Privacy notice

This notice covers Agenda and the other pages served at trentini.tools. Last updated 4 October 2026.

Who is responsible

Bruno Trentini, an individual, runs this site and decides how personal data is used (the “controller”). To contact me about your data, use the contact section at trentini.fyi/#contact.

What is collected, why, and for how long

• Your account. A username and a sign-in key. Your password is stretched in your browser and only the result is sent; I never receive the password. If you sign in with Google (Gmail), I store only a one-way hash of your Google account id. I do not ask for or keep your email address, name or picture. Why: to provide the service you asked for. Kept: until you delete the account.
• Meetings you create. The title, first date, the names you add, each person’s availability and display time zone. All of it is encrypted before it is stored. Why: to run the poll. Kept: until you delete it, and in any case deleted automatically 90 days after the poll’s 15-day response window closes.
• Answers from participants. If you answer a poll you give a name and your available times. The organiser can see them, as can anyone else with the poll link. You can delete your own answer at any time from your personal link. Why: to find a time for the group.
• A session cookie (agenda_session, up to 8 hours) keeps you signed in and protects against forged requests. During Google sign-in a second cookie (agenda_oauth) lasts 10 minutes. Both are strictly necessary and are not used for tracking.
• Visitor counts. The Agenda page counts each visitor once a day, without cookies. A hash of the IP address and browser, keyed with a secret that changes daily, is kept for two days only to avoid double counting. What remains is a number per day and per country, worked out from the IP address. Why: to show how the service is used (legitimate interests). Visitors who send Do Not Track or Global Privacy Control are not counted.
• Analytics (only if you agree). If you click “Allow analytics”, Google Analytics sets cookies (_ga) and receives page views, which app you used, device and approximate location. Meeting links, meeting names and participant names are never sent. Basis: your consent, which you can withdraw at any time with “Analytics preferences” in the page footer. If you decline, nothing is loaded from Google.
• Server logs. Access logging is switched off for Agenda. The web server may briefly hold IP addresses in error logs for security.

Who receives data

Hostinger hosts the server and processes data on my behalf. Google receives analytics data only if you consent. If you choose Google sign-in, Google learns that you use this service. Nothing is sold and there is no advertising.

Google may process analytics data outside the UK and EEA, including in the United States, under the safeguards Google describes for Google Analytics.

Your rights

You can ask to see, correct or delete your data, to restrict or object to its use, to receive it in a portable format, and to withdraw consent. Signed-in organisers can download all their data and delete their account from “Your data” in the workspace; deleting removes the account, its meetings and every answer in them. Participants can delete their own answer from their personal link. For anything else, contact me as above and I will reply within one month. You may also complain to your data protection authority; in the UK this is the Information Commissioner’s Office.

Security

The site is served over HTTPS only. Meeting content is encrypted at rest, passwords are never received, meetings are reachable only through private links, and sign-in attempts are rate limited.

Children

This service is not directed at children under 16.

Changes

If this notice changes, the date above changes with it.