Privacy policy

Data collection and use

PraCat, the application at app.pracat.com, collects and uses the information below to run a workspace for professional practices. This section states what data the application accesses, how that data is used, how it is stored, with whom it is shared, and how long it is kept.

Google user data PraCat accesses

Connecting a Google account is optional. When a member connects Google Calendar, PraCat accesses only this Google user data:

• The email address of the connected Google account.
• Calendars that PraCat itself creates in that Google account, and the events PraCat writes on those calendars.

PraCat does not access Gmail, Google Drive, Google Contacts, or calendars the member created outside PraCat. The OAuth scopes for this access are openid, https://www.googleapis.com/auth/userinfo.email, and https://www.googleapis.com/auth/calendar.app.created.

How PraCat uses Google user data

PraCat uses this Google user data only to provide the calendar sync the member requested. It uses the Google account email to show which account is connected. It uses the calendar permission to create one secondary calendar in that account and to add, update, and delete the workspace's appointments and tasks on that calendar.

PraCat does not use Google user data for advertising, to sell data to data brokers or information resellers, to determine creditworthiness, or for lending. PraCat does not use Google user data to develop, improve, or train generalized or non-personalized AI or machine-learning models. PraCat's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How PraCat stores and protects Google user data

PraCat stores the connected Google account email, an OAuth refresh token encrypted with AES-256-GCM, and the identifier of the calendar PraCat created. Short-lived access tokens are used only in memory while a sync is running and are not saved. This information is stored in Google Cloud in the European Union (region europe-west1, Belgium). The service is served over HTTPS. Security procedures are in place to protect the confidentiality of this data, including encryption at rest and access limited to members of the workspace.

With whom PraCat shares Google user data

PraCat does not sell Google user data. PraCat does not transfer or disclose Google user data to third parties for purposes other than providing the calendar sync the member requested. Google receives the calendar events the member asked PraCat to write. Google Cloud hosts the stored connection for PraCat. PraCat does not send Google user data to advertising networks, data brokers, or to a workspace's AI provider.

How long PraCat keeps Google user data, and how to delete it

PraCat keeps the Google Calendar connection for as long as the member stays connected, and deletes it when the member disconnects in Settings → Calendar sync or when the workspace is deleted. Disconnecting deletes the PraCat calendar and its events from the Google account and deletes PraCat's copy of the token. The member can also revoke PraCat from their Google Account at myaccount.google.com/permissions. To ask PraCat to delete account data, email pracat.dev@gmail.com.

Who we are

PraCat is a workspace for professional practices. It holds client records, notes, appointments, reminders, and optional AI assistance. In this policy, "PraCat", "we", and "us" mean the operator of that service.

For your account, sign-in, and security settings, PraCat is the controller. For client records, notes, and appointments that a workspace enters, that workspace is the controller and PraCat processes the data on the workspace's instructions. People whose details were entered by a practice should contact that practice first.

Privacy requests: pracat.dev@gmail.com.

Information we collect

Account and security data:

• Email address and a password hash (Argon2id).
• Session records, including when a session was last used. Sessions last 30 days by default, or 7 days when the workspace requires shorter sessions.
• Optional multi-factor authentication data: an authenticator secret, recovery-code hashes, and, if you trust a device, a device cookie and the browser user agent.
• Workspace membership, role, and invitation email.
• Theme preference.

Data a workspace stores in PraCat:

• Client profile fields the workspace enters, such as name, email, phone, age, weight, tax identifier, and observations.
• Notes and the fields that workspace configured.
• Appointments and tasks: title, description, start, end, and time zone.
• Reminder and message settings, sent-message records, and the workspace's own email or SMS credentials when it connects a provider.
• AI chats and the workspace's own AI provider key, when AI is enabled.

We do not run advertising or third-party analytics on the service.

Google user data

Connecting Google Calendar is optional and is done per member from Settings → Calendar sync. PraCat requests only these scopes:

• openid and https://www.googleapis.com/auth/userinfo.email — to show which Google account is connected.
• https://www.googleapis.com/auth/calendar.app.created — to create and manage calendars that PraCat itself creates in that account.

From Google, we receive:

• The Google account email address, which we store.
• An OAuth refresh token, which we store encrypted with AES-256-GCM. Access tokens are used only in memory while a sync is running and are not saved.
• The identifier of the calendar PraCat created, which we store.

PraCat then creates one secondary calendar in that Google account. The default name is "PraCat - " followed by the workspace name. The member can rename it. Sync is one-way, from PraCat to that calendar. We add, update, and delete events on that calendar for the workspace's shared appointments and tasks. Each event can include the title, description, start, end, time zone, and a private PraCat appointment id. For a client appointment, the event title includes the client's display name.

