Privacy Policy — Ripple: Time Breakdown for Google Calendar™

Effective Date: October 28, 2026 · Last Updated: November 10, 2026 · Publisher: Ripple Reports (https://ripplereports.app)

Overview

Ripple: Time Breakdown for Google Calendar™ ("Ripple", "the Extension", "we", "our") is a Chrome browser extension published by Ripple Reports that provides calendar time breakdowns, multi-calendar rollups, color label management, weekly time targets, custom tracking fields (such as Client, Strategic Pillar, Billable, or Grant), focus-time patterns, automatic categorization rules, and report exports directly inside Google Calendar (https://calendar.google.com).

We design Ripple around strict data minimization:

In-Browser Analytics: All meeting-hour calculations, category breakdowns, recurring-meeting payroll cost estimates, focus-time metrics, and CSV/PDF report exports are computed locally inside your browser.
Scoped Cloud Sync for Custom Fields, Rules & Team Pillars: Only your custom field definitions, categorization rules, anonymized team pillar minute totals, and per-event field tag assignments (eventId mapped to selected field options) are synced to our secure Google Cloud / Firebase backend so your custom tags persist across sessions and shared calendars.
No Selling or Ad Targeting: We never sell, rent, or share your personal or calendar data with data brokers, advertisers, or third-party analytics providers.

Summary of Google OAuth 2.0 Scopes & Data Handling
Google OAuth Scope	When Requested	How Data Is Used & Stored
`https://www.googleapis.com/auth/calendar`	Sign in with Google	Reads calendar list, color labels (`labelProperties`), and event schedules into browser memory for time breakdowns and targets. Writes event colors/labels or opaque record pointers only when you tag events or enable auto-rules. Raw meeting descriptions and guest lists are never stored on our servers.
`https://www.googleapis.com/auth/userinfo.email`	Sign in with Google	Displays which Google account is connected in the Ripple sidebar and verifies calendar access role (`owner`, `writer`, or `reader`) when syncing custom fields.
`https://www.googleapis.com/auth/drive.file`	Optional (only if you click Connect Google Sheet)	Non-sensitive per-file scope used strictly in your browser to create and update only the specific Linked Google Sheet created by Ripple. Ripple cannot view or access any other files in your Google Drive.

1. Information We Access and Collect

A. Google Account & Google Calendar Data (via Google OAuth 2.0)

When you click "Sign in with Google", the Extension uses Chrome's Identity API (chrome.identity) to request authorization for the following Google OAuth 2.0 scopes:

https://www.googleapis.com/auth/calendar
- Read Access: Fetches your calendar list (/users/me/calendarList), calendar color/label definitions (labelProperties), event schedules, attendees, and working-location entries directly from https://www.googleapis.com/calendar/v3/* into your browser memory to calculate time breakdowns, multi-calendar rollups, focus blocks, and meeting patterns.
- Write Access (User-Initiated or User-Configured Rules Only): Updates event colors/native color labels (colorId / eventLabelId), manages calendar color label names (labelProperties), and, when needed on shared calendars, writes an opaque record reference ID (extendedProperties.shared.timereports_record — never raw label text) when you edit an event's color/fields or enable automatic categorization rules.
https://www.googleapis.com/auth/userinfo.email
- Retrieves your Google account email address to display which account is connected in the sidebar and to verify your access level (owner, writer, or reader) on shared calendars when syncing custom fields.
https://www.googleapis.com/auth/drive.file (Optional, Incremental Authorization)
- Requested only if you explicitly click "Connect Google Sheet" in the Export modal. Used solely to create and refresh the dedicated Ripple Linked Google Sheet (Executive Summary + Events tabs) directly from your browser.

B. Custom Fields, Rules, and Event Tag Assignments (Synced to First-Party Cloud Backend)

To persist custom tracking fields beyond Google Calendar's built-in color slots and synchronize them with shared calendar collaborators and your Ripple team, the Extension transmits and stores the following structured metadata via HTTPS (TLS 1.2+) at https://us-central1-ripple-gcal.cloudfunctions.net/api/v2:

Account Identifier: Your Google account email address and authenticated user ID.
Calendar Identifier & Access Role: The Google Calendar ID (calendarId) and verified permission role (owner, writer, or reader), checked transiently using your OAuth 2.0 bearer token.
Custom Field Definitions: Field names, field types (dropdown, multi-select, toggle, text), and option labels you create (e.g., Client: Acme Corp, Billable: Yes, Grant: NSF #24109).
Auto-Categorization Rules: Rule conditions you explicitly create (such as title keywords, location keywords, or guest domains) and the target color or custom field values those rules assign.
Event Tag Records: The Google Calendar event ID (eventId / recurringEventId) paired with the custom field option IDs or values assigned to that event.
Privacy-Safe Leadership Rollups (Optional): If you join a Ripple Leadership team and opt in, strictly aggregated minute totals per shared category/pillar are synced—never raw event titles, free-form text notes, or guest lists.

