Privacy Policy for Birthday Blitz
Last Updated: July 21, 2026
Birthday Blitz ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy details how our Chrome Extension collects, uses, protects, retains, and deletes your data—specifically Google user data obtained via Google Calendar APIs.
1. How We Use Google User Data
Birthday Blitz accesses Google user data strictly through official Google Calendar API scopes (https://www.googleapis.com/auth/calendar.events and https://www.googleapis.com/auth/calendar.readonly).
- Data Accessed:
- Calendar List: We access your list of Google Calendars so you can select which calendar to add birthdays to.
- Account Identification: We access basic account identifiers (such as your primary calendar email) strictly to display your logged-in account in the extension UI.
- Event Creation: We request permissions to create new recurring birthday events in your selected calendar.
- Specific Data Usage:
Data retrieved from Google APIs is used exclusively to populate the calendar dropdown in the extension UI and to create annual recurring birthday events (formatted as
[Name]'s Birthday) in your designated calendar.
We do not use Google user data for advertising, marketing, profiling, tracking, or training AI/machine learning models.
Google API Limited Use Disclosure: Birthday Blitz's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
2. Data Protection Mechanisms for Sensitive Data
We employ strict data security mechanisms to protect your sensitive Google user data:
- Encryption in Transit: All requests and communications between Birthday Blitz and Google API endpoints are encrypted in transit using industry-standard HTTPS / TLS 1.2+ protocols.
- OAuth 2.0 Authentication: Authentication is handled exclusively through Google's official
chrome.identity OAuth 2.0 framework. Birthday Blitz never sees, requests, or stores your Google account password.
- Client-Side Execution: Birthday Blitz operates entirely within your browser environment. OAuth tokens are cached securely in Chrome's identity storage, and non-sensitive preferences (e.g., your last selected calendar ID) are stored locally in Chrome's isolated storage (
chrome.storage.local).
- No Remote Servers: We do not host or operate external backend servers or databases. Your sensitive user data is never sent to or stored on external servers.
3. Retention and Deletion of Google User Data
- Data Retention:
Birthday Blitz does not retain or store your Google user data on any remote servers. Calendar details retrieved from Google APIs exist temporarily in browser memory during your active extension session.
- Data Deletion & Access Revocation:
- In-App Logout: Clicking Logout in the extension immediately revokes your OAuth access token via Google's token revocation endpoint (
https://accounts.google.com/o/oauth2/revoke), deletes Chrome's cached token, and clears stored local preferences.
- Google Account Permissions: You can revoke access at any time via Google Account Third-party App Permissions.
- Uninstalling Extension: Uninstalling Birthday Blitz automatically removes all locally stored extension data from your browser.
4. Third-Party Data Sharing
We do not sell, share, trade, or transfer any Google user data or personal data to third parties.
5. Contact Us
If you have questions regarding this Privacy Policy, please visit https://tobyyeung.github.io/ or view our repository on GitHub.