We do not read Gmail, Drive, Contacts, or calendars that PraCat did not create. We do not import events from Google back into PraCat. Edits made in Google Calendar are not copied into PraCat.

PraCat's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

• We use Google user data only to provide the calendar connection the member turned on: identifying the connected account and keeping the PraCat calendar in that account up to date.
• We do not sell Google user data and we do not use it for advertising.
• We do not use Google user data to train generalized AI or machine-learning models, and we do not send Google tokens or data received from Google APIs to a workspace's AI provider.
• We do not transfer Google user data to third parties except to Google, to provide the feature, and to our infrastructure provider, which stores it for us. We do not allow humans to read that data unless the user asks us to for support, it is necessary for security, we are required by law, or the data is aggregated and cannot identify the user.

Disconnecting in Settings → Calendar sync deletes the PraCat calendar and its events from the Google account and deletes our copy of the token. Appointments stored in PraCat remain. The connection is also removed when the workspace is deleted.

How we use information

• To provide the workspace, sign-in, and member access.
• To send account email, such as verification, invitations, and password reset.
• To send client reminders and messages when a workspace turns that on, using the workspace's email or SMS settings.
• To sync appointments to a connected Google Calendar, as described above.
• To answer AI questions a member sends. Note text is included only when the member tags it and the workspace allows notes in AI. The request goes to the provider whose key the workspace saved: OpenAI, Anthropic, Google Gemini, or OpenRouter.
• To protect the service, investigate abuse, and keep security and audit records.
• To take payment for a paid plan. Card payments are processed by Stripe. PraCat does not store full card numbers.

Who else receives data

We share data with service providers only as needed to run PraCat:

• Google Cloud hosts the application and database in europe-west1 (Belgium).
• Google receives the calendar data described above when a member connects Google Calendar.
• Brevo sends PraCat account email, such as verification, invitations, and password reset.
• The email or SMS provider a workspace configures (for example its own SMTP server, Twilio, or GatewayAPI) receives the client messages that workspace sends.
• The AI provider a workspace selects receives the chat content the member submits.
• Stripe receives billing details when a workspace pays.

Workspace members with access can see the workspace's shared schedule and client records according to their role. We may also disclose information if the law requires it, or to protect members, clients, or the service.

Where data is stored

Production data is stored in the European Union, in Google Cloud region europe-west1 (Belgium). A workspace's own email, SMS, or AI provider may process the content of a message or chat outside the EU under that provider's terms. Google stores the calendar PraCat creates in the connected Google account.

How long we keep it

• Workspace records stay until a member deletes them or an owner deletes the workspace.
• A Google Calendar connection stays until the member disconnects or the workspace is deleted. Connecting again replaces the stored token.
• AI chats are deleted after 30 days. Records of sent alerts are deleted after 90 days.
• Finished appointment-reminder rows are deleted after the appointment start time plus 7 days.
• Sessions end on sign-out or when they expire. A trusted-device cookie lasts 30 days.

Owners can export the workspace from Settings before deleting it. To delete an account that is no longer a member of a workspace, email pracat.dev@gmail.com.

Cookies

PraCat uses cookies only to run the product:

• pracat_session — keeps you signed in. HttpOnly.
• pracat_mfa_challenge — short-lived cookie while a multi-factor sign-in is in progress. HttpOnly.
• pracat_mfa_device — remembers a trusted device for 30 days. HttpOnly.
• pracat_theme — stores light or dark mode for one year.

The browser may also keep the theme in local storage under pracat-theme.

Security

The service is served over HTTPS. Passwords are hashed. Google refresh tokens and workspace provider credentials are encrypted at rest. Access to a workspace's records is limited to its members. These measures reduce risk. They do not guarantee that unauthorized access is impossible.

Your rights

If the GDPR applies, you can ask for access, correction, deletion, restriction, or a copy of your personal data, and you can object to certain processing. You can update account and workspace data in the product, export a workspace, and delete a workspace you own. You can also email pracat.dev@gmail.com.

If you are in the European Economic Area, you may lodge a complaint with your supervisory authority. In Portugal, that is the Comissão Nacional de Proteção de Dados (CNPD).

Children

PraCat is a tool for professional practices. We do not knowingly open accounts for children. A workspace may store information about a minor when that is part of the practice's own records. The workspace is responsible for having a lawful basis to do so.

Changes

We will update this page, and the effective date above, if PraCat changes what Google user data it accesses or how that data is used, stored, or shared.

Contact

pracat.dev@gmail.com