Privacy Policy

Last updated: 2026-10-22

Calendar Sync (https://calendarsync.arbait.hr) is a service that copies events between Microsoft 365 / Outlook calendars and Google calendars that you connect. It is operated by the operator of calendarsync.arbait.hr ("we", "us"). This policy explains which data the service processes, why, and for how long.

1. Data we process

• Account data: your email address, a salted hash of your password (Argon2id — we never store your password in readable form), your account status, and, if you enable two-factor authentication, an encrypted authenticator secret and hashed recovery codes.
• Connected accounts: for each Microsoft or Google account you connect: the account identifier and email address returned by the provider, the permissions you granted, and OAuth access and refresh tokens. Tokens are stored encrypted (AES-256-GCM).
• Calendar metadata: identifiers, names, time zones and your access level for the calendars you add to the app.
• Event data: to synchronize, the service reads events from your source calendars (for example title, description, location, start and end time, recurrence and free/busy status) and writes copies to your destination calendars. Event content is processed in memory during synchronization. We store only what is needed to keep copies in sync: provider event identifiers, the start time, and a one-way hash of the synchronized fields. We do not store event titles, descriptions or locations in our database. Attendees, attachments and online-meeting details are not copied.
• Technical data: session records, security logs (for example sign-in attempts, rate-limit counters), and synchronization logs. Logs never contain passwords, tokens or event content.
• Email: we send transactional emails only (verification, sign-in codes, password reset, account and sync notifications). We do not send marketing email.

2. Why we process it

Only to provide the service you request: to authenticate you, to synchronize the calendars you configure, to keep the service secure, and to notify you about problems with your account or synchronization. We do not sell your data, use it for advertising, build profiles, or use it to train artificial intelligence or machine-learning models.

3. Google user data

Calendar Sync requests access to your Google calendar list (read only) and to your calendar events (read and write) so that it can read events from calendars you choose as a source and create, update or delete the copies it manages in calendars you choose as a destination. Calendar Sync's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not transferred to third parties except as necessary to provide the service (our hosting provider), for security purposes, or to comply with applicable law, and humans do not read it unless you ask us to for support, it is needed for security, or it is required by law.

4. Microsoft user data

With your consent, Calendar Sync uses the Microsoft Graph permissions to read your basic profile and to read and write events in your calendars (including calendars shared with you, if you allow it), for the same purposes as described above.

5. Who processes the data

The service runs on web hosting provided by Hostinger (database, application and email delivery). Calendar data is exchanged directly with Microsoft and Google, as you instruct. We do not use analytics or advertising services.

6. Retention

• Detailed sync logs, sent-email history and finished background jobs: deleted after 7 days.
• Sessions, sign-in codes, verification and password-reset links: deleted when they expire.
• Account data, connected accounts and sync mappings: kept while your account exists. Disconnecting an account deletes its stored tokens and calendars from the app; for Google we also ask Google to revoke the access.
• When your account is deleted, its data is removed from the live database. Copies may remain in encrypted hosting backups until those backups are rotated out.

7. Your choices and rights

You can disconnect accounts and remove calendars at any time. You can also revoke the app's access in your Google account (Security → Third-party access) or your Microsoft account (app permissions). Events that were copied to your calendars stay there unless you delete them. Depending on where you live (for example under the EU GDPR) you may have the right to access, correct, export or delete your personal data and to object to or restrict processing; you can also lodge a complaint with your data protection authority (in Croatia: AZOP).

8. Security

Connections use HTTPS. Passwords are hashed, OAuth tokens and authenticator secrets are encrypted, sessions use secure, HTTP-only cookies, and access to each user's data is restricted to that user. Administrators can see account metadata needed to operate the service but cannot see your calendar events through the app.

9. Changes

We may update this policy. The date at the top shows the latest version. Material changes will be announced by email.