Privacy policy
In effect from 15 November 2026.
Kentaro Wada runs Poleway from Japan. This page says what the service at poleway.so and alpha.poleway.so keeps about you, what it sends to others, and what it reads from Google. Poleway's code is open. A copy that someone else hosts is theirs to answer for.
Your account
Poleway keeps your email address. It signs you in with a code sent to that address. An email delivery provider sends the message, so that provider receives your address and the code.
While you are signed in, the server keeps a session with the IP address and the browser it started from, and your browser keeps a cookie that names the session. A second cookie remembers the language you chose.
Your work
Poleway stores the Areas, Projects, Tasks and Logs you write, and the images you add. No one else who uses Poleway can read them. The text is in a database on Poleway's server, which a hosting provider runs. The images are in a private bucket at Cloudflare R2.
When you write a link, the server fetches that page to show its title and picture.
Agents
An Agent is an app you connect, such as Claude or ChatGPT. It reads and writes your Areas, Projects, Tasks and Logs with your authority. What it reads goes to that app, under that app's own terms. You can revoke an Agent on the Agents page. An Agent cannot read your calendar events.
Google Calendar
Poleway can show your Google Calendar events in Today and Upcoming. It reads nothing from Google until you connect a Google account. When you connect, Poleway asks Google for two permissions, both read-only:
-
calendar.calendarlist.readonly, to list your calendars with their names and colors, so you can choose which ones to show. -
calendar.events.readonly, to read each event's title, its start and end, and whether you declined it.
Poleway cannot change or delete anything in your calendar.
The server asks Google for your events each time Today or Upcoming opens, and sends them to your browser. It does not store them. It keeps three things: the token Google issues so it can read again later, which it encrypts, the address of the Google account, and the list of calendars you chose to hide.
Poleway uses what it reads from Google only to show it to you. It does not give it to Agents, send it to PostHog or to anyone else, use it for advertising, or use it to train AI models. Nobody at Poleway reads it.
Turning Calendar Events off deletes the token and the address, and tells Google to cancel the permission. You can also remove Poleway from your Google account's connections at any time.
Poleway's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Usage
Poleway sends page views and the names of the actions you take, such as
createTask, to PostHog, to learn which parts of Poleway people use. PostHog
stores them in the United States, and its script keeps an id in your browser.
An event carries your user id, a session id, your device and browser, your time zone and screen size, the path of the page, and the site or campaign you came from. It never carries a title, a description, a Log, an image, your email address or anything from your calendar.
Turning on Do Not Track in your browser stops the page views. It does not stop the action names, which the server sends.
Who else receives data
The providers named above, each for the job named there: the email delivery provider, the hosting provider, Cloudflare, PostHog, and Google once you connect a calendar. Some of them work outside Japan. Poleway does not sell data or share it for advertising. It discloses data to anyone else only when the law requires it.
Keeping and deleting
Poleway keeps your account and your work until you delete them or ask for your account to be deleted. Backups keep a copy for some weeks after that: a database backup is deleted after 30 days, as is the backup of a deleted image, and the hosting provider keeps copies of the server's disk for about two weeks.
For a copy of your data, or to have your account and everything in it deleted, email [email protected].
Security
Your browser and Poleway talk over HTTPS. The token from Google is encrypted in the database, and the bucket that holds your images is closed to the public.
Changes
When this policy changes, this page shows the new date. Before Poleway reads anything more from Google than this page says, the page changes first and Poleway asks for your consent again.
Contact
Kentaro Wada, [email protected]