Compliance
Compliance and data handling
What NextUp Alert connects to, what it stores, and where. If anything here disagrees with the privacy policy, the privacy policy is the authoritative document.
What NextUp Alert is
NextUp Alert is a standalone desktop application. It does not provide IaaS, PaaS or SaaS services, and it is not hosted infrastructure that you log in to. It runs locally on your device and talks directly to the calendar APIs you have authorised:
Security certifications for the calendar providers are published by Google Cloud and Microsoft.
Two applications
There are two products, and they have different footprints. Which one you have determines which services are involved.
- NextUp Alert Lite — the original Windows-only app, free, no AI features and on-device voice only. It uses the calendar APIs and diagnostics only.
- NextUp Alert — the current app. Everything Lite does, plus optional AI and voice features and optional paid licensing. Those optional features involve additional providers, listed below.
Services involved
This list mirrors the sub-processors set out in the privacy policy, which contains the full detail of what is sent to each and how long it is kept.
| Service | Role | Applies to |
|---|---|---|
| Calendar data source, sign-in | Both apps | |
| Microsoft | Calendar data source, sign-in, Microsoft Store distribution | Both apps |
| New Relic | Diagnostics, monitoring and logging | Both apps |
| Cloudflare | Backend and licence services | NextUp Alert |
| OpenRouter | AI gateway for the day briefing and smart rules | NextUp Alert, AI features only |
| Fish Audio | Text-to-speech for AI voice announcements | NextUp Alert, AI voices only |
| Lemon Squeezy (and Stripe) | Payment and licensing for optional paid features | NextUp Alert, paid features only |
New Relic publishes its security certifications, including ISO 27001 and FedRAMP listings.
How your data is treated
- No NextUp account is required to use the app. You sign in with the Google or Microsoft account you already have.
- NextUp Alert requests read access only to your calendar — enough to display events and give you timely notifications.
- Your calendar information stays on your machine and with your calendar provider, except where you have deliberately enabled an AI or voice feature that needs to send event details to produce a summary or spoken audio.
- Diagnostic logs are the one other thing that leaves the device. They are redacted on your machine to strip calendar content before upload — a best-effort automated process, not a guarantee, as sections A1.4 and A4.4 of the privacy policy set out.
- Monitoring and logging data is retained for 30 days.
- Reminders themselves are generated locally, which is why they keep working when you are offline.
Security measures
When you sign in, a token is used to read your calendar. That token is stored on your device and encrypted using your Windows credentials — NextUp Alert never sees or stores your password.
The app is distributed through the Microsoft Store as an MSIX package, which brings trusted distribution and the Windows platform protections that come with it, rather than a traditional installer.
A note on what you put in your calendar
Whatever software you use, it is worth being deliberate about what goes into a calendar entry. Event titles, descriptions and attachments are visible to everyone the event is shared with, and to every application you authorise against that calendar. Avoid putting credentials or sensitive personal information in them — that advice applies whether or not you use NextUp Alert.
If your Windows device is compromised
- Contact a trusted IT professional immediately.
- Change your Windows password to a strong one, and do not share it — not even once.
- Sign out of NextUp Alert and sign back in, which refreshes the stored token.
- You can also revoke the app’s access directly in your Google account permissions or your Microsoft account.
Questions
Compliance or security questions can go to pligoapps@gmail.com. See also the privacy policy and the terms of service.