Privacy Policy
Last updated: 28 March 2026
1. Who we are
CalendarSync ("we", "us", "our") is a calendar synchronisation service operated by BizGrants Consulting Pte Ltd. We can be reached at ryan@calendarsync.app.
2. What data we collect
Account information
Your name and email address, collected when you sign in via Google, Microsoft, or Apple OAuth.
Calendar access tokens
OAuth access and refresh tokens for the calendar providers you connect. These are encrypted at rest using AES-256 and are only used to read and write calendar events on your behalf.
Calendar event metadata
Event start and end times, titles (only when you explicitly enable "Show real event title" in Pro settings), and status. In default Blocker mode, we only process event timing and write a generic "Busy" placeholder to your other calendar. We do not store event contents on our servers.
Sync logs
A record of when syncs ran, how many events were created, updated, or deleted, and any errors. Logs are retained for 7 days (Trial) or 30 days (Pro) and then automatically deleted.
Payment information
Billing is handled by Stripe. We never see or store your full card number. We store only your Stripe Customer ID and Subscription ID to manage your plan.
Usage data
Basic usage metrics such as pages visited, used to improve the service. We do not use third-party advertising trackers.
3. How we use your data
- To provide the calendar synchronisation service you signed up for
- To send transactional emails (sync alerts, account notices, payment receipts)
- To manage your subscription and billing via Stripe
- To respond to support requests you send us
- To improve reliability and fix bugs using anonymised usage data
We do not sell your data, share it with advertisers, or use it to train AI models.
4. Google API data
CalendarSync's use of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically: we access Google Calendar data solely to perform the synchronisation actions you configure. We do not use Google user data for advertising, profiling, or any purpose beyond the core sync feature. We do not allow humans to read your Google Calendar data unless you explicitly grant access for support purposes.
5. Data storage and security
- Data is stored on Supabase (PostgreSQL) hosted on AWS ap-southeast-1 (Singapore)
- OAuth tokens are encrypted at rest using AES-256 before storage
- All data in transit is protected with TLS 1.2 or higher
- Access to production data is restricted to the service owner
6. Data retention
- Sync logs: 7 days (Trial), 30 days (Pro), then automatically deleted
- Calendar tokens: deleted immediately when you disconnect a calendar
- Account data: retained while your account is active
- On account deletion: all personal data is permanently deleted within 30 days
7. Third-party services
We use the following sub-processors:
- Supabase - database and authentication hosting
- Vercel - application hosting
- Stripe - payment processing
- Resend - transactional email delivery
- Google, Microsoft, Apple - calendar OAuth providers
8. Your rights
You have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your account and all associated data
- Disconnect any calendar at any time from your dashboard
- Revoke CalendarSync's access to your Google or Microsoft account via those platforms' security settings
To exercise any of these rights, email ryan@calendarsync.app.
9. Cookies
We use only essential session cookies required for authentication. We do not use advertising or tracking cookies.
10. Children
CalendarSync is not directed at children under 13. We do not knowingly collect data from anyone under 13.
11. Changes to this policy
We may update this policy from time to time. Material changes will be communicated by email to registered users at least 7 days before taking effect.
12. Contact
Questions about this policy? Email ryan@calendarsync.app and we will respond within 2 business days.