Privacy policy

Last updated 5 November 2026

diarydeck is a booking page for small service businesses. This page explains what it does with personal information, for the businesses that use it and for the people who book with them.

Who is responsible for what

diarydeck is run by We Are One Apps in the United Kingdom. You can reach us at info@weareoneapps.com.

There are two different relationships here, and it matters which one you are in.

  • If you run a business on diarydeck, we are the data controller for your own account details, and we decide how they are handled. This page tells you how.
  • If you booked an appointment with a business, that business is the data controller. It decides what to ask you and how long to keep it. We only hold the booking for them, as their processor, and act on their instructions. Ask them for their own privacy notice; if you cannot reach them, write to us and we will pass it on.

What we hold

If you run a business here

  • Your name, email address and a one-way hash of your password. We never store the password itself and cannot read it.
  • Your business name, the address of your booking page, your time zone, your working hours and anything else you fill in while setting up.
  • Credentials for the services you connect — your SMS provider's API key, your mailbox password, Google and Zoom access tokens. These are encrypted before they are written to disk, and the admin screens only ever show you the last few characters.
  • A record of the messages the app sent for you, so you can see what went out and when.

If you booked with a business here

  • Your name and email address, and your phone number if the business asks for one.
  • Your answers to any questions that business added to its booking form, the names of guests you added, and your time zone.
  • The time you booked, whether you later moved or cancelled it, and the reason you gave.
  • Whether you agreed to text reminders.

Everyone

Our web server keeps short-lived request logs that include IP addresses, so we can find faults and block abuse. Signing in sets one cookie, which keeps you signed in and nothing else. There is no analytics script, no advertising tag and no third-party tracker anywhere on this site or on a booking page.

What we do with it

We use it to run the service and nothing else: to show a booking page, to work out which times are genuinely free, to record a booking, to send the confirmations and reminders the business has set up, to keep the business's calendar in step, and to answer support questions. We do not sell personal information, we do not share it with advertisers, and we do not use it to train machine-learning models.

Google data

Connecting a Google account is optional. If a business connects one, it grants two permissions:

  • See your calendars and when you are busy (calendar.readonly) — so that a time already taken in Google is never offered on the booking page. We read the busy periods of the calendars that business ticks. We do not read the titles, guests, descriptions or attachments of those events.
  • Create and update calendar events (calendar.events) — so that each booking appears in the chosen calendar, carries a Google Meet link when that is the meeting type, moves when the booking moves and disappears when it is cancelled. We only touch events this app created.

We keep the refresh token Google issues, encrypted, and the email address of the connected account so it can be shown in the admin. Nothing else from Google is stored.

Limited Use. diarydeck's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

A business can disconnect Google at any time on its Integrations page, which deletes the stored token, or revoke access directly at myaccount.google.com/permissions.

Who else sees it

The services a business connects are that business's own accounts, chosen and paid for by them. When a reminder goes out, the recipient's number or email address and the text of the message pass through the provider the business picked — typically TextMagic or Twilio for texts, and their own mailbox for email. Those providers hold that data under their own terms.

Our only supplier is Hostinger, which provides the server. Everything is stored on a single virtual server in the United Kingdom, and backups stay on it.

We would also disclose information if the law required it, and we would tell the business first unless we were forbidden to.

How long we keep it

Bookings and their message history stay until the business deletes them or closes its account. Closing an account removes its data, including every booking and every stored credential, within 30 days. Request logs are kept for about two weeks. If you booked an appointment and want it removed sooner, ask the business — it is their record to delete.

Your rights

Under UK and EU data protection law you can ask for a copy of what we hold about you, ask for it to be corrected or deleted, object to how it is used, or ask for it in a portable form. Write to info@weareoneapps.com and we will answer within a month. If your request concerns a booking you made with a business, we will pass it to that business, because the decision is theirs.

If you think we have handled your information badly, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first and gave us the chance to put it right.

Children

diarydeck is a tool for businesses and is not intended for children. Do not create an account if you are under 16.

Changes

If this page changes in a way that matters, we will email the businesses using the service before the change takes effect, and change the date at the top.

Questions about this page: info@weareoneapps.com.