Privacy Policy
Last updated: October 2026
Soloft ("we", "us") provides a business-management app for solopreneurs at soloft.io. This policy explains what data we collect, why, and how you can control it.
1. What we collect
Account information — email, password (handled by our self-hosted authentication service, built on open-source Supabase Auth; we never see your plaintext password), full name, business name, phone, logo, timezone, and currency.
Business data you enter — clients/contacts, invoices, projects, tasks, expenses, notes, proposals, and product/portfolio records you create while using Soloft.
Booking data — when someone books a meeting through your booking page, we store their name, email, and any notes or answers they provide.
2. Google Calendar access
If you connect Google Calendar in Settings, Soloft requests two scopes: calendar.readonly and calendar.events.
We use this access only to:
- Check your existing calendar for busy time, so we don't offer booking slots that clash with something already on your calendar.
- Create a calendar event (with a Google Meet link, if enabled) when someone books a meeting with you.
- Delete that calendar event if the booking is later cancelled.
We do not read the contents, attendees, or descriptions of your other existing calendar events beyond their free/busy status. You can disconnect Google Calendar at any time from Settings, which stops all future access.
3. Other integrations (optional)
Zoom — if connected, used only to create and delete Zoom meetings for your bookings.
Stripe — used to process invoice payments. Card details are handled entirely by Stripe; we never see or store full card numbers.
Resend — our email provider, used to send booking confirmations, invoice reminders, and emails you configure.
4. AI features
Features like AI email drafts, proposal generation, and morning briefings send relevant text to Google's Gemini API. OpenRouter (which may route to third-party model providers including DeepSeek) is used as a primary provider for email drafts and as a fallback for other features if Gemini is unavailable.
What is sent to AI providers: Only the minimum context needed for each feature — a user-typed email prompt and recipient name, a user-typed project brief, or aggregate counts ("3 tasks pending", "2 overdue invoices"). We never send your full client database, invoice history, or document contents to any AI provider.
Google API data is never sent to third-party AI providers: Data obtained from Google APIs (such as Google Calendar free/busy information or calendar event details) is never included in any prompt sent to OpenRouter or any non-Google AI provider. Google API data is used exclusively for the scheduling feature described in Section 2. The scheduling subsystem and AI subsystem are architecturally separate and do not share data.
5. How we protect your data
Encryption in transit — all data is transmitted over HTTPS/TLS. OAuth tokens and API keys are never transmitted over unencrypted connections.
Encryption at rest — your data is stored in a self-hosted Postgres database (open-source Supabase) running on Google Cloud Platform in the United States; the underlying Google Cloud disks are encrypted at rest with AES-256 by default. Google OAuth refresh tokens are stored in a restricted database column accessible only via our backend service role, not via client-side queries.
Access controls — row-level security (RLS) is enforced at the database level so each user can only access their own records. Our backend verifies your session token on every authenticated request before any database query executes.
Minimal data collection — we request only the permissions needed for specific features. Google Calendar access is entirely optional, can be revoked at any time from Settings, and revocation immediately stops all future calendar access.
6. Where your data lives
All app data is stored in a self-hosted Postgres database (open-source Supabase) that we operate on Google Cloud Platform. Access is restricted to your account and any team members you explicitly invite to your workspace, enforced by database-level row security — not just app logic.
7. What we don't do
We do not sell your data. We do not share it with advertisers. We do not use your business or client data to train AI models. We do not send Google API data to third-party AI providers.
8. Your rights
You can export or delete your data, or disconnect any integration, at any time from Settings. To request full account deletion, contact us at the email below.
9. Contact
Questions about this policy: founder@tenderlab.studio