics. Apple does not include your name or contact details.
The Apple Privacy Policy covers these services.
9. When you contact us
If you email support@smart-schedules.com, we receive your email address and whatever you send, and use them only to reply and help you. This mailbox uses Google Workspace from Google: mail to this address is received and stored directly in Gmail, and we reply from the same mailbox (see section 12). We keep support emails only as long as needed to handle your request and any follow-up, then delete them; after that, Google removes them from its systems within a limited period under its data processing terms with us.
10. This website
This website, www.smart-schedules.com, uses no cookies, analytics, ads or third-party code. Cloudflare hosts it and processes your IP address and browser information to deliver the pages and protect the site.
11. Google user data and Limited Use
Smart Schedules' use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
In particular:
We use Google user data (your calendar data and your Google account's email address) only to provide the features you see in the app: showing which accounts you connected, showing, creating and changing your events, reminders and Live Activities, and the AI assistant you have allowed. Your Google account's email address is used only on your iPhone, to show and tell apart your accounts, and is not sent to Gemini.
We transfer it only to Google's Gemini API (only with your permission, to answer your requests, passing through our server, which doesn't keep it; only the calendar data described in section 4, never your accounts' email addresses). Otherwise we transfer it only where needed for security, to comply with the law, or, as part of a merger, acquisition or sale of assets, only after obtaining your explicit prior consent.
We do not use it for advertising, do not sell it, and do not use it to determine creditworthiness or for lending.
No one on our side reads it unless you ask us to (for example in a support email you send), it is needed for security (such as investigating abuse), or the law requires it (for Google's own abuse review, see section 4).
We do not use Google user data, or data derived from it, to develop, improve or train any AI or machine-learning models, generalized or personalized, and we do not allow anyone else to do so. The Gemini API uses it only to answer your request, under paid-service terms that do not allow Google to use it to improve its products.
12. Who receives data
We do not sell or rent your personal data, or share it for advertising, and we do not track you across apps or websites. Smart Schedules contains no advertising, analytics, crash-reporting or tracking software, does not use the advertising identifier, and does not access your location, your contacts or the iPhone's built-in Calendar app.
Service providers that help us run Smart Schedules:
Cloudflare, Inc. runs our server, its storage and logs, and this website, as our processor under its Data Processing Addendum.
Google LLC provides the Gemini API (AI requests, only with your permission), as our processor under its Data Processing Addendum for Products Where Google is a Data Processor and its paid-service terms, which do not allow it to use your requests to improve its products (see section 4). Separately, Google Calendar and Google sign-in are Google services you use directly, under the Google Privacy Policy.
Apple Inc. provides App Attest, the App Store, Siri and speech recognition, under Apple's own terms.
Google (Google Workspace) provides Gmail for our support mailbox, support@smart-schedules.com, which receives and stores support messages and sends our replies (section 9), as our processor under the Cloud Data Processing Addendum that applies to Google Workspace.
Each of these providers is bound by contract or by its own terms to protect your data at least as well as this policy describes, and to use it only to provide its service to us or to you.
We may also disclose data where the law requires it or where necessary to protect rights and safety. If Smart Schedules is transferred to another provider, existing data remains protected by this policy, and Google user data is transferred only after obtaining your explicit prior consent.
13. How long we keep data
Retention
Data
Kept for
Data on your iPhone (events, settings, accounts, tokens)
Until you remove the account, erase data or delete the app; chat history 30 days by default
AI request content on our server
Not kept
AI requests at Google (Gemini paid service)
Up to 55 days, only for abuse monitoring (which may include review by authorized Google staff if activity is flagged as possible abuse) and legally required disclosures
App Attest key record
No fixed expiry (no content, not linked to your identity)
Session token hashes
7 days
IP network blocks used for rate limiting
Up to 2 days
Request counts
Up to 2 days
Server logs
Up to 7 days
Support emails (in Gmail, Google Workspace)
As long as needed for your request and any follow-up, then deleted
Deleting the app removes its files from your iPhone, but iOS may keep Keychain items such as sign-in tokens, and the app's access to your Google account remains until you revoke it. Before deleting the app, use "Erase all data on this device" while you're online, then check that Smart Schedules no longer appears under Third-party apps & services in your Google Account (and remove it there if it does).
14. Security
All connections are encrypted (HTTPS/TLS).
Sign-in tokens are kept in the iOS Keychain, and the app's files are protected by iOS data protection.
App Attest ensures that only the genuine app can use our server; the AI API key stays on the server.
Our server removes identifying headers, does not store request content, and what it does store expires quickly.
No method is completely secure. If a security incident affects your data, we will take appropriate steps and give notice as the law requires.
15. Your choices and rights
Providing data is voluntary: without AI data sharing, the AI assistant is unavailable; without a Google account you can't use your real calendar, but you can still use demo mode.
In the app (takes effect immediately)
To open Settings, tap ☰ at the top left › General.
Stop AI data sharing: Settings › AI & privacy › Stop sharing.
Remove a Google account: tap your avatar at the top right, swipe left on the account (or tap ⋯) › Remove account; or use the ⋯ next to the account's email in the ☰ menu. This asks Google to revoke the app's access and deletes that account's tokens and cached events from your iPhone. Revoking needs an internet connection; if you were offline, remove Smart Schedules under Third-party apps & services in your Google Account (next item).
Export: Settings › Data › Export my data creates a JSON file with your settings, what the assistant remembers, accounts and calendars, cached events, chat history and AI data-sharing status (never sign-in tokens).
Erase: Settings › Data › Erase all data on this device stops Live Activities, withdraws AI data sharing, removes notifications, asks Google to revoke access and deletes every sign-in token, then deletes accounts, cached events, pending changes, settings, chat history and exports. Revoking access needs an internet connection; if you were offline, remove Smart Schedules under Third-party apps & services in your Google Account. For what remains on the server, see sections 6 and 13.
Chat history: Settings › Data › Keep chat history / Clear chat history.
Keep speech on the device: Settings › Assistant › On-device recognition.
Delete the events themselves: in Google Calendar.
By email
Depending on where you live (for example the UK, California or Taiwan), you may have the right to access, obtain a copy of, correct or delete your data, to restrict or object to its processing, to data portability, and to withdraw consent. Most of your data is on your device, and the tools above put you in control of it. Data on our server is linked only to random IDs, not to your name or email, so we usually cannot find it from your identity, and most of it expires within days. Write to support@smart-schedules.com and we will reply within the time the law requires. You can also complain to your data protection authority, such as the Information Commissioner's Office (ICO) in the UK.
Right to object: where we rely on legitimate interests (see the legal bases below: security and abuse prevention, this website, support emails and crash reports from Apple), you can object at any time by emailing support@smart-schedules.com.
Legal bases (where the UK GDPR or similar laws apply)
Consent: AI data sharing (section 4). You can withdraw it at any time; withdrawing consent does not affect processing done before you withdrew it.
Legitimate interests: security and abuse prevention (section 6), delivering this website, answering your support emails (section 9), and the crash reports and usage statistics Apple shares with your permission (section 8).
Legal obligations: responding to lawful requests.
16. Minimum age
You must be 18 or older to use Smart Schedules, and its App Store age rating is 18+. This is because Google's Gemini API terms require users to be 18 or older and do not allow use in services directed at, or likely to be used by, people under 18. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has used Smart Schedules, contact us, or simply erase all data on that device.
17. International transfers
Our server runs on Cloudflare's global network: requests are usually handled in a Cloudflare data center near you, and stored data is kept in Cloudflare's central storage, which has no fixed region, and may be cached worldwide. Google and Apple process data in their own global infrastructure, including in the United States. Cloudflare relies on the EU-U.S. Data Privacy Framework and its UK Extension (which covers users in the UK), and Standard Contractual Clauses for transfers. Google processes Gemini requests under its Data Processing Addendum for Products Where Google is a Data Processor, which relies on Standard Contractual Clauses for transfers, and Google LLC is also certified under the EU-U.S. Data Privacy Framework and its UK Extension. Support emails are stored in Google Workspace, which Google processes under its Cloud Data Processing Addendum; transfers follow the terms of that addendum (a transfer mechanism Google has adopted, such as the Data Privacy Framework, or Standard Contractual Clauses).
18. Changes to this policy
We will post updates on this page and change the effective date. Significant changes will be clearly marked here, and if a change affects what the AI assistant sends, the app will ask for your permission again before sending anything.
Smart Schedules