We will never sell or share your Reclaim data with a third party for profit or comarketing purposes; that is not our current business model and never will be. 

We will never access or look at your calendar data unless you ask and give us permission in a support scenario, or in extremely rare cases where it may be necessary to do so to fix a critical emergency with your Reclaim account.

We do use tools like Intercom to communicate with you and troubleshoot support issues, and in order to do that job we have to share your email address with that software. If we didn’t send it there, we couldn’t contact you to help you resolve a support issue, nor could we contact you to let you know about new features in Reclaim that you can take advantage of.

Even in cases where we send data to a third party in the normal course of business, however, we make every effort to redact and remove PII and replace it with an anonymized, unique user ID specific to your Reclaim account. For example, we use Google Analytics to measure site traffic, but we don’t ever send PII to that software — because it’s simply not necessary for us to do that job.

See a complete list of 3rd party tools that we work with as subprocessors.

From the very beginning, Reclaim has been proud to offer a self-service delete capability. You can click a button in your account, confirm the deletion, and our software will automatically kick off a job to wipe all your calendar data from our systems within one hour, and also clean up your calendar to remove any Reclaim-created events. It’s that simple.

We fundamentally believe that deleting your data or your account shouldn’t be difficult. Obviously, we’re happier if you love Reclaim, but we view it as our job to earn that love — not to prevent you from leaving once you’ve signed up. We’ve invested significant engineering effort into ensuring your data gets properly purged from our systems, and we’re happy to provide additional confirmation if you’d like.

Want to learn more? Read this help article.

As with permissions, we believe that we should never store data unless it’s absolutely vital to performing the core mission of our software. To that end, Reclaim takes the following stance on storing your calendar data:

• Reclaim does store data from the primary calendar associated with your Reclaim account. That means that the primary calendar associated with the email you use to sign up for Reclaim will be stored in Reclaim’s databases. We have to store this data, because it allows us to do things like reschedule your Tasks and Habits when conflicts occur, use prediction services to flip events between free and busy, and run processing against your events to automatically categorize them.
• Reclaim does not store data from any other calendars that you’ve connected to Reclaim for the purposes of using Calendar Sync. We only need to hold that data in memory to make a synced copy of the event, and then we throw the data away as soon as that job is complete.

Reclaim currently has four integrations that require permission scopes in order to use them:

• Google Calendar
• Microsoft Calendar
• Slack Integration
• Google Tasks
  
• Google Mail / Gmail
  

Here is a brief overview of the permissions we ask for across these integrations. For more technical details, please check out the “Want More Details?” section below.

You can find more detailed information about Reclaim’s architecture, security policies, and other technical information below or at our Trust Center (https://trust.reclaim.ai)

You can also contact us at [email protected] or schedule time to meet with our security team directly. We’re happy to chat!

Reclaim is SOC2 Type II certified as of September 2023, and was renewed in 2024. SOC2 Type II is the highest standard for security certification and compliance, and we're proud to have achieved it. If you're an IT or security representative for your company and are interested in getting more information about our SOC2 report, please contact us.

As a company, Reclaim is committed to complying with the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). We understand how important it is for our EU and California users and companies to feel secure and confident using Reclaim, and to that end we've incorporated those standards into our data and privacy practices.

Reclaim has self-serve data deletion processes and a Data Processing Addendum that is incorporated into our Business Terms of Service. Since GDPR is a relatively new and broad regulation that lacks a certification process, we have no mechanism to validate that we are complying with GDPR. However, through our efforts, good-faith improvements and discussions with Legal and Privacy consultants, we are confident that we are in compliance, both now and in the future.

If you are a company and sign up for Reclaim using our Business Terms of Service, our DPA is automatically in place for you. If you would like to get a signed copy of Reclaim's DPA, please contact us and we will be happy to send a pre-signed version over to you.

Below are some details for commonly asked questions regarding how to we access and interact with your Google Calendar:

• Connection and authentication to Google Calendar is via Google OAuth
• The Google OAuth ID for Reclaim is: 220938082027-gkc85db1dueubr544ps9svgtlec4608l.apps.googleusercontent.com
• Reclaim uses Google APIs and is not a marketplace app. We use the following APIs to access your Google data:
• Google Calendar API
• Google Tasks API
• Reclaim is enabled per user and not domain-wide.

We are very thankful to security researchers who help identify vulnerabilities in our service, as it benefits both us and our customers. 

Please see our Responsible Disclosure Policy for how to report security vulnerabilities, and know that every submission is read and investigated by a real person. Our team will work quickly to validate and assess the level of risk, and take action as needed in the best interests of protecting your data.

Please see our subprocessors page for a list of subprocessors Reclaim uses as well as their respective security and compliance policies.