Your crew’s data is your crew’s.

1. What we collect

Your account

• Email address, it’s how you sign in and how we send you a sign-in link. It’s also the only way to reach you.
• Display name, what your crew sees on a roster.
• Avatar, and only if you picked an illustrated face: a style name and a short random seed we draw it from. The default face is stored as nothing at all — your initial and the colour behind it are worked out from your account, not saved. Never a photo: there is nowhere to upload one, so we never hold one.
• Timezone, detected from your browser automatically — there’s nothing to set — so a notification we send while your browser is closed says “Wednesday at 19:00” on your clock, not ours.
• Sign-in method, whether you used an email link or Google, and for Google an opaque account identifier so we can recognise you next time.

We never receive or store a password. Sign-in links are single-use, and session tokens are hashed before they touch the database.

What you create

• Groups you make or join, and who else is in them.
• Events, their name, time, place and the response pattern you picked.
• Your responses on a roster: in, maybe, out, or done, in progress, not yet.
• Messages you post in an event thread, and emoji reactions.
• Your notification preferences per group, including mute and quiet hours.
• An activity log of joins, leaves, status changes and event create/cancel actions. It powers future stats and lets a group settle “I definitely said I was coming” arguments. It is not shown as a public history in the app today.

Technical basics

• A session cookie so you stay signed in, and a short-lived cookie during Google sign-in to protect against request forgery.
• Ordinary server logs, IP address, browser and requested URL, kept briefly to keep the service running and to spot abuse.
• Usage analytics, which pages are visited and the main things people do (creating a group or an event, responding, posting a message, but never what the message says), sent to Google Analytics and Mixpanel under a random account id. Sign-in and invite links are stripped from every address before it is sent.

2. What we never collect

• Passwords.
• Your contacts or address book.
• Your precise location. An event’s place is text you type.
• Payment details. Oskuad is free.
• Advertising identifiers. There are no ad trackers on this site, and the usage analytics above are never used for advertising.

3. How we use it

We use your data to run the product, and for nothing else:

• Sign you in and keep you signed in.
• Show your group the live roster, and update it in real time when someone joins.
• Send the notifications you asked for, a join, a reminder, and at most one gentle nudge per event if you haven’t responded.
• Keep the service secure, available and free of abuse.

We do not sell or rent your data, and we do not share it with advertisers.

4. Who can see your data

• Members of a group see that group’s events, rosters, messages and member list, including your display name and avatar colour.
• Anyone holding a group’s invite link can join that group, and then sees the same. Treat an invite link like a key: share it only with the people you actually want in.
• Your email address is not shown to other members.
• Us. A small number of people can access the production database when they have to, to fix a bug, restore data, or respond to a legal obligation. We don’t browse your groups for fun.

5. Who we share it with

Only the infrastructure needed to run the service, and only what each provider needs to do its job:

• Hosting and managed database providers.
• An email delivery provider, which handles your address in order to deliver sign-in links and notifications.
• Google, but only if you choose to sign in with Google. In that case Google tells us your email address, name and an account identifier. We don’t get access to anything else in your Google account.
• Google Analytics and Mixpanel, which receive page visits and product actions under a random account id so we can see how Oskuad is used. Never your email, your name, or anything you write.

We may also disclose data where the law genuinely requires it. If that ever happens and we’re allowed to tell you, we will.

6. Cookies

Oskuad sets the cookies it needs to function: one that keeps you signed in, and one that exists for a few minutes during Google sign-in to prevent a forged request. Google Analytics sets its own first-party cookies, and Mixpanel keeps an anonymous id in your browser’s local storage, both only to count visits. There are no advertising cookies.

7. How long we keep it

• Your account and content, for as long as your account exists.
• Sign-in links, single-use, and they expire shortly after being sent.
• Server logs, a short rolling window, then they’re gone.
• Group content after you leave, messages and roster history you left behind stay with the group, because deleting them would rewrite other people’s record of what happened.

8. Your choices

• Change your details, your name and avatar colour are editable in the app at any time.
• Turn notifications down, mute a group or set quiet hours, per group.
• Leave a group, you stop seeing it and it stops notifying you.
• Get a copy of your data, or delete your account, ask us and we’ll handle it. Self-serve account deletion is on the roadmap; until it ships, a request to us does the same job.

Depending on where you live you may have additional rights over your personal data, access, correction, deletion, portability, and objecting to certain processing. Ask, and we’ll do it.

9. Children

Oskuad isn’t designed for children under 13, and we don’t knowingly collect their data. If you believe a child has created an account, contact us and we’ll remove it.

10. Changes to this policy

If we change what we collect or how we use it, we’ll update this page and move the date at the top. Material changes get a notice in the app too, not a silently edited page.

11. Contact

Questions about any of this, or a request about your data? Get in touch and a human will answer.