Tiếng Việt

Privacy Policy

For the Nhắc Âm Lịch browser extension and the companion web page at nhac-am-lich.chuan-nv.com. Last updated: 9 September 2026.

1. Google user data we access

The application requests exactly one OAuth scope:

• https://www.googleapis.com/auth/calendar.events — create and edit events on the user's calendar.

Using this scope, the application creates, updates and deletes only the calendar events it created itself. Every such event is tagged with a private extended property (amLichId), and all read queries filter on that property. The application does not read, modify or delete any other event on the user's calendar, and does not access calendar settings, calendar lists or sharing permissions.

The application does not request access to Gmail, Google Drive, Contacts, Photos, location, or any other Google service.

2. Data stored on the user's device

Data	Where	Why
List of lunar dates the user entered: title, lunar day and month, repeat rule, reminder offsets	chrome.storage.local	To compute upcoming dates and fire local reminders. Never leaves the device.
Google OAuth access token, and the IDs of calendar events the application created	chrome.storage.local	To call the Google Calendar API and avoid creating duplicate events. Never leaves the device.
Timestamps of reminders already shown	chrome.storage.local	To avoid notifying the user twice for the same date. Never leaves the device.

The application does not store email addresses, passwords, contacts, browsing history, location, advertising identifiers, or any analytics identifier.

3. How we protect your data

Security procedures are in place to protect the confidentiality of Google user data. Specifically:

• Encryption in transit. All communication with Google is performed over HTTPS (TLS). The application makes no plaintext network requests. Its network access is restricted at the manifest level to googleapis.com and oauth2.googleapis.com.
• Encryption and isolation at rest. Tokens and user data are stored using the browser's chrome.storage.local API, inside the browser profile directory. The browser isolates each extension's storage so that no other extension, website or script can read it, and the data inherits the disk encryption of the user's operating system where enabled.
• No central store to breach. The developer operates no server, no database and no backup system. Google user data is never transmitted to, or stored on, developer-controlled infrastructure. There is therefore no central repository that could be compromised, and no developer employee can access user data.
• Credentials are never handled by the application. Authentication happens entirely within Google's own OAuth consent flow. The application never sees, receives or stores the user's Google password.
• Short-lived credentials. The access token expires approximately one hour after issue. It is stored only in local extension storage and is never synchronised to any cloud service, including the browser's own account-sync mechanism.
• Least privilege. The application requests the narrowest scope that permits its function. A read-only scope would not allow it to create reminders; the broader calendar scope is not requested because settings, calendar lists and sharing are never touched.
• Code integrity. The extension contains no obfuscated code and loads no remote code. It executes only the JavaScript shipped inside its reviewed package, under the Manifest V3 content security policy. It uses no third-party analytics, telemetry, advertising or tracking SDKs.

4. Data retention and deletion

Data is retained only for as long as it serves the purpose for which it was collected, and no longer:

• Access token — retained until it expires (approximately one hour), or until the user disconnects, whichever comes first. Disconnecting sends a revocation request to Google's oauth2.googleapis.com/revoke endpoint, so the grant is destroyed at Google's end as well as locally.
• The user's list of lunar dates — retained on the user's own device until the user deletes an entry or uninstalls the extension.
• Server-side retention — none, because there is no server. No copy of any user data exists outside the user's own device and the user's own Google account.

How a user can delete their data at any time:

• Disconnect in the extension's settings — revokes the token at Google and clears it locally.
• Delete an entry in the extension — the corresponding Google Calendar events are removed on the next sync.
• Uninstall the extension — the browser erases all data it stored, with no residue.
• Revoke access from Google at myaccount.google.com/permissions, independently of the application.

Calendar events already created belong to the user and remain in their Google Calendar after disconnecting; the user may delete them there at any time.

5. Sharing and transfer

Google user data is never transferred, sold, rented or disclosed to any third party. There are no service providers, no processors, no affiliates and no advertising partners, because there is no infrastructure through which data could pass.

6. Limited use and prohibited uses

The application's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Google user data is explicitly not used:

• for advertising, retargeting, or personalised or interest-based advertising;
• for determining creditworthiness or for any lending purpose;
• for sale or transfer to data brokers, information resellers or any other party;
• to develop, improve or train generalised artificial-intelligence or machine-learning models;
• for any purpose other than providing the user-facing reminder features described in this policy.

No human reads Google user data. The developer has no technical means of doing so.

7. The companion web page

The page at nhac-am-lich.chuan-nv.com lets users add lunar dates from a phone. It follows the same principles: the lunar algorithm runs in the visitor's browser, the access token is held only in the page's memory and is discarded when the tab closes, nothing is written to a database, and no cookies or analytics are used. The page loads Google's official identity script (accounts.google.com/gsi/client) solely to display Google's sign-in dialog.

8. Children

The application is not directed to children under 13 and does not knowingly collect data from them.

9. Changes to this policy

If this policy changes, the revised version will be published at this address with an updated date. Any change that would broaden the scope of data accessed will require the user to grant consent again.

10. Contact

Questions about this policy may be sent to chuan.nguyen.van.ttbn@gmail.com.