Privacy

Privacy policy

VEGA Schedule for iPhone, iPad, Windows and Android. Last updated 4 September 2026.

1. Scope

This policy covers VEGA Schedule, an app from VEGA Works for iPhone, iPad, Windows and Android. VEGA Works is the data controller. Contact details are at the end.

2. What the app collects

It doesn't read your contacts, messages, health data or browsing. It knows nothing about your other apps.

Turn on VEGA Sync, and some information — tasks, settings, and more — is also stored on a server. What's stored is listed under Sending data, section 4.4, VEGA Sync.

2.1 Differences by platform

Where things are stored, and where they can be sent, depends on the platform you use. This table lays out the differences.

• Microsoft means Outlook.com, Microsoft 365 or Exchange. It can be read and written.
• Google is read-only. This app never writes to Google.
• CalDAV covers iCloud, Fastmail, Nextcloud and mailbox.org. It can be read and written.
• Local uses no account and no network.

On Android, accounts already added to the phone are synced in by the system. The app itself signs in to nothing.

3. Why

The information is used only to:

• show your day and the free time in it
• estimate how long getting ready and getting there will take
• save the events and tasks you confirm
• remember your settings

None of it is used for advertising. None of it is sold, and none is shared with anyone. By default, VEGA Works runs no server of its own, and collects no usage data. VEGA Sync is the exception — see section 4.4, VEGA Sync.

4. Sending data

What gets sent depends on your platform and on which features you use. If you don't use them, nothing is sent.

4.1 The map service (iPhone and iPad)

When an event has a place written on it that hasn't been looked up before, the app sends that text — and only that text — to Apple's map service. The coordinate that comes back is used to estimate the trip. Your name, anything identifying you, and the event's title are not sent. Each place is looked up once. Apple's privacy policy governs the request.

Windows and Android have no version of this feature. Nothing is sent anywhere to look up a place. An estimate built into the app is used instead.

4.2 Connecting a calendar

On iPhone and iPad, Google Calendar is the only outside connection. It's optional and does nothing until you connect it.

On Windows, you choose where your calendar lives:

• Microsoft — Outlook.com, Microsoft 365 or Exchange. Read and write.
• Google Calendar — read-only. Nothing is ever written back.
• CalDAV — iCloud, Fastmail, Nextcloud or mailbox.org. Read and write.
• Local — no account, and no network.

Android has no connection of this kind. Accounts already added to the phone are synced in by the system.

4.3 Signing in and tokens

For Microsoft, Google or CalDAV, you sign in on that provider's own page, so this app never sees your password. The token it receives is kept in a secure place on your device: the Keychain on iPhone and iPad, DPAPI on Windows. It never leaves that device.

For Google, the app asks for your calendars and their events, from a week ago to ninety days ahead. Both permissions are read-only: list your calendars, and read events. It never asks to change an event, or to create, delete or share a calendar. This is the same on iPhone, iPad and Windows.

On iPhone and iPad, those events are copied to a calendar on the device called Google (VEGA Schedule). If the device syncs its calendars with iCloud, that copy goes to your iCloud too and appears on your other Apple devices — inside your own Apple account, and no further.

On Windows, those events are shown inside the app, alongside your other calendars. Nothing is sent back to Google. Disconnecting revokes the access at Google. There is no copy to delete.

4.4 VEGA Sync (optional)

VEGA Sync isn't offered on any platform right now — not on iPhone, iPad, Windows, or Android. VEGA Sync is an optional feature that shares your tasks and settings across your devices. Once it's offered, it will be off by default, and turning it on will be the only way anything gets sent. Every feature works without it. It doesn't use your email address or your name. There's no sign-in yet — to add a device, you type a code shown on one screen into another.

The recovery key is generated on the device that turns VEGA Sync on, and shown once. The server can find that row by the recovery key's hash. It can't open what's inside. Finding the row and opening it use the same recovery key, but in two different ways. If you lose every device and the recovery key, nobody — including VEGA Works — can recover what's stored.

An optional notification tells your other devices something changed, carrying only that and a sequence number. It carries no content.

Event sync is on by default. An event's title can reveal sensitive information — health conditions, beliefs, and the like. You're shown a screen about this before it's turned on, and you can turn it off at any time.

Where the server is located is covered in section 9, Security. Deleting the account is covered in section 7, Keeping and deleting. Exporting your data is covered in section 8, Your choices.

5. Google user data

VEGA Schedule's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

That information is used only for the features you can see. It is never used for advertising, never read by a person, and never sold or passed to anybody else.

6. Apple Intelligence (iPhone and iPad)

On iPhones and iPads that support it, the app can use Apple Intelligence to tidy up a sentence you typed or read a photo of a timetable. That runs on the device. If a request would go to Apple's Private Cloud Compute, iOS or iPadOS tells you, and Apple's terms apply. Every one of those features has a path that works without it.

Windows and Android have nothing like this. Text and photos are never read for this purpose there.

7. Keeping and deleting

What the app stores stays until you delete it. Deleting the app removes all of it.

Your calendar events and tasks are usually not the app's to delete. Anything the app created can be deleted the ordinary way, wherever it lives.

• iPhone and iPad — they live in Apple's Calendar and Reminders.
• Windows — they live wherever you connected your calendar, or on your device.
• Android calendar events — they live in your device's calendar.
• Android tasks — there is no other home for them; they live only in the app.

Deleting the app on Android removes its tasks along with everything else. Your calendar events and other connected data are managed wherever they live.

If VEGA Sync is on, deleting the account is done from inside the app. It's a real deletion, not a deactivation. It removes the account's devices, its synced records, and any pairing code still waiting to be used.

8. Your choices

• Calendar, task, location, microphone and photo permissions can be changed at any time in your device's settings.
• A Google connection on iPhone or iPad, or a Microsoft, Google or CalDAV connection on Windows, can be ended in the app's settings. For Google, you can also use your Google account permissions.
• Deleting the app leaves nothing behind that the app itself stored. Your calendar and tasks stay wherever they live.
• VEGA Sync's event sync can be turned off at any time, in the app's settings.
• A VEGA Sync account can be deleted at any time, in the app's settings. Deletion can't be undone.
• What the server holds can be exported at any time, from the app's settings.

9. Security

A sign-in token is held in a secure place on your device: the Keychain on iPhone and iPad, DPAPI on Windows. Either way, it is readable only after the device has been unlocked once, and only on that device. Every request the app makes is encrypted in transit.

VEGA Sync's server runs on Cloudflare's infrastructure — Cloudflare Workers and Cloudflare D1. When the database was created, it was set to prefer the Asia-Pacific region, but that's a preference, not a guarantee. Which country or region actually handles it depends on Cloudflare's own infrastructure, and staying inside Japan isn't guaranteed. As a result, some of your information may be processed outside Japan.

Three endpoints are open to anyone: creating an account, claiming a pairing code, and recovering one. Each is rate-limited per connecting IP address, once a minute. The IP address is used only to count requests, and it isn't stored in the database. Cloudflare's own request logs are on. Nothing in the service writes a record's content, an auth token, or an IP address into a log line.

10. Children

VEGA Schedule is not directed at children and collects nothing about age.

11. Purchases

Purchases are handled by your platform's own store.

• iPhone and iPad — the App Store
• Windows — the Microsoft Store
• Android — Google Play

The app is told only whether a purchase is active. It never sees your name, your payment details or your account.

12. Changes

This policy may change. When it does, the date at the top changes. Material changes are noted in the app's release notes as well.

13. Contact

Questions about this policy or about how your information is handled:

• Email support@vegaworks.net