Privacy Policy

Last updated: October 5, 2026

This policy covers chateaukhan.com, www.chateaukhan.com, home.chateaukhan.com, and the other services operated under the chateaukhan.com domain ("the Services", "we", "us"). The Services are a personal, non-commercial project operated by Jamal Khan. This policy explains what information we collect, how it's used, and the choices you have.

Public website (www.chateaukhan.com)

You don't need an account or any personal information to browse this site. Like most websites, our hosting and networking infrastructure automatically logs standard technical information for security and reliability, such as:

• IP address and general location (derived from IP)
• Browser type and version, and device/operating system
• Pages visited, timestamps, and referring page

The public test endpoint (/test-api) records each request it receives, including the requester's IP address, headers, and body, and shows them in a public viewer so developers can inspect their own requests. These records are kept in memory only and are discarded after about two hours or when the service restarts. Do not send personal or sensitive information to this endpoint.

If you contact us (for example, by email), we collect whatever you include in that message, such as your name and email address.

Household portal and Family Calendar (home.chateaukhan.com)

home.chateaukhan.com is available only to invited family members who sign in. For those members we store:

• Name, email address, and family group membership, from our own sign-in system and from the calendar provider's consent screen.
• OAuth access and refresh tokens (or, for Apple, an app-specific password) needed to read a connected calendar on the member's behalf. These are encrypted at rest.
• Calendar event data from connected calendars (event times, titles, locations, descriptions, and free/busy status), cached so the calendar can be shown to the member and to the family groups they share it with.
• The sharing settings each member chooses, such as which groups can see a calendar and at what level of detail.

Google user data

If a family member connects a Google account, the Family Calendar requests the https://www.googleapis.com/auth/calendar.readonly scope (plus basic sign-in identity via openid). We use this access only to:

• read that member's calendar events and free/busy information;
• show those events to the member; and
• show them to the family members the member has chosen to share with, at the level of detail the member has chosen (from free/busy only up to full details).

We never create, modify, or delete events in a Google account. Google user data is not sold, not used for advertising, not used to train machine-learning or AI models, and not transferred to anyone other than the family members the user has chosen to share with, except where required by law. No person reads this data other than the user and those family members, except when the user asks for help, when needed for security, or when required by law.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft and Apple calendars are handled the same way, using read-only access (Calendars.Read for Microsoft, CalDAV read access for Apple).

Cookies

We do not use tracking or advertising cookies. Cookies are used only for sign-in sessions on the private portal and basic site functionality, and are never shared with third parties.

How we share information

We do not sell or rent your information. We share it only with the family members a user chooses to share their calendar with, with the calendar providers themselves (Google, Microsoft, Apple) to fetch the user's own data, or when required by law. The Services are self-hosted; your data is stored on our own hardware, not with a third-party cloud provider.

Data retention and deletion

• Disconnecting a calendar from within the Family Calendar deletes its stored credentials and cached events.
• You can also revoke our access at any time from your Google account at myaccount.google.com/permissions, or from your Microsoft or Apple account settings.
• You can ask us to delete your account and all associated data by emailing the address below. We will do so within 30 days.
• Technical logs are kept only as long as reasonably necessary for security and operations, then deleted.

Security

All Services are served over HTTPS. The household portal requires signing in, and stored calendar credentials are encrypted at rest. No method of storage or transmission is perfectly secure, but we take reasonable steps to protect your information.

Children

The Services are not directed at children under 13, and we do not knowingly collect personal information from them.

Changes to this policy

We may update this policy as the Services change. The "Last updated" date at the top of this page shows when it last changed.

Contact

Questions about this policy or requests about your data can be sent to contact@chateaukhan.com.

See also our Terms of Service. ← Back home