Month Minder

This policy explains what information the Month Minder Alexa skill (“Month Minder”, “we”, “us”) uses, why, and what control you have over it. Month Minder is provided by Bloom Web Design. We are the data controller for the information described here.

The short version

• Month Minder reads your calendar only to show it on your Alexa device’s screen.
• It can’t change your calendar.
• We don’t store your calendar events, and we don’t sell or share them.
• If you connect a calendar by pasting a shared calendar link (for example from iCloud), Month Minder only reads the calendars you choose to share.
• You can disconnect Month Minder at any time.

What information we use

Calendar events. When you open Month Minder, it fetches the events for the month or day you’re viewing from your connected calendar account (Google or Microsoft). For each event this includes the title, start and end times, whether it is all-day, its location, and whether it has been cancelled or declined. This is used only to draw the calendar on your screen, at the moment you ask for it. It is not saved once the screen has been drawn.

Calendar links. (iCloud and others). Instead of signing in with Google or Microsoft, you can connect Month Minder by pasting one or more shared calendar links, such as an iCloud “Public Calendar” link. When you do, our server downloads each calendar once to check the link works. The links are then encrypted and held by Amazon as part of your Alexa account link – we do not keep a copy on our servers. Each time you open Month Minder, it uses the links to read the events for the month or day you’re viewing, in the same way as described above. It never sees your Apple ID or password.

Contact birthdays (optional). If you allow access to your Google or Microsoft contacts, Month Minder reads each contact’s name and birthday so it can show birthdays, and ages where a birth year is saved, on your calendar. It reads nothing else from your contacts. This is only used to draw the calendar at the moment you ask for it, and is not stored. If you don’t allow contacts access, Month Minder works as normal without birthdays.

Account access token. When you link Month Minder to your calendar account, the sign-in is handled by Amazon and by Google or Microsoft. Amazon stores the resulting access token and passes it to Month Minder with each request so we can read your calendar. We never see or store your password.

Device settings. We read your Alexa device’s time zone so that events show at the correct local time, and your screen size so the calendar fits your display.

Which month you’re viewing. While the skill is open, we remember which month you’re looking at so “next month” works. This is forgotten when the skill closes.

Technical logs. Like most online services, our hosting keeps short-term technical logs to help us fix problems, such as error messages and timings. We don’t write the contents of your calendar to these logs.

Subscriptions. If you subscribe to Month Minder Premium, Amazon handles the payment. We never receive your payment details. Amazon only tells Month Minder whether you have an active subscription or free trial, so it can unlock Premium features.

Why we use it

We use this information to provide the service you have asked for, which is showing your calendar on your screen. Under UK GDPR, our lawful basis is that this is necessary to perform our agreement with you (our terms of use).

Who we share it with

We don’t sell your information or share it for advertising. The only other parties involved are those needed to run the service:

• Amazon: runs Alexa, handles account linking, and hosts the Month Minder code.
• Google or Microsoft: the calendar provider you choose to connect.
• The calendar service that hosts any calendar link you paste (for example Apple iCloud).

Their own privacy policies cover how they handle your information.

Google user data

Month Minder requests read-only access to your Google Calendar list and events (the calendar.calendarlist.readonly and calendar.events.readonly permissions) and, optionally, read-only access to your Google contacts (the contacts.readonly permission).It uses them only to display your calendar events and your contacts’ birthdays on your Alexa device. Month Minder’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, and no person reads it.

Microsoft user data

If you connect a Microsoft account, Month Minder requests read-only access to your calendar (the Calendars.Read permission), your basic profile (User.Read) and, optionally, read-only access to your contacts (the Contacts.Read permission). It also requests offline_access so you stay connected without signing in again. It uses these only to display your calendar events and your contacts’ birthdays on your Alexa device. Month Minder’s use of information received from Microsoft APIs will comply with the Microsoft APIs Terms of Use. We do not use Microsoft user data for advertising, we do not sell it, and no person reads it.

Calendar link user data (iCloud and others)

If you connect Month Minder by pasting shared calendar links, such as iCloud Public Calendar links, Month Minder reads only the calendars you choose to share. It uses them only to display your calendar events on your Alexa device, and it cannot add, change or delete anything. Month Minder never sees your Apple ID or password. Your links are encrypted and held by Amazon as part of your Alexa account link, and we do not keep a copy on our servers. We do not use this information for advertising, we do not sell it, and no person reads it.

A shared calendar link lets anyone who has the link view that calendar, so only paste links for calendars you’re happy for Month Minder to read, and keep them private. Birthdays from iCloud contacts are not available through calendar links.

Where your information is processed

Month Minder runs on Amazon Web Services in the EU (Ireland). Amazon, Google and Microsoft may process information in other countries under their own safeguards.

How we protect your information

We take the following steps to protect your information, including your Google, Microsoft and calendar link data:

– Encryption in transit: all information passed between your Alexa device, Amazon, our sign-in page and Google, Microsoft or your calendar provider is sent over encrypted HTTPS (TLS) connections.
– No storage of calendar data: your calendar events and contacts’ birthdays are read only when you open Month Minder, used only to draw the screen, and are not saved by us.
– Secure access tokens: the access tokens that let Month Minder read your calendar are held by Amazon as part of your Alexa account link. We do not keep a copy on our servers. Calendar links are encrypted (AES-256) before they leave our sign-in page.
– Least access: Month Minder only requests read-only access, and only to the information it needs to display your calendar and birthdays.
– Restricted access: only Bloom Web Design can access the systems that run Month Minder, protected by strong passwords and two-step verification. Our secret keys are stored privately on our servers and never shared.
– Minimal logging: our technical logs record errors and timings to help us fix problems. They do not contain the contents of your calendar or contacts.
– Data breaches: if a security incident ever affected your information, we would notify you and the Information Commissioner’s Office as required by UK data protection law.

How long we keep it

Calendar events and contact birthdays are not kept after they’re displayed. Technical logs are kept for a limited period and then deleted automatically. The access token is held by Amazon until you disable the skill or unlink your account.

How to disconnect Month Minder

• In the Alexa app: go to Skills & Games, then Your Skills, then Month Minder, and choose Disable Skill. This removes the link to your calendar account.
• Google: remove Month Minder at myaccount.google.com/permissions.
• Microsoft (personal accounts): remove it at account.live.com/consent/Manage. Work accounts: use myapps.microsoft.com or ask your IT administrator.
• Calendar links (iCloud): disable the skill in the Alexa app, then turn off the link itself on your iPhone: Calendar app → Calendars → ⓘ next to the calendar → turn off Public Calendar. Once it’s off, the link stops working for everyone, including Month Minder.

Your rights

Under UK data protection law you have the right to ask what information we hold about you, and to ask us to correct or delete it. You also have the right to object to or restrict how we use it. To make a request, email sharon@bloomwebdesign.co.uk
If you’re unhappy with how we’ve handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk.