Privacy Policy

1. Who we are

CalendarSync ("we", "us", "our") is a calendar synchronisation service operated by BizGrants Consulting Pte Ltd. We can be reached at ryan@calendarsync.app.

2. What data we collect

Account information

Your name and email address, collected when you sign in via Google or Microsoft OAuth, or your email address and a password (stored hashed by our authentication provider, Supabase) if you register with email.

Calendar access tokens

OAuth access and refresh tokens for the calendar providers you connect. These are encrypted at rest using AES-256 and are only used to list your calendars and to read and write their events on your behalf. Apple Calendar connects over CalDAV rather than OAuth, so for Apple we store the Apple Account email and the app-specific password you create for CalendarSync. The password is encrypted at rest using AES-256 and is only used to list the calendars in your Apple Account and to read and write events in the Apple calendar you connect.

Calendar event data

We read the events on the calendars you connect so we can sync them, show your free times on your booking links and list your meetings. In Blocker mode, the copy we write to your other calendar carries only the event's time and free/busy status, the title "Busy (CalendarSync)" and a note naming the calendar it came from. In Mirror mode (Pro), the copy also carries the event's title and description. Attendees and locations are never copied.

Meetings, contacts and notes

To fill your Meetings and Contacts pages, we store the title, date and time of the events on the calendars you connect, and the name and email address of each attendee. Each attendee is saved as a contact. If you connect Fireflies, we also store your Fireflies API key and the meeting summaries and action items we fetch with it.

Bookings

When someone books time through one of your booking links, we store what they enter: their name, email address, any guests, and their answers and notes. The booker is also saved as a contact.

Sync logs

A record of when syncs ran, how many events were created, updated, or deleted, any errors, and the title and time of up to 20 of the events each run changed. Sync logs are kept for 30 days and then automatically deleted.

Payment information

Billing is handled by Stripe. We never see or store your full card number. We store only your Stripe Customer ID and Subscription ID to manage your plan.

Usage data

Basic usage metrics such as pages visited, used to improve the service. We do not use third-party advertising trackers.

How you found us

When you sign up, we save how you reached CalendarSync: the web page that referred you, the page you landed on and any campaign tags in the link (utm_source, utm_medium and utm_campaign). If a partner's referral link brought you here, we also record which partner referred you, so the partner is credited. Each time someone opens a partner's referral link, we log the click with a one-way hash of their IP address, their browser's user agent and the referring page, to count clicks for the partner and detect fraud.

3. How we use your data

To provide the calendar synchronisation service you signed up for
To send transactional emails (sync alerts, account notices, payment receipts)
To manage your subscription and billing via Stripe
To respond to support requests you send us
To improve reliability and fix bugs using anonymised usage data

We do not sell your data, share it with advertisers, or use it to train AI models.

4. Google API data

CalendarSync's use of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically: we access Google Calendar data solely to provide CalendarSync's features (calendar sync, booking links, the Meetings and Contacts pages, the daily digest email, the API and the optional Fireflies integration). We do not use Google user data for advertising, profiling, or any purpose beyond providing those features. We do not allow humans to read your Google Calendar data unless you explicitly grant access for support purposes.

5. Data storage and security

Data is stored on Supabase (PostgreSQL) hosted on AWS ap-southeast-1 (Singapore)
OAuth tokens and Apple app-specific passwords are encrypted at rest using AES-256 before storage
All data in transit is protected with TLS 1.2 or higher
Access to production data is restricted to the service owner

6. Data retention

Sync logs: 30 days, then automatically deleted
Calendar tokens: deleted immediately when you disconnect a calendar
Account data: retained while your account is active
On account deletion: your account and the data in it are permanently deleted within 30 days. We keep a short record of the deletion, such as your email address, plan, sign-up date and any reason you give, along with any support messages you sent us and the billing records held by Stripe.

7. Third-party services

We use the following sub-processors:

Supabase - database and authentication hosting
Vercel - application hosting
Stripe - payment processing
Resend - transactional email delivery
Google, Microsoft - calendar OAuth providers
Apple - iCloud calendar access over CalDAV
Google Analytics - aggregate website usage analytics
Microsoft Clarity - anonymized session analytics (interaction heatmaps and session replays) to improve usability
Fireflies.ai - only if you connect the optional notetaker integration; meeting invitations are then shared with Fireflies so its bot can join and transcribe your meetings under Fireflies' own privacy policy

8. Your rights

You have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your account and all associated data
Disconnect any calendar at any time from your dashboard
Revoke CalendarSync's access to your Google or Microsoft account via those platforms' security settings
Revoke CalendarSync's access to your Apple Calendar by removing its app-specific password at account.apple.com under Sign-In & Security > App-Specific Passwords

To exercise any of these rights, email ryan@calendarsync.app.

9. Cookies

We use essential cookies to keep you signed in. Google Analytics and Microsoft Clarity also set cookies to measure how our website and app are used. We also set two cookies of our own to record how you found us. When you arrive from another website or through a link with campaign tags, cs_attrib stores the referring page, the page you landed on and those tags for 30 days, so we can save them to your account if you sign up. When you open a partner's referral link, cs_ref stores that partner's code for 90 days, so the partner is credited if you sign up. We do not use advertising cookies.

10. Children

CalendarSync is not directed at children under 13. We do not knowingly collect data from anyone under 13.

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email to registered users at least 7 days before taking effect.

12. Contact

Questions about this policy? Email ryan@calendarsync.app and we will respond within 2 business days.