Privacy Policy

Last updated: August 20, 2026

SyncBusy ("we", "us", "the service") syncs events between your personal calendar (Google Calendar or iCloud) and your work Google Calendar. This policy explains what data we access, how we use it, and how you can control it.

What we access

When you connect your accounts, we request the following access:

• Email address. We request your Google account email address to identify your account and prevent duplicate sign-ups. We use Google's OpenID Connect protocol for this.
• Personal calendar (Google) — read-only. We read event times, titles, and status (accepted/declined/free) to determine when you're busy. We never modify your personal Google Calendar.
• Personal calendar (iCloud) — read-only by default; write only with reverse sync (Pro). When you choose iCloud as your personal calendar, we connect to Apple iCloud Calendar via the CalDAV standard using an app-specific password you generate at appleid.apple.com. We read your event start times, end times, titles, and free/busy status. If you enable reverse sync (Pro), we additionally create, update, and delete events on a single iCloud calendar of your choice that you designate as the reverse-sync target — and only on that calendar. The app-specific password can be revoked at any time at appleid.apple.com → Sign-In and Security → App-Specific Passwords.
• Work calendar — read and write. We create, update, and delete "busy block" events on your work Google Calendar that mirror your personal schedule. We never read or modify your other work events.

What we store

• OAuth tokens (Google accounts) — encrypted at rest with AES-256-GCM. These allow us to access your calendars on your behalf. We never see or store your Google password.
• iCloud credentials — for iCloud connections, we store your Apple ID email address and the 16-character app-specific password in encrypted form (AES-256-GCM). We never store your main Apple ID password.
• Event mappings — a table linking personal event IDs to the corresponding work calendar busy block IDs, so we can update or delete them when your schedule changes.
• Calendar URLs — for iCloud users, the public CalDAV URLs of the calendars you've selected for sync (forward and, if reverse sync is enabled, the single reverse target). These contain no credentials.
• Sync configuration — your preferences (naming style, sync range, pause settings).
• Email address — from your Google account (and/or Apple ID for iCloud users), used to identify your account in the dashboard.
• Setup-link token — if you use the "continue in another browser profile" option during setup, we briefly store a one-way hash of that single-use link's secret so it can be validated and revoked. It stops working within 30 minutes, and the stored hash is cleared when the link is used or replaced by a newer one.

What we do NOT store

• Event descriptions, attendees, locations, or attachments
• Your Google password
• Any data from calendars other than the ones you connect
• Your calendar content, OAuth tokens, or passwords in any analytics event (see "Analytics" below)
• Advertising identifiers, or any data for ad targeting

How data is protected

• OAuth tokens are encrypted with AES-256-GCM before being stored in Google Cloud Firestore.
• All traffic is encrypted in transit via HTTPS/TLS.
• Session cookies are signed with HMAC and marked HttpOnly, Secure, and SameSite.
• The service runs on Google Cloud Run with no persistent local storage.

Analytics

We use Google Analytics 4 to understand how many people visit SyncBusy, which pages they land on, and which product actions (like starting setup or running a sync) get used. This applies only to the hosted syncbusy.dev service — a self-hosted instance never loads Google Analytics or sends any data to Google, regardless of configuration.

• Nothing loads until you accept the cookie banner shown on your first visit. Declining, or not answering, means no analytics script runs and no data is sent.
• What's collected: page views, the page you arrived from (referrer/traffic source), and named product-usage events (e.g. "sync started," "settings saved").
• What's never collected: your calendar events, titles, attendees, locations, OAuth tokens, or passwords. Nothing about the contents of your calendars ever reaches Google Analytics.
• You can revoke consent at any time by clearing your browser's site data for syncbusy.dev.

Third-party services

SyncBusy uses these services to operate:

• Google Calendar API — to read personal events and write busy blocks to work calendars
• Apple iCloud Calendar (CalDAV) — to read personal events from iCloud, when you choose iCloud as your personal calendar provider
• Google Cloud Firestore — to store user data
• Google Cloud Run — to host the service
• Google Analytics 4 — to measure site traffic and product usage on the hosted service, only after you accept the cookie banner. See Google's Privacy Policy.

We do not share your data with any other third parties, and we do not sell data or use it for advertising.

Data retention and deletion

Your data is stored as long as your account is active. You can delete your account and all associated data at any time by signing out. When you disconnect:

• All busy blocks created on your work calendar are deleted.
• Your OAuth tokens, event mappings, and configuration are permanently removed from our database.
• Any active Pro subscription is cancelled with Stripe.

Google API Services User Data Policy

SyncBusy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Changes to this policy

If we make material changes, we'll update the date at the top of this page. For significant changes, we may notify users via the dashboard.

Contact

Questions about this policy? Contact us at support@syncbusy.dev.