when.work

Legal

Privacy Policy

What we collect, why, who else sees it, how long we keep it, and what you can do about it. In plain words.

Last updated October 17, 2026

when.work helps a group find a time to meet. To do that it keeps the poll and everyone's free times, and, when an organiser uses Pro, the email addresses and phone numbers of the people they invite. This policy explains, plainly, what we collect, why, who else sees it, how long we keep it, and what you can do about it. It applies to the website at when.work and the emails and text messages it sends.

1. Who We Are

when.work is operated by Nobokai, Inc., a Delaware corporation (“Nobokai,” “we,” “our,” or “us”). Polls and accounts are stored by Khanflow, Nobokai's calendar service, so signing in to when.work uses a Khanflow account. For the information described in this policy about the people who use when.work, we are the data controller: we decide why and how it is used.

When an organiser uses when.work to invite people, we process those people's details on the organiser's behalf. If when.work Holds Your Information Because of Someone Else explains what that means for them.

2. Information We Collect

Polls

  • What the organiser enters: the poll's title, days, hours, length and time zone, and the time that is picked.
  • With Autopilot (Pro): the deadline and how often to remind, and the names, email addresses and phone numbers of the people the organiser invites; whether each of them opened their link, answered or declined; and how many reminders and texts each was sent.

Answers

  • The name you give, the times you mark free, and your email address if you add it.
  • If you fill your answer from a calendar, which kind it came from (Google, Outlook or your phone's).

Your calendar, if you connect one

  • “Continue with Google” or “Continue with Outlook” asks for read-only access to your calendar, and gives us the name and email address on that account.
  • To fill your answer we ask your calendar only when you are busy during the poll's days and hours: start and end times. We do not read the titles, notes, places or guests of your events.
  • We keep the connection on your account so you don't have to connect again for the next poll. You can remove it at any time (see Your Choices and Controls).
  • If an organiser has given Khanflow permission to write to their own calendar, Autopilot adds the picked time there and invites the people who answered. Otherwise it emails everyone a calendar file.

Your account (Pro)

  • Your email address, and your name if you give it or sign in with Google or Microsoft.
  • The 6-digit codes we send to sign you in or to check your phone. We keep only a hashed form of each code, and it expires after 10 minutes.
  • The mobile number you verify to send texts.
  • Your plan, when it renews, the texts you have left, and a reference to your customer record at Stripe. Stripe takes your payment details directly; we never see or store your card.

Usage, device and diagnostic information

  • Pages you visit and buttons you press on the site. We don't attach your name or email to this.
  • A one-way hash of your IP address when you make or answer a poll, to limit abuse.
  • Error reports and server logs of requests to our service, used for security and to fix problems.
  • A record of each email and text we send: which poll, what kind of message, and whether it was delivered. For texts this record holds the number only in hashed form.

What we do not collect

  • We do not read what is in your calendar events.
  • We do not track your location, use advertising identifiers, or track you across other companies' apps or websites.

3. Emails We Send for Organisers

  • When an organiser invites people by email or turns on Autopilot, we email those people for the organiser, with the organiser's name on it: an invite with their own link, reminders while they haven't answered (as many as the organiser chose), and the picked time with a calendar file. Replies go to the organiser.
  • When the organiser picks a time, everyone who left an email address on the poll is sent it.
  • Account holders get sign-in codes and messages about their account and billing.
  • We never add anyone to a mailing list or send marketing to the people invited to a poll.

4. Text Messages (SMS)

Before we text anyone, the organiser confirms that the people they add know them and agreed to get texts about that poll, and we record when. Then we send you one text with a link to the poll, from “their name @ when.work”. After that we text you only if you opened your link: at most three reminders for that poll, never more than one a day, in the daytime. If the organiser gave only your number, you may also get one text with the time that was picked. We never send more than four texts to one person for one poll.

Organisers on Pro verify their own mobile number with a code we text to it. We text only US numbers.

Reply STOP to any text and we stop texting that number, for every poll. Reply START to allow texts again, and HELP for help.

Mobile information is never shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are never shared with any third party.

Message frequency varies. Message and data rates may apply. Reply STOP to opt out, HELP for help.

