Privacy Policy

Resync is operated by Version1 Advisor LLC, 1001 E 12th St, Austin, TX 78702. It is a Google-only calendar sync app. It keeps selected calendars aligned by copying busy time from source calendars onto mirror calendars as privacy-preserving hold events. This policy describes what we access, what we store, and how we use it.

Google user data we access

• Sign-in identity: your Google email, name, and account identifier so we can create your Resync user and label connected accounts.
• Calendar list: calendar IDs, names, colors, and access roles so you can choose sources and mirrors.
• Source events: start time, end time, busy/free transparency, and enough metadata to skip declined or Resync-created events. We use this to decide when you are busy, not to copy the meeting.
• Mirror calendars: we create, update, and delete hold events titled Busy. Those holds do not include source titles, descriptions, attendees, locations, or conference links.

Google OAuth scopes

Resync requests only these scopes. They match what the app actually calls.

• openid, email, and profile: sign you in with Google and show each connected account's email and name.
• https://www.googleapis.com/auth/calendar.calendarlist.readonly: list the calendars you can access (calendar list read-only) so you can pick sources and mirrors. We do not use this to read event contents.
• https://www.googleapis.com/auth/calendar.events: view and edit events. We read busy time on Source calendars and create, update, and delete events titled Busy on Mirror calendars.

Transient processing of source events

Google's API returns full event details (including titles, descriptions, attendees and locations) for events on your Source calendars. Resync processes these in memory only to determine start/end time, busy/free status and whether you declined. We do not store, log or copy titles, descriptions, attendees, locations or conference links.

What we store

• Your Resync user record, email, and Stripe billing identifiers.
• Encrypted Google OAuth refresh tokens so sync can continue after you close the browser.
• Selected calendar IDs, source/mirror roles, and Google watch-channel IDs.
• Opaque shadow-event identifiers that link a source event ID to a mirror event ID. We do not store source titles, attendees, locations, or descriptions.
• Tombstones when you delete a hold, so we do not recreate that source/mirror pair.

How we use the data

We use Google user data only to provide and improve the user-facing calendar sync features you enable: listing calendars, watching source calendars, and writing Busy holds onto mirror calendars. We do not use Google user data for advertising, credit scoring, or unrelated product training.

We do not use Google user data to develop, improve or train generalized or non-personalized AI and/or ML models, and we do not transfer it to third-party AI tools.

Limited Use

Resync's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Resync's use of information received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide or improve user-facing features that are prominent in this app.
• We do not transfer Google user data to third parties except as necessary to provide the sync features, to comply with applicable law, or as part of a merger, acquisition or sale of assets, after obtaining your explicit prior consent.
• We do not use Google user data for serving advertisements.
• We do not allow humans to read Google user data unless you give us affirmative consent for a specific support case, it is necessary for security purposes, or we are required to do so by law.

How we protect your data

We collect only the Google data the sync features need (described above) and protect it as follows.

• Encryption in transit: all traffic between your browser and Resync uses HTTPS (TLS). Resync connects to Google APIs, Supabase, and Stripe only over TLS, and the connection between our application servers and our database requires TLS.
• Encryption at rest:Google OAuth access and refresh tokens are encrypted by Resync before they are stored, using AES-256-GCM with a unique random nonce for every value. The encryption key is kept in our hosting provider's secret store, separate from the database. Our database provider, Supabase, also encrypts stored data, including its backups, at rest, according to Supabase's documentation.
• Data minimization: we never store event titles, descriptions, attendees, locations, or conference links. Event details returned by Google are processed in memory only and are not written to our logs. We store only calendar and event identifiers plus the names of the calendars you select.
• Access controls: every request is tied to your signed-in session, and you can access only your own connected accounts and calendars. Google sign-in requests use signed, short-lived state values. Background jobs and webhooks require secret credentials or verified signatures. Access to production systems is limited to the operator.
• Infrastructure:the app runs on Fly.io and stores data in Supabase (Postgres), both in the United States. No Google user data is stored on our application servers' disks.
• No sale, ads, or AI training: we do not sell Google user data, use it for advertising, or use it to develop or train AI/ML models.

Processors

We host the app on Fly.io, store application data in Supabase (Postgres), and process payments with Stripe. Supabase also handles Google sign-in at auth.labs.version1.io and receives the Google identity (email, name, avatar) and OAuth tokens for that purpose. These processors receive only what they need to run the service. We do not sell personal data.

How to delete your data

• Delete your Resync account: Dashboard → Account → Delete account. This removes stored tokens, calendar selections, watches, shadow records, and billing identifiers we control, and deletes Busy holds Resync created on your mirror calendars.
• Disconnect a Google account:Dashboard → Accounts → Remove, then confirm Disconnect. That account's tokens and the Busy holds it created or received are deleted.
• You can also revoke Resync at myaccount.google.com/connections. Revoking access in Google stops new sync. Busy holds already written to mirror calendars stay until you disconnect the account or delete your Resync account.

Deletion is immediate in our database. Backups are managed by our database provider, Supabase, and are encrypted at rest; deleted data ages out of them on Supabase's backup schedule.

Retention

We keep connected-account and shadow-event records while your account is active. After you delete your account or disconnect a Google account as described above, those records are removed.

Contact

For privacy questions or deletion requests, email the support address shown on this page.