CalSync — Privacy Policy

Last updated: 3 September 2026

What CalSync does

CalSync mirrors busy time between calendars that belong to different organisations, for example a work Microsoft 365 calendar, a university calendar and a personal Google or iCloud calendar. It reads the start and end times of your events and writes placeholder events (titled "Busy" by default) into your other calendars for the same time slots. Event titles, attendees, locations and notes are never copied from one calendar to another.

Data the developer collects

None. There is no CalSync account, no analytics, no crash reporting service, no advertising and no developer-operated backend. Nothing about you or your calendars is transmitted to the developer.

Data stored on your Mac

• Settings — the accounts you added (a name you choose, the provider, and for Microsoft 365 the tenant and app registration used to sign in), the placeholder title and the sync interval. Stored in the app's sandbox container.
• Sign-in tokens — the OAuth refresh tokens for Microsoft 365 and Google accounts are stored in the macOS Keychain, scoped to CalSync, and are sent only to the provider that issued them.
• Diagnostic log — a local file recording each sync run (account names, counts of events created or deleted, and error messages). It stays in the sandbox container and leaves your Mac only if you choose Copy log and paste it somewhere yourself.

Removing an account from CalSync makes a best-effort attempt to delete the placeholder events it created in that calendar, then removes the account's sign-in token from the Keychain. Deleting the app does not remove its container folder or Keychain items on its own: remove your accounts in CalSync first, or delete ~/Library/Containers/ee.vene.siim.calsync and the ee.vene.calsync items in Keychain Access afterwards.

Services CalSync connects to

• Microsoft 365 — login.microsoftonline.com for sign-in and graph.microsoft.com for calendar access, under the delegated Calendars.ReadWrite permission you grant. When you add an account, the email address you type is sent once to Microsoft's home-realm discovery endpoint to determine whether it is a work/school or personal account; the address itself is not stored.
• Google Calendar — accounts.google.com for sign-in and googleapis.com for calendar access, under the calendar.events scope. CalSync's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Apple Calendar — read and written locally through macOS (EventKit) after you grant Calendar access. No additional network connection is made by CalSync for these calendars.

Your use of those services is governed by their own privacy policies. CalSync does not connect to any other host.

What other calendars can see

Only that you are busy: a placeholder event with the time slot and the placeholder title, plus a small CalSync identifier so the app can recognise its own events later (stored in a hidden event property for Microsoft 365 and Google, and in the event's notes field for Apple calendars). Nothing from your other calendars' events crosses between accounts.

Permissions

• Calendars (macOS) — required to read and write Apple Calendar events.
• Network — required to reach Microsoft and Google. CalSync also opens a temporary listener on 127.0.0.1 during Google sign-in to receive the browser redirect; it is closed as soon as sign-in completes.

Children

CalSync is a productivity tool and is not directed at children under 13.

Changes

If this policy changes, the "Last updated" date above will change.

Contact

Privacy questions: siim.vene@gmail.com.