What We Do NOT Store on Our Servers:

We do not store raw Google Calendar event titles, meeting descriptions, conference links, or attendee lists in our database (other than specific keyword or domain criteria you explicitly save as an auto-categorization rule).
All CSV, TSV, clipboard Weekly Snapshots, and standalone print/PDF time reports are generated locally on your device.

C. Local Browser Storage

The Extension uses Chrome's local extension storage APIs on your device:

chrome.storage.local: Stores UI preferences (active calendar selection, Saved Views, date-range mode, export preferences, theme preference, processed rule keys) and an offline-resilient local cache of your custom fields, rules, and event tag records (smartLabelsCache:*).
chrome.storage.session: Holds your short-lived OAuth 2.0 access token in memory for the current browser session (automatically cleared when Chrome closes and inaccessible to web page scripts).
The Extension does not use chrome.storage.sync.

2. Google API Services User Data Policy (Limited Use Disclosure)

Ripple: Time Breakdown for Google Calendar™'s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Limited Use: We use Google user data solely to provide and improve the user-facing calendar analytics, color labeling, custom field tagging, rule automation, and reporting features visible inside Ripple.
No Third-Party Transfers: We do not sell, trade, or transfer Google user data to third parties, advertising platforms, data brokers, or information resellers. Data is processed only on infrastructure necessary to operate the service (Google Cloud Platform / Firebase).
No Advertising Use: Google user data is never used for serving personalized, retargeted, or interest-based advertisements.
No AI/ML Model Training: We do not use any Google Calendar or Google Drive/Sheets data obtained through Google Workspace APIs to train, fine-tune, or improve generalized artificial intelligence (AI) or machine learning (ML) models.
Strict Access Controls: Human access to stored metadata is prohibited except when explicitly requested by you for customer support troubleshooting, required for security/abuse investigation, or required by law.

3. Infrastructure & Sub-Processors

Ripple contains zero third-party advertising SDKs, behavioral telemetry trackers, or external analytics scripts. To provide authentication, custom-field persistence, and optional subscription billing, the Extension communicates strictly over HTTPS with:

Google APIs (https://www.googleapis.com, https://sheets.googleapis.com, https://accounts.google.com): Official Google OAuth 2.0 authentication, Google Calendar REST API v3, and user-initiated Linked Google Sheets updates via drive.file (Google Privacy Policy).
Google Cloud Functions & Firebase Realtime Database (https://us-central1-ripple-gcal.cloudfunctions.net): First-party backend infrastructure hosted on Google Cloud Platform in the United States (us-central1) for storing custom field schemas, rules, anonymized team pillar rollups, and event tag mappings (Firebase Privacy and Security).
Stripe (Paid Subscriptions Only): If you upgrade to a paid plan, payment checkout and billing portal sessions are processed directly by Stripe (Stripe Privacy Policy). Ripple never receives or stores your full payment card number.

4. Data Security, Retention, and Deletion

Encryption: All network communication uses HTTPS (TLS 1.2+), and cloud-stored custom field/tag records are encrypted at rest on Google Cloud / Firebase infrastructure.
Session Token Isolation: OAuth access tokens are confined to Chrome's chrome.identity subsystem and ephemeral chrome.storage.session memory, and are never persisted in our backend database.
Disconnecting & Deleting Local Data:
- Click your account menu inside the Ripple sidebar and select Sign out to revoke cached tokens and clear session credentials, or uninstall the Extension from Chrome to erase all chrome.storage.local and chrome.storage.session data on your device immediately.
- You can revoke Ripple's Google OAuth permissions at any time at Google Account Third-Party Access Settings.
Deleting Cloud-Synced Custom Fields & Records:
- You can delete individual custom fields, options, or rules directly inside the Extension at any time.
- To request permanent deletion of all cloud-synced custom field definitions, rules, team records, and event tag records associated with your account or calendar, email support@ripplereports.app (or hello@ripplereports.app) from your connected Google account email address. Verified deletion requests are completed within 30 days.

5. Changes to This Privacy Policy

If we make material changes to this Privacy Policy, we will update the "Last Updated" date at the top of this page and publish the revised policy at https://ripplereports.app/privacy. Where required by applicable law or Chrome Web Store policy, we will obtain your consent before applying material changes.

6. Contact Us

If you have questions about this Privacy Policy, our data practices, or data deletion requests, contact us at:

Email: support@ripplereports.app / hello@ripplereports.app
Website: https://ripplereports.app
Privacy Policy URL: https://ripplereports.app/privacy