5. How We Use Your Information

  • To run when.work: show a poll and its answers, find the best time, and, for an organiser on Pro, invite the people they named, remind whoever hasn't answered, and send everyone the time that is picked.
  • To run your account: sign you in, take payments through Stripe, and count your texts.
  • To fix and improve it: find where the site breaks or confuses people.
  • To keep it safe: prevent spam, abuse, fraud and unauthorized access, limit how many polls and answers come from one place, and never text a number that has opted out.
  • To talk to you: service messages about your account and billing.
  • To meet legal obligations and enforce our Terms of Service.

An invitee's email address and phone number are used only to send the invite, the reminders and the final time for that poll. They are not added to any list and not used for marketing.

We do not sell your personal information, use it for targeted advertising, or build advertising profiles. We do not make decisions about you by automated means that have legal or similarly significant effects.

7. Who We Share Information With

We do not sell your personal information. We share it only as described here.

Service providers

These companies process information on our behalf, under contracts that limit them to doing so:

  • Amazon Web Services: hosting, servers and storage, and delivering text messages (AWS End User Messaging).
  • Supabase: our database.
  • Resend: sends our emails (invites, reminders, the picked time, sign-in codes) and tells us whether they arrived.
  • Stripe: payments and billing. Stripe takes your card details directly, under its own privacy policy.
  • PostHog: page views and clicks on the site.
  • Sentry: error reports from our servers.

Services you connect

  • Google and Microsoft, if you continue with them, with your permission through their sign-in screens. You can remove that permission at any time in your Google or Microsoft account settings.

People who see your information

  • Anyone with a poll's link sees the names given on it, each person's free times, and whether they filled them from a calendar.
  • Email addresses and phone numbers are shown only to the organiser, who also sees whether each invitee opened their link and answered.
  • People an organiser invites see the organiser's name in the emails and texts we send for them.

Other cases

  • Legal requirements: when required by law, court order or legal process, and where we believe in good faith it is necessary to protect someone's safety or our rights.
  • Business transfers: if Nobokai is involved in a merger, acquisition or sale of assets, your information may transfer as part of it. This policy will continue to apply, and we will tell you before it becomes subject to a different one.
  • With your consent in any other case.

8. How Long We Keep It

  • Polls, answers and the people invited to them: for as long as the poll exists. Ask us and we delete a poll, an answer, or an invitee's details within 30 days. When an organiser's account is deleted, the polls it made go with it.
  • Your account (plan, phone number, texts, calendar connection): until you ask us to delete it. We cancel any when.work Pro subscription first, then delete the account and everything in it within 30 days.
  • Sign-in and phone codes: kept only in hashed form, and they expire after 10 minutes.
  • Opt-outs: when you reply STOP, we keep a hashed form of your number and the date, so we never text you again, even after a poll or account is deleted.
  • Records of emails and texts we sent: as long as the account they were sent for. Text records hold the number only in hashed form.
  • Server logs and error reports: up to 30 days, longer only when needed to investigate a security problem.
  • Analytics: page views and clicks are kept in PostHog and are not tied to your name or email.
  • Payments: Stripe keeps records of payments as financial law requires.
  • Backups: deleted information may remain in encrypted backups until they are replaced in the normal cycle, up to 30 more days.
  • We may keep a small amount of information longer where the law requires it, or to resolve a dispute or prevent abuse.

9. Security

  • Information is encrypted in transit (TLS) and at rest.
  • The organiser's private link and the key that lets you change your answer stay in your browser; we store only hashed forms of them.
  • Codes and the phone numbers in our message records are hashed with a secret key.
  • Calendar connection tokens are stored securely on our servers and are never shown to anyone.
  • Access to production systems is limited to the people who need it, and we review our systems for security problems.

No system is perfectly secure. If a breach affects your information, we will tell you and the relevant authorities as the law requires. To report a security problem, email developer@nobokai.com.

10. Your Choices and Controls

  • Your answer: change it from the browser you answered in, or ask us to delete it.
  • Texts: reply STOP to any text from when.work; reply START to allow them again.
  • Emails sent for an organiser: email developer@nobokai.com and we stop them.
  • Calendar connection: remove the access in your Google or Microsoft account settings, or ask us to delete it.
  • Pro: cancel from Account, Manage billing.
  • Browser storage: clear this site's data in your browser.
  • Delete your account: email developer@nobokai.com from the address on your account.

