RoomKnit Privacy Policy
Effective date: October 15, 2026 Who we are: RoomKnit is a product of Sterlacci Brothers LLC, Henderson, Nevada, USA ("we", "us"). Contact: michael@sterlaccibrothers.com
1. The short version
- RoomKnit keeps a meeting room's calendar in sync across Google Calendar, Microsoft Outlook and Apple Calendar, so people can book the room from the calendar they already use.
- To do that, a workspace owner or admin connects the company's rooms account (the Google, Microsoft or Apple account that owns the room calendar). RoomKnit reads and writes events only on the calendar you pick as the room calendar. The one exception is the list of calendar names, which is used only so you can choose which calendar is the room.
- We do not sell your data. We do not show ads. We do not use calendar data for advertising, profiling, credit decisions or AI model training.
- You can disconnect a calendar at any time, and you can ask us to delete your data by emailing michael@sterlaccibrothers.com.
2. Information we collect
2.1 Your RoomKnit account
- Your name, email address and the workspace (company) name you enter.
- Your password. We store only a one-way scrypt hash, never the password itself.
- Your role in the workspace (owner, admin or member), the color and icon you pick, which calendar apps you say you use, and when you last signed in.
- Sign-in sessions. We store a hashed session token, when it was created and last used, when it expires, and your browser's "user agent" text. RoomKnit sets one sign-in cookie. There are no advertising or analytics cookies and no third-party tracking scripts.
- Invitations: the email address invited, the role, which rooms they get, and when the invite was accepted, revoked or expires.
2.2 Calendar connections (Google, Microsoft, Apple)
- When an owner or admin clicks Connect Google or Connect Outlook, the provider gives RoomKnit an access token and a refresh token. We store both encrypted at rest, plus the RoomKnit user who connected and the result of our periodic "is this connection still working?" check.
- For Apple Calendar (CalDAV), we store the Apple ID and an app-specific password, both encrypted.
- We never see or store your Google or Microsoft password.
2.3 Data we access from Google Calendar (Google user data)
With your permission, RoomKnit uses the Google Calendar API to:
| What RoomKnit does | Google data involved | What we store |
|---|---|---|
| Show the calendars on the connected rooms account so you can pick the room calendar | Each calendar's ID and name | Only the ID and name of the calendar you pick for each room |
| Read events on the room calendar to keep the room in sync (by default from 7 days ago to 30 days ahead, checked about every 10 minutes) | Event ID, status, title, description, start and end time and time zone, last-updated time, creator, organizer (name and email), attendee email addresses | Each event as a RoomKnit booking: title, description, times, organizer name and email, attendee emails, and the Google event ID |
| Create, update and delete events on the room calendar when someone books, changes or cancels in RoomKnit, or in a linked Outlook or Apple room calendar | The event we write: title, description (including a short "booked by" note with the booker's name and email), times, attendee emails, a color, and a private RoomKnit booking ID tag | The Google event ID, so we can update the same event later |
| Share the room calendar with a teammate, and remove that access when they leave the workspace or lose access to the room | The room calendar's sharing list (we add or remove the teammate's email address with "make changes to events" access). Google then emails the teammate about the share. | The teammate's email is already in their RoomKnit account. If a removal fails, we keep a note (email, calendar ID, reason) so the owner can retry. |
| Disconnect | Your refresh token, which we send to Google's revoke endpoint | We then delete the stored tokens and unlink the room calendars |
RoomKnit does not read events on any calendar other than the room calendar you picked. It does not read your Gmail, contacts, Drive files or Google profile.
2.4 Data we access from Microsoft (Outlook / Microsoft 365)
The same sync, share and disconnect functions, through Microsoft Graph with these permissions: Calendars.ReadWrite, User.Read (the name and email of the account that connected), offline_access, openid and profile. We store the same booking fields listed above, plus the Outlook event and calendar IDs.
2.5 Help, feedback and "Report a problem"
When you choose to send a report or suggestion:
- We store what you type, the page you were on, your workspace and role, your browser's user agent, the app version, recent error messages, and recent failed requests (method, path and status code only).
- If you attach one, we store a screenshot. Screenshots can show calendar details on your screen, so only attach one if you're comfortable with that.
- Before saving, we automatically strip passwords, tokens, cookies, authorization headers, web-address query strings and raw calendar-file contents from the text.
- Reports may be copied, without the screenshot, into an issue in our private GitHub repository so we can fix the problem.
- Spencer self-help and "Suggest a feature": the text you type in these boxes is sent to OpenAI (model gpt-4o-mini) so it can be matched to a help article or feature theme. Each person is limited to a few such checks per hour. No Google Calendar data, screenshots or tokens are sent to OpenAI. If OpenAI is unavailable, we use a simple keyword match instead.
