CSI Theeta
Privacy notice
Last updated 12 October 2026
CSI Theeta is the internal task portal of Central School International (CSI), Islamabad. Only CSI staff invited by a CSI administrator can use it. This notice explains what CSI Theeta keeps about you and, in detail, what happens to your Google Calendar data if you choose to connect it.
Google Calendar
Connecting a Google Calendar is optional and only you can do it, for your own Google account. Nobody else can connect or view your calendar for you.
At a glance
| What | Why | Kept for | Who can see it |
|---|---|---|---|
| Your Google account’s email address | To show which account is connected | Until you disconnect | You |
| Names and colours of your calendars, and their default reminder times | So you can choose which calendars to show | Until you disconnect | You |
| Events from the calendars you choose: title, start and end, all-day or not, location, reminder times, and a link to the event in Google | To show them beside your tasks and remind you before they start | A rolling window of one month back to six months ahead | You |
| Reminder notifications for those events | To remind you in CSI Theeta | In your notifications until you disconnect | You |
| Access tokens from Google | To refresh your calendar and update the “CSI Theeta” calendar | Until you disconnect | Nobody: stored encrypted, used only by the server |
Permissions CSI Theeta asks Google for
- Your email address (basic sign-in permission), to label the connection.
- See the list of your calendars, so you can pick which ones to show.
- See events in your calendars, read-only. CSI Theeta cannot change or delete any of them.
- Create and manage calendars it creates itself. CSI Theeta uses this for one calendar named “CSI Theeta” that holds your tasks. Google does not let CSI Theeta write to any other calendar.
What CSI Theeta does not copy
Event descriptions, guest lists, attachments, video-meeting links, events you declined and cancelled events are not stored. Only the calendars you tick are read; by default that is just your main calendar.
What CSI Theeta puts into your Google Calendar
For each task you are responsible for or are working on, CSI Theeta adds an all-day event on its due date to the “CSI Theeta” calendar in your Google account. The event contains the task title, its reference code, status and priority, the first 1,500 characters of its instructions, and a link back to the task. These events are marked “free” so they never block your availability, and carry no Google reminders. You can switch this off in Google Calendar settings in CSI Theeta; the events are then removed from Google.
How it is protected
- Google tokens are encrypted (AES-256-GCM) before they are stored, and only CSI Theeta’s server can read them.
- Your calendar data can only be read by your own signed-in session. CSI administrators and team leads cannot see it in CSI Theeta, and it never appears in reports, exports or other people’s screens.
- The people who maintain CSI Theeta can technically access its database to keep the service running. They do not look at calendar data unless you ask them to help with a problem involving it.
- Connections to Google and to CSI Theeta are encrypted in transit (HTTPS).
When it is updated and deleted
- Changes you make in Google (new, moved or deleted events) reach CSI Theeta within about five minutes. Deleted events are removed from CSI Theeta at that point.
- Events that fall more than a month into the past are removed at the next update.
- Unticking a calendar deletes its copied events from CSI Theeta immediately.
- Disconnecting (Profile, or Settings for administrators → Google Calendar → Disconnect) immediately deletes your Google email, calendar list, copied events, calendar reminders and tokens from CSI Theeta, removes the “CSI Theeta” calendar from your Google account, and revokes CSI Theeta’s access at Google.
- If your CSI Theeta account is closed, the same deletion and revocation happen automatically within minutes. Your calendar stops being read the moment the account is closed.
- You can also remove access from Google at any time at myaccount.google.com/permissions. CSI Theeta then stops updating, shows a “Reconnect” prompt, and you can disconnect to delete the copies.
Google API Services User Data Policy
CSI Theeta’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to show your calendar, remind you, and keep your “CSI Theeta” calendar up to date for you. It is not sold, not used for advertising, not used to train AI models, and not shared with anyone else.
Your work in CSI Theeta
What we keep
- Your name, school email address, division and role, set by an administrator.
- The tasks, comments, files, approvals and notifications you work with.
- Sign-in times and security events, to protect accounts.
Who can see it
Your tasks are visible to you, the people who assigned, support or review them, the leads of the division they belong to, and CSI administrators.
Where it is stored
CSI Theeta runs on Supabase (database and file storage) and Vercel (application servers), both in Tokyo, Japan. Data is encrypted in transit and at rest. Notification emails are sent through our email provider.
Contact
Questions, or a request to see or delete your data: csi-theta@ksp.org.pk.