How the data is used
Your Google OAuth token is used only to call the Google Calendar API after you type /meet in Slack. The app creates a short calendar event on your primary Google Calendar with Google Meet conference data enabled, then reads the generated Meet link from Google's response.
The stored token lets the app create the meeting link from the Google account you connected. Meet for Slack does not use Google user data for any purpose unrelated to creating and sharing the meeting link you requested.
Sharing and disclosure
Meet for Slack does not sell Google user data and does not disclose Google OAuth tokens to Slack or other third parties.
When you run /meet, the generated Google Meet link is sent to Slack so it can appear in the channel or direct message where you requested the meeting. This is the only Google API response data we intentionally share with Slack.
Google user data is processed by Cloudflare Workers and stored in Cloudflare KV because Cloudflare hosts the app infrastructure. We may also disclose data if required to comply with law, enforce our terms, or protect the app from abuse.
Data protection
All browser, Slack, Google, and Cloudflare Worker requests use HTTPS. Google OAuth tokens are stored server-side in Cloudflare KV, are not exposed to the browser, and are available only to the Worker through its bound KV namespace.
Cloudflare KV provides encryption at rest, and traffic between Cloudflare Workers and KV is protected with TLS. App secrets such as the Google client secret and Slack signing secret are stored as Worker environment secrets instead of being placed in public code.
Google authorization state is signed, expires after a short time, and is used only to complete the account connection flow. Access to production systems is limited to people who need it to operate and support the app.
Retention and deletion
Google OAuth tokens are kept only while your Slack user remains connected to a Google account for Meet for Slack. Temporary authorization records expire automatically, usually within 30 minutes, and short connection status records expire within about 60 seconds.
You can disconnect the app at any time by removing Meet for Slack from your Google Account Permissions page. If Google token refresh fails or access is revoked, Meet for Slack deletes the stored Google tokens and asks you to reconnect before creating another Meet link.
You can also request deletion of stored Slack and Google connection data by emailing hello@meetforslack.work. We delete connection records unless we must retain limited information for legal, security, or abuse-prevention reasons.
Contact
Questions about privacy can be sent to hello@meetforslack.work.