이용약관

1. Data Accessed (수집하는 Google 사용자 데이터)

Gritto requests the following OAuth scopes when you sign in with Google:

• openid, email, profile — Your Google account email address, display name, and profile photo. Used solely for authentication and displaying your identity within the app.
• https://www.googleapis.com/auth/calendar.events— Read and write access to your Google Calendar events. This scope is requested only when you enable Google Calendar sync in Settings. Gritto reads event titles, start/end dates and times, and all-day status. Gritto writes events you create within the app back to your Google Calendar (prefixed with "[Gritto]").

2. Data Usage (Google 데이터 이용 목적)

Gritto uses Google user data strictly for the following purposes:

• Authentication: Your email, name, and profile photo are used to create and manage your Gritto account. No password is stored; authentication is handled entirely through Google OAuth.
• Calendar Synchronization:When you enable Google Calendar sync, Gritto reads your calendar events to display them alongside your tasks and habits. Events created in Gritto are pushed to your Google Calendar so they appear in both places. Gritto filters out its own events (identified by the "[Gritto]" prefix) to prevent duplication.

Gritto does not use Google user data for advertising, marketing, or any purpose unrelated to the core functionality described above.

3. Data Sharing (Google 데이터 제3자 제공)

Gritto does not sell, rent, or share your Google user data with any third party for marketing or advertising purposes.

Google user data may be transmitted to the following service providers solely to operate Gritto:

• Google LLC: OAuth tokens are exchanged with Google servers to authenticate your account and access Google Calendar on your behalf. This is required for the calendar sync feature to function.
• Database hosting provider: Your account information (email, name, profile photo) and OAuth tokens are stored in a secured MySQL database to maintain your session and sync state.

No other third parties receive your Google user data.

4. Data Storage & Protection (데이터 저장 및 보호)

• OAuth Tokens: Your Google OAuth access token, refresh token, and token expiry timestamp are stored in an encrypted database. Tokens are automatically refreshed when they expire (with a 5-minute buffer) and are invalidated immediately upon authentication failure.
• Transport Security: All data transmitted between your browser and Gritto servers is encrypted via SSL/TLS (HTTPS).
• Access Control: Database access is restricted to the minimum required permissions. OAuth tokens are only accessed server-side and are never exposed to the client browser.
• Rate Limiting: API endpoints are rate-limited (60 requests per minute per IP) to prevent abuse.

5. Data Retention & Deletion (데이터 보유 및 삭제)

• Retention: Your Google user data is retained for as long as your Gritto account is active. Google Calendar data is fetched on demand for display purposes and is not permanently cached beyond your active session.
• Disabling Sync: You can disable Google Calendar sync at any time in Settings. When sync is disabled, Gritto stops reading from and writing to your Google Calendar. Your OAuth tokens remain stored to allow re-enabling sync without re-authentication.
• Account Deletion: You can delete your account at any time from the Settings page. Upon deletion, your account enters a 30-day soft-delete grace period during which you cannot log in. After 30 days, if you do not restore your account, all associated data — including Google OAuth tokens, tasks, events, categories, and preferences — is permanently deleted via cascading database deletion.
• Immediate Session Termination: When you delete your account, all active sessions are immediately invalidated and you are logged out.
• Token Revocation: If Google reports an authentication error (e.g., revoked access), Gritto immediately clears the stored OAuth tokens and disables Google Calendar sync for the affected account.
• Requesting Deletion: To request immediate deletion of your data, you may contact us at the email provided below or use the account deletion feature in Settings.