- If you click "Yes" on a help answer, including asking about RoomKnit Multi, we record that answer (once per person per workspace) so we know which help worked and who's interested in Multi.
2.6 Email
RoomKnit sends service emails only: teammate invitations, calendar-sharing instructions, notices that you were removed from a room calendar, and notices that a calendar change was undone. They go out through an email delivery service we use to send invitations and notices. We don't send marketing email.
3. How we use information
We use the information above only to provide and improve RoomKnit's user-facing features: signing you in, syncing room bookings between calendars, sharing room calendars with your teammates, sending the service emails above, answering support requests and keeping the service secure. Specifically:
- We do not sell or rent any personal information or Google user data.
- We do not use any data for advertising, retargeting or interest-based ads.
- We do not use Google user data to decide creditworthiness or for lending.
- We do not use Google user data to train or improve AI or machine-learning models.
- People at Sterlacci Brothers LLC do not read your calendar data unless (a) you ask us to, for example in a support request, (b) it's needed for security, such as investigating a bug or abuse, (c) the law requires it, or (d) the data is aggregated and anonymized for internal operations.
4. Google API Services: Limited Use disclosure
RoomKnit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Who we share information with
We share data only with the service providers we need to run RoomKnit, and only for that purpose:
| Provider | Why | What they receive |
|---|---|---|
| Render (render.com), our cloud provider | Hosts the RoomKnit app and its PostgreSQL database | All data stored by RoomKnit (stored encrypted where noted above) |
| Google, Microsoft, Apple | The calendars you connect | The bookings and sharing changes RoomKnit makes on your behalf |
| Email delivery service | Sends invitations and service notices | Recipient address, subject and message |
| OpenAI | Matches help and feature text to articles and themes | Only the text you type into those boxes (section 2.5) |
| GitHub (private repository) | Tracks bug reports | Problem-report text and context, without screenshots |
We may also disclose information if the law requires it, to protect the security of the service, or as part of a merger or sale of the business. In a merger or sale, we'll get your explicit consent before any Google user data is transferred.
6. Where data is stored and how it's protected
- Data is stored in a PostgreSQL database hosted by our cloud provider, Render.
- All traffic uses HTTPS.
- Calendar access tokens, refresh tokens and Apple app-specific passwords are encrypted at rest with a key kept separately from the database.
- Passwords are hashed with scrypt. Session tokens and invite tokens are stored only as hashes.
- Server logs (kept by Render) can include calendar IDs and short error messages from Google or Microsoft. They don't include tokens or passwords.
7. How long we keep data (retention)
- Bookings, including ones copied from Google or Outlook: deleted 12 months after the meeting ends. Someone with permission can also delete a booking sooner, and it's then removed from RoomKnit and from the linked calendars.
- Problem reports, screenshots, feature suggestions and help answers: deleted 90 days after they're submitted.
- Sign-in sessions and invitations: deleted 30 days after they expire, are signed out, revoked or used.
- Calendar connection tokens: kept only while the calendar is connected. Disconnecting revokes the token at Google (for Microsoft, we ask Microsoft to end it where Microsoft allows) and deletes our copy right away. Disconnecting stops new syncing; bookings already copied follow the 12-month rule above.
- Your account (name, email, password hash, workspace membership): kept while your account is active, and deleted when you ask us (see section 8).
- Backups and logs: our cloud provider keeps short-term database backups and server logs for recovery and troubleshooting. They're overwritten on the provider's regular schedule, so deleted data drops out of them after that period.
8. Your choices and rights
- Disconnect: A workspace owner can click Disconnect Google (or Outlook) in RoomKnit at any time. You can also remove RoomKnit's access from your Google Account at https://myaccount.google.com/permissions.
- Delete a booking: It's removed from RoomKnit and from the linked calendars.
- Delete your data: Email michael@sterlaccibrothers.com from the account's email address and say what you want deleted (your personal account, or a whole workspace if you're its owner). We'll confirm and complete the deletion, including the tokens and calendar data copied from Google, within 30 days.
- Access or correct: Email us and we'll send you a copy of your data or fix it.
- Depending on where you live (for example California or the EU/UK), you may have more rights under local law. Email us and we'll honor them.
9. Children
RoomKnit is a business tool. It isn't directed at children under 13, and we don't knowingly collect their information.
10. Changes to this policy
If we change how RoomKnit uses Google user data or other personal data, we'll update this page, change the effective date, and tell workspace owners by email or in the app before the new use begins. Where the law or Google's policy requires it, we'll ask for your consent again.
11. Contact
Sterlacci Brothers LLC Henderson, Nevada, USA michael@sterlaccibrothers.com