Privacy Policy

Last updated 2026-10-26

This Privacy Policy explains how shinetree collects, uses, stores and protects personal information when you use the shinetree service. Please read it carefully.

1. Introduction

shinetree ("shinetree", "we", "us" or "our") operates a booking and scheduling service for creators, coaches and other professionals, available at shinetr.ee (the "Service"). Creators publish a page where visitors ("Bookers") can book sessions, submit offers and pay. This Privacy Policy describes how we collect, use, disclose and safeguard information for both Creators and Bookers.

By using the Service you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

We collect only the information needed to provide and operate the Service.

2.1 Account information (Creators)

2.2 Booking information (Bookers)

Bookers do not need an account. The management link is the only credential.

2.3 Connected calendars

If a Creator connects Google Calendar, Microsoft Outlook or Apple Calendar, we store the connected account's email address, an encrypted credential, the list of that account's calendars together with the Creator's selections, and the start and end times of busy events on the selected calendars. We do not store event titles, attendees, locations or descriptions. We add confirmed bookings to the one calendar the Creator selects, with the Booker listed as a guest. Disconnecting a calendar deletes all of this data immediately.

2.4 Connected video (Zoom)

If a Creator connects Zoom, we store the Zoom account's email address and user ID and an encrypted OAuth credential that allows shinetree to create meetings under that account. For each booking of a session held on Zoom, we create one scheduled meeting and store its meeting ID and join URL so the Booker can join and so we can update or delete that meeting when the booking changes. We send Zoom only the session name, start time, duration and time zone; no Booker information is sent to Zoom. We do not access any other meetings, recordings, contacts or account data. Disconnecting Zoom in Settings, or removing shinetree from your Zoom account, deletes the credential immediately. Meetings already created remain in the Creator's Zoom account. Google Meet links are created through the connected Google Calendar and are covered by section 2.3.

2.5 Connected Discord server

If a Creator connects Discord, they add the shinetree bot to a Discord server they manage. We store the server's ID and name, the Creator's Discord user ID and username, and the IDs of the channels, messages and invite the bot creates in that server. Discord's sign-in token is used once to identify the Creator and the server, and is not kept.

Like every Discord bot, it can see the server's channels and roles. It uses them only to set up and run its own channels. It sees who is in a voice channel, so it can let Bookers into their room, but it never joins a call and never hears or records audio. It does not read messages in the server's other channels.

For each booking of a session held on Discord, the bot opens a private voice room in that server and a server-only event with the session name and times. We store the room's IDs and times and, for each Booker, the Discord username they gave, their Discord user ID once the bot finds that username among the server's members, and when they joined and left the room. The bot may send the Creator direct messages about their rooms or their plan.

Bookers can also book inside Discord with the bot's /book command. The name, email address and notes typed into its form are handled as described in section 2.2, and the Discord username comes from the account that used the command.

Meeting notesare off unless the Creator turns them on in Settings. When they are on, the bot reads the messages and files posted in the room's chat once, when the room closes, and posts them as a text file, with the files in a zip, into a private thread in the Creator's server. The thread has the Creator and that session's Bookers in it and tells them, when it opens, that the notes will be posted there. The messages and files are held only while the bot makes the notes. We do not store them in our database, and we do not use them for anything else.

Disconnecting Discord in Settings deletes the server, room and room member records described above. If the bot is removed from the server, it stops working there and we email the Creator; the records stay until the Creator reconnects or disconnects. Channels, events and notes the bot posted stay in the Creator's server, where Discord holds them under the Discord Privacy Policy.

2.6 Payment information

Payments are processed by Stripe. Card details are entered on Stripe's own pages, so we never receive or store card numbers. For a plan, we store your Stripe customer identifier and your current plan. For a paid booking, we store Stripe's identifiers for the payment, the amounts, and any refund.

2.7 Payout information (Creators who take paid bookings)

Before Stripe can pay a Creator, the law requires it to verify who they are. Our payout form in Settings asks for your name, date of birth, home address, phone number, nationality where Stripe requires it, and the bank account you want to be paid to. These details pass through our server straight to Stripe over an encrypted connection. We do not store them.

We keep only your Stripe account identifier, your country, your bank's name, the last digits of the account number, and whether Stripe still needs anything from you. When you accept Stripe's Connected Account Agreement on our form, we send Stripe the time, the IP address and the browser it was accepted from, as Stripe requires. If Stripe asks for an identity document, you give it to Stripe in Stripe's own form; it does not pass through us. Stripe holds these details under its own privacy policy.

2.8 Technical information

Our hosting providers record standard server logs (request path, status, timestamp, IP address) for security and troubleshooting. We use one session cookie for sign-in. We do not use advertising or tracking cookies, and we do not run third-party analytics.

