Privacy policy

Last updated 5 October 2026

SaYomi helps readers follow release sources, discover new releases, and keep track of books they’re interested in. Reading plans and calendar synchronization help users organize their reading. SaYomi at sayomi.cc is operated by Thanan Meepalang. Visitors can explore an isolated demo workspace with sample data. This policy explains how your information is used when you sign in and connect a calendar.

Information SaYomi uses

Google sign-in supplies your account identifier, name, and verified email address. SaYomi stores the books, reading history, tasks, notes, source follows, and preferences you save. Connecting Google Calendar allows SaYomi to read event details and create, update, and delete events for task synchronization. An optional Outlook connection works similarly.

SaYomi uses request counters and hashed network and account identifiers to enforce abuse and usage limits.

How calendar access works

SaYomi imports events from your primary calendar to show them alongside your reading plans. Dated tasks can create calendar events; changes to linked events and tasks synchronize in both directions. Completing or deleting a task removes its linked calendar event. SaYomi does not copy unrelated personal events between Google and Outlook.

Access and refresh tokens let synchronization continue while you are away. Tokens are encrypted before storage. SaYomi uses a necessary session cookie to keep you signed in and a temporary cookie to protect the sign-in process. A preference cookie remembers your selected language. It does not use advertising cookies.

How we protect your data

SaYomi uses the following safeguards to protect Google account information, calendar data, connection credentials, and your private workspace against unauthorized access, disclosure, alteration, or loss:

Encryption in transit: When you access SaYomi at https://sayomi.cc, HTTPS/TLS encrypts data sent between your browser and the service. Requests from SaYomi to Google APIs also use HTTPS.
Encryption at rest: Cloudflare encrypts SaYomi's production database and recovery backups at rest using provider-managed encryption. Google and Microsoft OAuth access and refresh tokens are additionally encrypted with AES-256-GCM before storage. The token-encryption key is held in a Cloudflare Worker secret, separately from the database.
Access controls: Google sign-in verifies your Google account identity and email address. Server-side authorization checks limit each signed-in user to their own private workspace and connected-calendar data. Recovery backups are not publicly accessible.
Session protection: Sign-in sessions use randomly generated tokens, stored as hashes on the server. Session cookies use Secure, HttpOnly, and SameSite protections, and requests that change your data are checked against the application's origin.

SaYomi shares, transfers, or discloses Google user data to the following recipients for the purposes described below:

Cloudflare: Our hosting and storage provider processes your Google account identifier, name, email address, calendar data, and connection tokens on our behalf to run SaYomi and store its database and private recovery backups. Tokens are encrypted before storage. Cloudflare also processes request metadata, including IP addresses and operational logs, to deliver and protect the service.
Google: Google receives sign-in and authorization requests. When you connect Google Calendar, SaYomi sends task titles, notes, dates, and event identifiers to Google to create, update, and delete events in your primary calendar.
Microsoft: If you connect Outlook, SaYomi sends dated task titles, notes, dates, and your workspace time zone to Microsoft to synchronize calendar events. If both calendars are connected, title and date changes from Google Calendar events linked to SaYomi tasks can reach Microsoft through those tasks, and vice versa. Synchronization can run in the background while connected. Unrelated personal events are not copied between providers, and Google OAuth tokens are not sent to Microsoft.
Resend: Our email delivery provider receives your Google-account email address, message content, and delivery identifiers to send release updates and account-inactivity or deletion notices. You can disable release emails in Settings; essential account notices are sent even when release emails are disabled. These messages do not include your Google Calendar events or OAuth tokens.
Browser push providers: If you enable browser notifications, encrypted notification content is sent through your browser's push provider (Google, Mozilla, Apple, or Microsoft) to your device. Task reminders may include a task title synchronized from Google Calendar. Push delivery does not include your Google account email address or OAuth tokens.
SaYomi's operator and authorized administrators: Account management and source-request review show your Google name and email alongside account status, activity, and requests you submit. Access is limited to account administration, responding to your requests, and security. Human access to private Google Calendar content is limited to your explicit consent for specific data, security investigations, or legal obligations.

We may also disclose Google user data to competent authorities when required by applicable law, or to appropriate parties when necessary to investigate abuse or protect security, as permitted by Google's Limited Use requirements. We do not otherwise share Google user data with other users, publishers, advertisers, or data brokers.

Google user data is used only for the sign-in, workspace, calendar, notification, account-management, and security purposes described here. Data received from Google, and information derived from it, is not sold, used for advertising, or used to train generalized AI models. SaYomi’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Public sources and external websites

Public release-source and book-cover websites receive normal network and browser request information when their content is loaded or you visit them. SaYomi does not provide these websites with your Google account information, OAuth tokens, or Calendar data.

Your choices and deletion

Disconnect a calendar in Settings to stop synchronization and remove its stored connection credentials. You can also revoke access through your Google Account . Disconnecting does not delete your existing remote calendar events or your reading workspace. You can export your workspace from Settings.

SaYomi records your last active use. For Google accounts, after 21 days of inactivity, source tracking and release alerts pause and an account warning is sent to your email, even if release emails are disabled. After three calendar months of inactivity, your account and private workspace data are deleted only if at least seven days have passed since the warning was accepted for delivery. Returning before deletion cancels it and resumes your previous tracking preferences. Existing accounts receive a fresh grace period when this policy launches. Shared public book and release records remain in the catalog; your personal edits and notes are private. Use Delete account in Settings → Your data to remove your account, stored calendar data, and workspace. You can also request deletion by emailing kengonline02@gmail.com. Recovery backups rotate on an approximately 14-day schedule; hosting recovery history can retain previous data for up to 30 days.

Demo workspaces and their private data are automatically deleted after seven days without active use, without an email warning. Returning before deletion starts a new seven-day period. A demo converted to a Google account follows the Google-account retention policy instead. Demo workspaces suspended by an administrator are excluded from automatic cleanup.

Contact and changes

Send privacy questions to kengonline02@gmail.com. Changes to these practices will be described on this page with an updated date.