Junocal + Zoom

When a studio owner connects their Zoom account to Junocal, every virtual class they schedule can auto-generate a Zoom meeting on their own Zoom subscription. The join URL lands on the client's booking confirmation email, reminder emails, and the "my bookings" page — so clients can join with one click instead of hunting for a link.

Rescheduling a class updates the existing Zoom meeting (the join URL stays the same, the time changes). Cancelling a class deletes the meeting. If you delete the meeting directly inside Zoom instead, Junocal clears the dead link from the class so your clients don't email broken URLs.

Meetings are hosted on your Zoom account, not Junocal's. We never charge against your Zoom subscription, we never join your meetings, and we never see who attended or what was recorded.

We request exactly three OAuth scopes — the minimum needed to do the job, all of them "User-level" (not account-administrator):

• meeting:write:meeting — to create the meeting when you schedule a virtual class.

• meeting:update:meeting — to update the meeting time when you reschedule.

• meeting:delete:meeting — to delete the meeting when you cancel.

We do NOT request access to recordings, your Zoom profile, chat messages, webinars, or other meetings on your account. The Zoom consent screen will confirm this before you connect.

1. Sign in to Junocal as the studio owner. (Front-desk and instructor roles can't connect Zoom — only Owner.)

2. Go to Settings → Integrations, find the Zoom card, click "Connect Zoom".

3. Junocal redirects you to Zoom's consent screen. Review the three scopes Zoom shows you. Click Authorize.

4. Zoom redirects you back to Junocal. The Integrations page now shows "Connected as <your-zoom-email>".

5. The next time you schedule a virtual class, the "Zoom (auto-generate link)" option is enabled in the Location picker. Existing classes keep whatever link (or no link) they had.

Schedule a virtual class with "Zoom (auto-generate link)" selected → Junocal creates a Zoom meeting on your account immediately. The meeting topic mirrors the class name (e.g., "Teaching: Reformer Flow"), the start time and duration match the class, and the timezone matches your studio. Default Zoom settings: waiting room ON, mute on entry ON, join-before-host ON.

Reschedule the class → Junocal updates the Zoom meeting in place. The join URL doesn't change, so clients who already received it still have a working link.

Cancel the class → Junocal deletes the Zoom meeting. Clients with bookings get the cancellation email; the dead join URL is removed from their booking record.

Delete the Zoom meeting directly from your Zoom dashboard → Zoom notifies Junocal via webhook, and Junocal clears the dead URL from the class so confirmation emails don't link to a 404.

Two paths, both equally final:

From Junocal: Settings → Integrations → Zoom → Disconnect. Junocal tells Zoom to revoke the OAuth grant, then deletes your stored tokens. Future virtual classes will fall back to manual "Custom link" or Google Meet auto-generation, depending on what you pick.

From Zoom: marketplace.zoom.us → Manage → Installed Apps → Junocal → Uninstall. Zoom sends Junocal a deauthorization notification, and Junocal deletes your stored tokens within seconds of receipt — this satisfies Zoom Marketplace's data-compliance requirement and our privacy policy commitment.

Existing Zoom meetings stay on your Zoom account after disconnecting; Junocal doesn't reach back to delete them. If you want them gone, delete them from Zoom directly.

From the OAuth flow: your Zoom email (for the "Connected as" label in Integrations), your Zoom account ID (so the deauthorization webhook can find the right row), and the refresh token (encrypted at rest with AES-256-GCM using a key Junocal holds, not derived from your Zoom account).

From each meeting we create: the Zoom meeting ID, the join URL, the meeting password, and a reference to which Junocal class it belongs to. These exist for the life of the class — when you cancel a class or delete the meeting, the corresponding row is removed.

When you disconnect or uninstall: all of the above is deleted immediately. We don't archive, soft-delete, or retain anything for analytics. The only trace that remains is the audit log entry that says "Zoom disconnected on <date>".

Refresh tokens are encrypted at the application layer (AES-256-GCM) before they hit the database, on top of the database's own at-rest encryption. Access tokens live only in memory and in short-lived rows that expire after an hour.

All communication with Zoom's API runs over TLS 1.2 or higher. Webhook events from Zoom are verified via HMAC-SHA256 against the Secret Token Zoom issued for our app — unsigned or tampered requests are rejected.

Internal Junocal staff cannot read your encrypted refresh tokens; the encryption key lives outside the database in our secrets store.

"Reconnect required" banner on the Integrations page → Zoom revoked our grant (often because you changed your Zoom password or your Zoom admin restricted third-party apps). Click Reconnect and re-authorize.

Class created but no Zoom link appeared → check the class detail page first; the link writes back a moment after class creation. If it's still missing after 30 seconds, your studio probably isn't connected to Zoom — go to Integrations → Zoom to confirm.

Zoom link points to a meeting that says "This meeting has been removed by the host" → the meeting was deleted directly in Zoom. Junocal usually clears the URL within seconds of Zoom's webhook arriving; if it didn't, edit the class manually and switch to "Custom link" or reschedule to regenerate.

Need to use a different Zoom account → disconnect first, then connect again as the other account. Junocal stores one Zoom account per studio.