2.9 Information we do not store

• Card numbers (entered on Stripe's pages only)
• Full bank account numbers, dates of birth, home addresses or identity documents (passed to Stripe, or given to Stripe directly)
• The content of calendar events, meetings or recordings
• Contacts, files or messages from any connected account (Discord meeting notes, when a Creator turns them on, are posted into the Creator's own server and not kept by us, as section 2.5 explains)
• Precise location data

3. How We Use Information

• Provide the Service: display booking pages, process bookings and offers, create calendar events, meeting links and Discord rooms, process payments, and have Stripe verify and pay Creators.
• Communicate: send transactional email such as sign-in links, booking confirmations, reminders, reschedule and cancellation notices. We do not send marketing email unless you opt in.
• Security: detect and prevent fraud, abuse and unauthorised access.
• Legal obligations: comply with applicable law and enforce our Terms of Use.

4. Data Storage and Retention

4.1 Storage location

Data is stored in databases operated by Supabase in the United States (US East) and processed by Vercel, which hosts the application. The Discord bot runs on a server operated by OVHcloud in the United States (Virginia). Data is encrypted in transit (TLS) and at rest. Calendar and video credentials are additionally encrypted at the application level with a key that is never stored in the database.

4.2 Retention

• Account and configuration data: retained while your account is active.
• Booking records: retained with the Creator's account so both parties can refer to past bookings.
• Calendar and video credentials: retained until you disconnect the integration, remove shinetree from the provider's side, or delete your account.
• Discord server and room records: retained until you disconnect Discord in Settings or delete your account. The Discord username a Booker gave is kept with the booking record.
• Payout details: the Stripe account identifier, bank name and last digits are retained while your payout method exists. Payment records are kept as long as the law requires us to keep accounting records.
• Server logs: retained by our hosting providers for a limited period under their own policies.

4.3 Account deletion

You may request deletion of your account by emailing support@shinetr.ee from the address on your account. On a verified request we delete your account, profile, configuration, bookings and any stored credentials within 30 days. Deleted data may persist in encrypted backups for a limited period before being purged.

5. Data Sharing and Disclosure

We do not sell, rent or trade personal information to third parties for marketing or advertising purposes.

5.1 Service providers

We share information only with the providers needed to operate the Service:

5.2 Between Creators and Bookers

A Booker's name, email address, time zone, notes and offer amount are shared with the Creator they book with, and for a session held on Discord, the Booker's Discord username. A Creator's public page and display name are visible to anyone with the link.

5.3 Legal requirements

We may disclose information if required by law or in response to valid legal process, to protect the rights, property or safety of shinetree, our users or others, or to investigate fraud or security issues.

5.4 Business transfers

If shinetree is involved in a merger, acquisition or sale of assets, personal information may be transferred as part of that transaction. We will notify users of any change in ownership or control of personal information.

6. Google User Data

shinetree's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We read calendar busy times only to hide unavailable times on your booking page, and write calendar events only for bookings you receive. This data is never used for advertising, never sold, and never read by a person except to resolve a support issue you have raised.

7. International Data Transfers

Our service providers process data in the United States and in other countries where they operate. Where you are located in the European Economic Area, the United Kingdom or Switzerland, transfers rely on the safeguards our providers offer, such as standard contractual clauses. By using the Service you acknowledge that your information may be transferred to and processed in these countries.

8. Security

We apply reasonable administrative and technical measures to protect personal information, including:

• Encryption in transit (TLS 1.2 or higher) and at rest
• Application-level encryption of calendar and video credentials
• Database row-level access controls so each account can reach only its own data
• Secrets held outside the codebase and restricted to the production environment
• Automated tests and review on every change before release

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your Rights

Depending on where you live, you may have the following rights regarding your personal information:

• Access: request a copy of the personal information we hold about you.
• Rectification: correct inaccurate or incomplete information. Most account information can be edited directly in the dashboard.
• Erasure: request deletion of your information, subject to legal retention requirements.
• Portability: receive your information in a structured, machine-readable format.
• Restriction and objection: restrict or object to certain processing.
• Withdraw consent: disconnect any integration at any time in Settings.

To exercise any of these rights, email support@shinetr.ee from the address on your account. We acknowledge requests within seven days and respond within the timeframes required by applicable law. If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data protection authority.

10. Children's Privacy

The Service is not intended for individuals under 16 years of age, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and change the "Last updated" date above. Where a change is material, we will notify account holders by email. Continued use of the Service after a change constitutes acceptance of the updated policy.

12. Contact

For questions about this Privacy Policy or to exercise your rights, contact support@shinetr.ee.