Privacy Policy
This Privacy Policy describes how Google → Zoho Calendar Sync processes Google Calendar data.
1. Purpose
The application provides a one-way synchronization from a user-authorized Google Calendar to a user-authorized Zoho Calendar. Google Calendar remains the source of truth.
2. Google user data accessed
The application requests the Google Calendar read-only OAuth scope. Depending on the selected calendar and events, data processed may include:
- calendar identifiers, names, timezone and synchronization tokens;
- event identifiers, titles, descriptions, start/end times, timezone, location and recurrence information;
- conference or Google Meet links when present;
- attendee information contained in events when present;
- event status and metadata required to detect additions, updates and deletions.
The application does not request permission to create, edit, or delete Google Calendar events.
3. How Google data is used
Google Calendar data is used only to:
- create and update the corresponding mirror event in Zoho Calendar;
- maintain synchronization state and prevent duplicate mirror events;
- detect changes and deletions in the source calendar;
- provide operational status, diagnostics, and limited synchronization logs.
Google user data is not used for advertising, profiling, sale, or unrelated analytics.
4. Storage and security
The service runs on Cloudflare Workers and uses Cloudflare D1 for synchronization state. OAuth tokens are encrypted by the application before being stored in D1. The service may store calendar/event identifiers, Google-to-Zoho mapping records, synchronization tokens, configuration, and limited activity logs. Activity logs may include an event title and operation result for troubleshooting.
Administrative API access is protected by a separate server-side bearer secret. OAuth client secrets, refresh tokens, and encryption keys are not intentionally exposed to browser-side code.
5. Data sharing and transfer
Calendar data is transferred to Zoho Calendar only as necessary to perform the synchronization requested by the authorized user. Cloudflare processes data as infrastructure provider for the Worker and D1 services. The operator does not sell Google user data and does not disclose it to third parties for advertising purposes.
6. Retention
Synchronization mappings and state are retained while the integration is active or as needed to maintain reliable synchronization. Operational activity logs are automatically pruned and are generally retained for up to 30 days. OAuth credentials are retained until authorization is revoked, the integration is decommissioned, or the stored credentials are deleted.
7. Revoking access and deletion
A user can revoke the application's Google access at any time from the security / third-party access settings of their Google Account. Revocation prevents future access to Google Calendar. The operator can also remove the integration's stored synchronization state and OAuth credentials when the integration is decommissioned.
8. Human access
Calendar content is not routinely reviewed by people. Limited access may occur only when necessary for security, troubleshooting, compliance, or operation of the service.
9. Changes to this policy
This policy may be updated when the integration, data processing, or applicable requirements change. The current version is published at https://calendar-sync.wxwellmax.trade/privacy.
10. Operator
WUXI WELLMAX TRADING CO., LTD.
Company website: wxwellmax.trade