Privacy Policy

Calendar Syncer is operated by Philip Reichen Software, a Swiss sole proprietorship (Einzelunternehmen) at Hohlstrasse 206, 8004 Zurich, Switzerland. Not VAT registered; Swiss VAT/MWST is not charged while the business is not registered for VAT.

Controller and status

Calendar Syncer is operated by Philip Reichen Software, a Swiss sole proprietorship (Einzelunternehmen) at Hohlstrasse 206, 8004 Zurich, Switzerland. This public-launch policy is written for product transparency and provider review, but it is not legal advice and does not claim that external legal review has occurred.

Not VAT registered; Swiss VAT/MWST is not charged while the business is not registered for VAT.

Data the product stores

Calendar Syncer stores operational data needed to run one-way sync from Microsoft Outlook Calendar into Google Calendar. It does not claim that no event data is stored. Calendar data is treated as sensitive operational data and includes:

• Encrypted OAuth tokens for connected Microsoft and Google accounts.
• Encrypted event cache data used to compare Outlook source events with Google shadow events for sync correctness.
• Sync state and event mappings that connect Outlook source events to Google shadow events.
• Webhook and subscription state, including Microsoft Graph subscription status, expiration, resource references, notification receipts, and encrypted client state.
• Billing and subscription state, including Stripe customer and subscription identifiers, trial status, subscription status, and billing lifecycle timestamps.
• Operational sync logs, audit records, run status, event counts, and error metadata used for retries, diagnostics, and abuse prevention.
• Support contact records and user requests sent to philthebrogrammer@gmail.com, if a user contacts support.

OAuth permissions and use

Microsoft permissions are planned around sign-in, offline access, user profile lookup, and read-oriented calendar access. Google permissions default to an app-created target calendar, with an advanced existing-calendar option requested separately when a user chooses an owned Google calendar. These permissions are used to authenticate accounts, read Outlook source calendar changes, and create, update, or delete Google Calendar shadow events.

Processors and subprocessors

The service uses Vercel for application hosting, Neon for database hosting, Microsoft and Google for the calendar accounts a user connects, Stripe for billing, and Resend for transactional email. These processors receive only the data needed to provide their part of the service. Vercel runs the application and handles HTTPS requests; Neon stores operational data, including OAuth-token and event-cache fields that the application encrypts before storage; Microsoft supplies Outlook source events; and Google receives the shadow events that the user directs the app to create in Google Calendar.

The public marketing pages use Vercel Web Analytics, a cookieless page-analytics processor that receives aggregate page views with technical metadata such as referrer, browser, device type, and coarse location. It does not use cookies or persistent identifiers, and the signed-in application under /app is excluded from analytics events.

Google user data sharing and disclosure

We do not sell, rent, or disclose Google user data for advertising, data brokerage, credit decisions, or any purpose unrelated to the calendar-sync features the user requests. Google account identity, owned-calendar metadata, OAuth credentials, and Google Calendar target details are processed by Vercel for application hosting and by Neon for database storage solely to operate and secure the service. Sensitive credential and event cache fields are encrypted before storage. Google processes API requests and stores the shadow calendar and events in the user's Google account.

Google user data is not sent to Microsoft, Stripe, Resend, or Vercel Web Analytics. It may otherwise be disclosed only when required by applicable law, when necessary to investigate abuse or a security incident, or as part of a merger, acquisition, or sale of assets after obtaining any consent required by Google's policies and applicable law. We do not use Google user data to train generalized machine-learning or artificial-intelligence models.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data protection

The service uses HTTPS with TLS to protect data in transit between the user's browser, the application, and connected providers. OAuth access, refresh, and ID tokens, cached event payloads, and Microsoft webhook client state are protected by AES-256-GCM encryption at rest before database storage. Encryption keys and provider client secrets are kept separately in the server environment rather than in the database or browser.

Provider credentials are decrypted only in server-side code when needed for an authorized sync operation. Database queries and settings actions are scoped to the signed-in user, OAuth callbacks use short-lived state values bound to that user, and OAuth tokens and client secrets are not written to application logs. Administrative access to production hosting and data systems is restricted to the operator accounts needed to run the service. Suspected unauthorized access is investigated, contained, and reported to affected users when notification is required by applicable law.

Retention and deletion

Users can disconnect providers, delete sync cache and history, or delete app sync data from Settings. The launch retention target is to remove encrypted event cache data and mappings when they are no longer needed for connected sync, while retaining minimal operational logs for up to 30 days unless longer retention is required for billing integrity, security, abuse prevention, or legal obligations.

Transparency and user rights

Swiss FADP-oriented privacy information should make data processing understandable to the data subject. Users can contact philthebrogrammer@gmail.com to ask questions about connected account data, deletion controls, retention, or support records.

Contact

Questions can be sent to philthebrogrammer@gmail.com.