Privacy policy

tp2gcal (training-tools) — last updated 29 August 2026.

tp2gcal is a private tool with a single user: its author, who is also the owner of the only Google Account it ever accesses. This policy describes how it accesses, uses, stores and shares Google user data.

What data is accessed

The application requests these OAuth scopes:

• https://www.googleapis.com/auth/calendar.events — to create, update and delete events in the operator's own calendar. It touches only events it created itself, identified by a workout id it stores on the event; other events in the calendar are never modified or deleted.
• https://www.googleapis.com/auth/drive.file — a per-file scope: the application can only see and manage files it created itself. It has no visibility into the rest of the operator's Drive.

How the data is used

Planned workouts are read from TrainingPeaks — not from Google — and written into the operator's calendar as events. On each run the application reads back the events it previously created so it can tell what already exists, what needs its title or description refreshed, and what was cancelled by the coach. For swim sessions it renders a printable PDF and uploads it to a tp2gcal folder in Drive, replacing the previous version of that same file when the workout changes.

The data is not used for advertising, profiling, analytics, training machine learning models, or any purpose other than maintaining the operator's own training calendar.

How the data is stored

The application runs on hardware controlled by its operator. It stores, on that machine only, an OAuth token for the operator's own account, in a file readable only by the operating system user that runs the application. It keeps no database and no copy of calendar or Drive content; each run reads what it needs and discards it.

How the data is shared

Google user data is not sold and is not transferred to anyone. It does not leave the operator's own machine except in requests back to Google's own APIs. There is no server operated for other people, no analytics provider and no third-party recipient.

Two details stated for completeness:

• The application can be configured to share an uploaded PDF, for reading, with a Google account named by the operator — used when the calendar lives on a different account than the token. This happens only for files the application itself created, and only for accounts the operator configures.
• When cumulative swim totals are enabled, the workout description obtained from TrainingPeaks is sent to a third-party language model provider to format it. This text does not originate from a Google API, and no data received from a Google API is sent there.

Retention and deletion

The operator can revoke the application's access at any time from Google Account permissions, which immediately ends all access. Deleting the locally stored token file leaves no copy of any Google user data anywhere. Events and PDFs the application created remain in the operator's own calendar and Drive until they choose to delete them.

Limited Use

Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Contact

Questions about this policy: jpolcar@gmail.com