1. Operator and scope
Arky Labs, Inc. (“we” or the “Operator”), a company incorporated in the State of Delaware, United States, operates the NutShell website and app. Our principal office is at 1F, 61, Yonsei-ro 2na-gil, Seodaemun-gu, Seoul, Republic of Korea. This Policy applies to personal information processed through nutshell.ooo and app.nutshell.ooo. For privacy inquiries or to exercise your rights, contact help@arky.so.
2. Information we process and why
| Feature | Information processed | Purpose |
|---|---|---|
| Email accounts | Email address, account identifier and authentication status; password information handled by the authentication service if you sign up with a password | Registration, sign-in, account security and authentication emails |
| Google sign-in | Google account identifier, email and basic profile information such as your name and profile image | Identifying you, creating an account or signing in to an existing account |
| Tasks and routines | Titles, notes, deadlines, status, planned dates, time blocks, travel time and recurrence settings you enter | Storing tasks, schedules and routines and making them available across devices |
| Google Calendar connection (optional) | Account email; calendar lists, names, identifiers and access permissions; event titles, descriptions, locations, times, recurrence, attendees, response status and sync identifiers for selected calendars; authentication tokens | Choosing calendars; displaying, creating, updating, deleting and syncing events; sending attendance responses |
| iCloud Calendar connection (optional) | Apple account email, app-specific password, selected calendar and event information, and sync identifiers | Displaying and syncing events from selected iCloud calendars |
| Operations and support | IP address, request time and path, browser and error information, email delivery results and information you provide in support inquiries | Providing the service, troubleshooting, security, checking email delivery and responding to inquiries |
The core service uses your account information and the information you enter. Calendar connections are optional: you can use tasks and routines without connecting a calendar. NutShell does not ask for your regular Google or Apple account password.
3. Google data access and Limited Use
Google sign-in uses basic profile and email permissions. When you connect Google Calendar, we separately request permission to read your calendar list and access events. The calendar list lets you choose which calendars to connect, and events are synced for the calendars you select. For calendars with write access, your actions may create, update or delete events, or send attendance responses.
Data received from Google APIs is used only to provide and improve the sign-in and calendar features visible in the app. We do not sell it or use it for targeted advertising, credit assessment, or training general-purpose artificial intelligence or machine learning models. We do not arbitrarily read your event content. Access is limited to circumstances permitted by Google policy, such as support with your explicit consent, responding to security incidents or complying with legal obligations.
NutShell’s use of information received from Google APIs, and its transfer to other services, adheres to the Google API Services User Data Policy, including its Limited Use requirements.
4. Retention and deletion
We retain account information and tasks and routines you create while your account is maintained and the service is provided. When you delete an item or request account deletion, we delete data no longer needed for the relevant purpose. You can request account deletion at help@arky.so; we process it after verifying your identity. If separate retention is required, for example by law or an ongoing dispute, we will explain its scope and duration.
We retain calendar connection tokens and iCloud app-specific passwords while the connection is active. Disconnecting in the app settings stops syncing and removes stored authentication credentials. Imported copies and connection information are cleaned up, but items you created yourself or converted into regular tasks, and originals in external calendars, may remain until separately deleted.
Information deleted from the live database is immediately excluded from service use. Backups, security logs and email processing records may remain for a limited period according to the relevant provider’s retention settings and contracts. They are not used for purposes other than recovery, security or legal obligations. Support records are retained for as long as necessary to resolve inquiries and meet related obligations.
5. Service providers and international processing
We use the following infrastructure and external services as needed to provide NutShell. Data is transmitted over encrypted connections when you use features, sync calendars or send emails.
| Service | Processing and information | Location and details |
|---|---|---|
| Supabase | Account authentication and storage of account, task, routine and calendar sync data | Primary database: Seoul, Republic of Korea. Overseas subprocessors may support operations and assistance. Supabase privacy information |
| Cloudflare | Web hosting, request handling, calendar sync execution, and security and error logs | Global network, including the United States and other countries. Cloudflare privacy information |
| Resend | Authentication and welcome emails: recipient email address, message content and delivery results | United States. Resend data processing information |
| Google / Apple | Account authentication or calendar API requests and responses selected by the user | Each provider’s account and data processing policies apply. Google / Apple |
Each service processes information while performing its role and for its contractual retention period. NutShell does not sell personal information or provide it for advertising outside these purposes. If you do not agree to the essential account, hosting and email processing, access to account-based services may be limited. You can choose not to use, or disconnect, optional Google and iCloud integrations. Contact help@arky.so for questions about international processing or to request that processing stop or your account be deleted.
6. Your rights and disconnecting
You can view, edit and delete content you create in the app. To request a copy, correction or deletion of personal information, restriction of processing or account closure, email help@arky.so from the address registered to your account. We may verify account ownership to handle your request safely.
You can disconnect Google in NutShell settings or revoke access in Google Account connections. You can revoke an iCloud app-specific password in Apple Account management. If you only revoke permission through the external provider, please separately request deletion of information already stored in NutShell or deletion of your account.
7. Safeguards and browser storage
We use HTTPS for communications and encrypt calendar access and refresh tokens and iCloud app-specific passwords on the server. Data access is separated by user, and server secret keys are not provided to the browser.
The app uses browser storage to maintain your sign-in session, temporary secure cookies to complete calendar connections, and storage for language, theme and display preferences. Clearing these may sign you out or reset your settings. We currently do not use advertising or behavioral tracking cookies, and the landing page contains no analytics tracking tools.
8. Contact and updates
Arky Labs, Inc. is responsible for processing personal information. Our Data Protection Officer is Jaeho Lee (CTO & DPO), reachable at jaeho@arky.so. General inquiries go to help@arky.so. Support hours are weekdays, 10:00–18:00 (Korea Standard Time). For privacy rights concerns, you may also contact Korea’s Personal Information Infringement Report Center or Personal Information Dispute Mediation Committee.
If our data practices change, we will update this page and its effective date. Changes that materially affect users’ rights will be announced through the service or by email at least 7 days in advance. This Policy takes effect on September 29, 2026.