11. Your Rights

Depending on where you live, you have some or all of these rights:

  • Access: get a copy of your information.
  • Correction: fix information that is wrong.
  • Deletion: have your information deleted.
  • Portability: get your information in a format you can take elsewhere.
  • Objection and restriction: object to, or ask us to limit, processing based on legitimate interests.
  • Withdraw consent: where we rely on your consent, at any time.

To use any of these rights, email developer@nobokai.com from the address on your account, or from the address or number the poll has for you. We may need to confirm it is you. We will answer within 30 days (45 days where US state law allows), and will not treat you differently for asking. If you are in the EEA or UK, you can also complain to your local data protection authority.

12. US State Privacy Rights

If you live in California or another US state with a consumer privacy law, this section adds to the above.

  • What we collect, in the categories those laws use: identifiers (name, email address, phone number, account IDs, hashed IP address); customer records (contact details, plan, Stripe reference); commercial information (your plan and purchases); and internet activity (pages viewed and buttons pressed).
  • Sources: you, the organiser who invited you, the calendar you connect, your browser, and Stripe.
  • Purposes and recipients: as described in How We Use Your Information and Who We Share Information With. We disclose information to service providers for business purposes only.
  • No sale or sharing: we do not sell personal information or share it for cross-context behavioral advertising, and have not done so in the past 12 months. We honor Global Privacy Control signals, though there is nothing for them to switch off.
  • Sensitive information: we do not use or disclose it to infer characteristics about you.
  • Your rights: to know, access, correct and delete, and not to be discriminated against for using them. You can use an authorized agent; we may ask them for proof of permission and ask you to confirm your identity.
  • Appeals: if we decline a request, you can appeal by replying to our answer or emailing developer@nobokai.com with “Appeal” in the subject. We will answer within 60 days.

13. If when.work Holds Your Information Because of Someone Else

You might be here because someone invited you to a poll, or you got an email or text from when.work on their behalf. In that case we hold your name, email address and phone number as the organiser entered them, whether you opened your link, answered or declined, and a record of the messages we sent you, on that organiser's poll and only to help them find a time.

  • We never contact you on our own account, never add you to a mailing list, and never sell or share your details.
  • Reply STOP to any text and no text from when.work reaches your number again.
  • To ask what we hold about you, have it deleted, or stop receiving emails sent through when.work, email developer@nobokai.com. We will act on it within 30 days.

14. International Transfers

We are based in the United States and our servers are in the United States. If you use when.work from elsewhere, your information is transferred to and processed in the United States. For transfers from the EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum), or on our providers' certification under the Data Privacy Framework, together with the safeguards in this policy.

15. Children's Privacy

when.work is not for children under 13, or under 16 in the EEA and UK. We do not knowingly collect information from them. If you believe a child has given us information, email developer@nobokai.com and we will delete it.

16. Cookies and Similar Technologies

  • The site keeps a few things in your browser's local and session storage so it works: the organiser's key to their poll, the key that lets you change your answer, your sign-in until it expires or you sign out, and a one-time code that protects calendar sign-in.
  • PostHog stores a random ID in a cookie and local storage to count visits and clicks. It is not tied to your name or email. We do not use advertising cookies or trackers.
  • You can block or delete these in your browser. If you do, this browser forgets that you organised a poll (keep your private organiser link) and can no longer change your answer.

17. Changes to This Policy

We will update this policy when what we do changes, and change the date at the top. If a change is significant, for example a new kind of information or a new company we share it with, we will tell account holders by email before it takes effect, and ask for your consent again where the law requires it.

18. Contact Us

Questions, requests or complaints about privacy:

Company: Nobokai, Inc. (Delaware, United States)
Email: developer@nobokai.com
Website: https://when.work

Google API Services User Data Policy

when.work's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, when.work asks only for read-only access to your calendar and uses it only to find when you are busy for the polls you answer. It does not use Google user data for serving advertisements or any purposes beyond the scheduling you asked for. Google user data is not used to train AI models.