Google User Data Disclosure

1. What Google Data We Access

Google Sign-In (all users)

Any user (student, instructor, or school owner) may create an account or sign in using their Google account via the standard OAuth 2.0 / OpenID Connect flow. When they do, DriveDate receives:

• Google account ID (used as a stable identifier to link the account)
• Display name (split into first name and last name and stored in the user profile)
• Email address (used as the primary account identifier)
• Profile picture URL (stored as the user's avatar)

OAuth scopes requested during Sign-In:

No calendar, drive, or any other Google service scope is requested during Sign-In. New students who sign in with Google have an account created automatically; instructors and school owners who use Google Sign-In must still complete the invitation/onboarding flow.

Google Calendar integration (instructors only, optional)

This is a separate, optional step from Sign-In. An instructor who already has a DriveDate account may choose to connect Google Calendar from their dashboard settings. This triggers a second, distinct OAuth consent that requests the additional calendar scope. DriveDate then accesses:

• List of calendars in the instructor's Google account (to locate or create the DriveDate calendar)
• Events in the instructor's calendars – titles and start/end times only – to detect scheduling conflicts
• Events we create, update, or delete in the dedicated “DriveDate Schedule” calendar

Additional OAuth scope requested during calendar connection:

Why we need the full calendar scope: We use the Google Calendar push notification API (calendar.events.watch()) to receive real-time updates when the instructor's availability changes. This API requires the calendar scope. We also call calendar.calendars.insert() to create the dedicated DriveDate calendar, which also requires this scope. Narrower scopes (calendar.events) do not support these operations.

2. Why We Access Google Data

3. How We Use Google Data

• Sign-In data (name, email, profile picture): Used to create or authenticate a DriveDate account, pre-fill the user's profile, and display their avatar. New student accounts created via Google Sign-In are set up immediately without a separate onboarding step.
• Google account ID: Stored as a stable identifier to match returning Google users to their existing DriveDate account.
• Calendar data (instructors only): Used exclusively to manage the instructor's DriveDate lesson schedule and availability. It is not used for advertising, profiling, or any purpose unrelated to the booking service.
• OAuth refresh tokens: Stored encrypted in our database and used solely to make authorised API calls on behalf of the instructor when calendar events need to be created, updated, or deleted. Sign-In sessions use short-lived JWT tokens managed by NextAuth; no long-lived token is stored for Sign-In-only users unless they also connect Google Calendar.

4. What We Do NOT Do with Google Data

5. Data Storage and Security

Google OAuth tokens are stored in our PostgreSQL database hosted on Railway. Access tokens are short-lived and refreshed automatically. Refresh tokens are used only when the server needs to make an authorised API call on behalf of the instructor. All database connections use TLS encryption. We do not log or cache raw token values in application logs.

6. How to Revoke Access

You can disconnect DriveDate from your Google account at any time by either:

1. Going to your DriveDate dashboard settings and clicking “Disconnect Google Calendar”. This stops push notifications and removes stored tokens from our database.
2. Visiting myaccount.google.com/permissions and revoking DriveDate's access. This immediately invalidates the tokens; DriveDate will detect the revocation on the next API call and de-link the calendar automatically.

After revocation, we delete the stored OAuth tokens from our database within 24 hours. Booking history and lesson events already created in Google Calendar are not automatically deleted; you can remove them manually from Google Calendar.

7. Scope Justification (Google OAuth Verification)

The following table justifies each OAuth scope DriveDate requests, in accordance with Google's minimum-scope requirement. DriveDate uses two separate OAuth consent flows – one for Sign-In and one for Calendar integration – so users only see the scopes relevant to what they are doing.

Note: Because the calendar scope is a sensitive scope, DriveDate is subject to Google's OAuth app verification requirements for the Calendar integration flow. We are undergoing (or have completed) Google's verification process. The basic Sign-In flow (openid, email, profile) does not require sensitive-scope verification.

8. Contact

For questions about how we handle Google user data, please contact our Privacy Team: