Privacy Policy

Sync ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web application at sync2meet.org (the "Service"). By accessing or using the Service, you agree to the terms of this Privacy Policy.

1. Information We Collect

1.1 Account Information

When you create an account, we collect your email address, display name, and timezone. If you sign in with Google, we receive your name and email from your Google profile.

1.2 Calendar Data

When you connect a third-party calendar (Google Calendar or Microsoft Outlook), we access and store your calendar event data, including event titles, dates, times, locations, descriptions, and attendee information. We also store OAuth access tokens and refresh tokens necessary to maintain the calendar connection.

1.3 Find-a-Time Pages

You can create a find-a-time link without an account. We store the event name, the dates or weekdays, the time window, the timezone, and the meeting length if you set one. Anyone with the link can open that page.

When you add your name on a page, we store that name, the times you mark as free, up to three votes, and whether you marked yourself optional. A password is optional. If you set one, we store only a hash of it so you can edit your marks later. We do not store the password itself.

Signed-in scheduling sessions, separate from these public links, store availability, votes, and participation for the people on that session.

1.4 Google Calendar Free/Busy

If you choose "Fill from Google Calendar" on a find-a-time page, Google grants us the calendar free/busy scope only. We use that access once, for the dates on that page, to learn when your primary calendar is busy, and we mark the remaining slots as free. We do not receive or store event titles, locations, descriptions, or guest lists, and we do not keep the Google access token after that request.

1.5 Cookies and Local Storage

We use a few cookies to run the Service:

• meet_person: an HttpOnly cookie that records which names on which find-a-time pages this browser may edit. It lasts 45 days. It does not contain your password. Choosing "Not you?" removes that page from the cookie. If the name has no password, the name and its marks are removed. If it has a password, they stay so you can open them again.
• oauth_nonce: an HttpOnly cookie set for about 10 minutes while you connect Google or Outlook, so the return from that site matches the browser that started the connection. It is cleared when the connection finishes.

Your light or dark theme is stored in local storage on your browser. If you have an account, a trimmed profile (display name, email, timezone, and which calendars are connected) may be cached in local storage so the calendar can load before the server responds. Calendar tokens are not included in that cache.

1.6 Contact Submissions

If you contact us through our contact form, we collect your name, email address, and message content.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Synchronize your calendar events between Sync and your connected third-party calendars
• Show a find-a-time page to anyone with its link, and turn Google free/busy intervals into free marks on that page
• Compute availability across participants for collaborative scheduling
• Authenticate your identity and secure your account
• Respond to your inquiries and support requests
• Detect, prevent, and address technical issues

We do not use your information for advertising, profiling, or any purpose unrelated to providing the Service.

3. Google API Services Disclosure

Sync's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the Service, in two ways:

• If you connect Google Calendar to an account, we read and write calendar events so Sync stays in sync with that calendar. We store the event data and the tokens needed to keep the connection.
• If you fill a find-a-time page from Google Calendar, we read busy intervals for that page only, as described in section 1.4, and we do not store event details or the access token.

We do not use Google user data for serving advertisements, and we do not sell it to third parties.

4. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties. We may share limited information in the following circumstances:

• Find-a-time links: Anyone with the link can see the event and each person's name, the times they marked free, and their votes. They cannot see Google Calendar event titles or other event details, and a password is never shown.
• Scheduling participants: When you join a signed-in scheduling session, other participants can view your busy/free status during the proposed time range. They cannot see your event titles, descriptions, or other details.
• Service providers: We use Google Cloud (Firebase) to host and store data. These providers are bound by their own privacy policies and data processing agreements.
• Legal requirements: We may disclose your information if required to do so by law or in response to valid legal process.

5. Data Storage and Security

Your data is stored in Google Cloud Firestore. We implement appropriate technical and organizational measures to protect your personal information, including:

• All data is encrypted in transit (TLS/SSL) and at rest
• Account API routes require a verified Firebase Authentication token
• A find-a-time page is available to anyone with its link. Editing the marks for a name requires the signed cookie set when that name was added
• Passwords on a find-a-time page are stored as a hash. The one-time Google token used to read free/busy is not stored
• OAuth tokens for a connected calendar are stored server-side and are never exposed to other users
• Firestore security rules keep account data limited to that account. Find-a-time data is read and written through our servers

While we strive to use commercially acceptable means to protect your information, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Calendar event data is retained to maintain synchronization with your connected calendars. If you disconnect a calendar, the associated OAuth tokens are removed. If you request account deletion, we will delete all associated personal data within 30 days. A find-a-time link expires 45 days after it is created. After that, the page and the names, times, and votes on it are deleted. Choosing "Not you?" on a name with no password removes that name and its marks. To remove a password-protected name or a whole link before 45 days, contact us using the form on the Service.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate personal data
• Deletion: Request deletion of your personal data and account
• Revocation: Disconnect third-party calendar integrations at any time from the application settings. On a find-a-time page, "Not you?" removes that page from this browser. A name with no password is removed with its marks. A name with a password stays on the page

To exercise any of these rights, please contact us using the contact form available on the Service.

8. Third-Party Services

The Service integrates with third-party services including Google Calendar and Microsoft Outlook. Your use of these integrations is subject to the respective privacy policies of Google and Microsoft. We encourage you to review their policies.

9. Children's Privacy

The Service is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information, we will take steps to delete it promptly.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the "Effective Date" at the top of this page. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us through the contact form available on the Service.