Privacy Policy

What we collect

• Account: your name, email, and profile photo from Google when you sign in.
• Calendar access: with Google sign-in, we request calendar.events (to check upcoming events, show your existing events on your Rested calendar for context, and create or update the study blocks you accept) and calendar.freebusy (to see when you're busy). Events we didn't create are shown read-only for your own reference — we never edit or delete anything we didn't create ourselves.
• Calendar feeds: any Canvas, Blackboard, Moodle, or .ics feed URL you add, and the assignment or class data pulled from it.
• Gmail (optional, Pro only): a separate opt-in grants read-only Gmail access (gmail.readonly) to scan for deadline and student-life-event mentions (career fairs, club meetings, and similar). We never send email from your account, and this can be revoked independently of Calendar access at any time.
• Uploaded syllabi (optional, Pro only): PDF or Word files you upload are parsed for dates and deadlines; the extracted text is stored so you can review it later.
• Watched pages and forwarded email (optional, Pro only): any webpage URL you add is periodically checked for new content, and any email you forward to your personal Rested inbox address, both scanned the same way a Gmail digest is.
• Billing: subscriptions and payments are handled directly by Stripe. We store your Stripe customer and subscription IDs only — we never see or store your card number.
• AI processing: when you use scheduling suggestions or the chat assistant, the relevant parts of your schedule and your messages are sent to Anthropic's Claude API to generate a response.

How we use it

Solely to run the product: syncing your calendars, proposing and placing study blocks around your classes and sleep window, extracting deadlines, answering questions in the assistant, sending the weekly digest email if you opt in, and processing your subscription. We do not sell your data, and we do not use your calendar or Gmail content for advertising.

Who we share it with

Only the vendors needed to run the service: Google (sign-in and Calendar/Gmail APIs), Anthropic (AI features), Stripe (billing), Resend (transactional email), and Supabase (database hosting). Each receives only the data needed for its function.

Security

OAuth refresh tokens are encrypted at rest. Access to your data is limited to what the app needs to function.

Your controls

• Revoke Calendar or Gmail access anytime from your Google Account permissions page — this immediately stops our access.
• Turn off the weekly digest anytime in Settings.
• Export a copy of everything we've stored for you, or permanently delete your account and all associated data, anytime from the "Danger zone" at the bottom of Settings — both are self-serve and take effect immediately.

Children

Rested isn't directed at children under 13, and we don't knowingly collect data from them.

Changes

If this policy changes meaningfully, we'll update the date above and note material changes on this page.