Legal

Privacy Notice

Last updated: July 11, 2026

1. Who we are

Sync is operated by Hedge Financial Group, LLC ("Sync", "we", "us"), a United States limited liability company. We act as the data controller for personal data collected through the Sync application at sync-me.app. You can reach us at privacy@sync-me.app.

2. Personal data we collect

  • Account data — email address, display name, avatar, authentication identifiers.
  • Calendar data — busy/free time ranges ({start, end} pairs only) from Google Calendar's freeBusy endpoint on your primary calendar. Sync never reads event titles, descriptions, attendees, locations, or attachments. See §5 for the full Google user data disclosure.
  • Relationship data — the people you connect with in Sync, the intents and cadences you set, and the groups you create or join.
  • Usage & device data — IP address, browser/device type, timestamps, and application logs collected for security, debugging, and product improvement.
  • Support communications — messages you send to our support inbox.
  • Billing metadata — subscription status, plan, renewal date, and a customer identifier provided by our payment processor. Card numbers and billing addresses are collected and stored by Paddle (see §4), not by Sync.

3. How we use your data & legal basis

  • To provide Sync — account creation, availability matching, group planning, calendar sync. Legal basis: performance of a contract.
  • To operate paid subscriptions — activate Premium, honor cancellations and refunds. Legal basis: performance of a contract.
  • Security and fraud prevention — abuse detection, rate limiting, incident response. Legal basis: legitimate interests.
  • Product improvement — aggregate analytics on which features are used. Legal basis: legitimate interests.
  • Customer support — replying to your messages. Legal basis: legitimate interests.
  • Legal compliance — responding to lawful requests, tax and accounting obligations. Legal basis: legal obligation.

We do not use your data for advertising or profiling and we do not sell your data.

4. Payments & Paddle (Merchant of Record)

Our order process is conducted by our online reseller Paddle.com. Paddle is the Merchant of Record for all Sync purchases and is a separate independent controller of the payment data you provide at checkout (name, billing address, payment method, transaction history). Paddle handles all payments, invoicing, sales tax, refund requests, and chargeback disputes, and provides customer support for order-related inquiries. Their privacy notice is at paddle.com/legal/privacy. Sync receives from Paddle only a customer identifier, subscription status, and billing metadata needed to activate and maintain your plan.

5. Google user data & Limited Use

When you connect Google Calendar to Sync, Sync accesses a strictly limited slice of your Google account under the Google API Services User Data Policy, including the Limited Use requirements. This section describes exactly what Sync requests, what it reads, what it stores, and how you can revoke access.

Scopes requested

  • https://www.googleapis.com/auth/calendar.readonly — sensitive scope, used solely to call the freeBusy endpoint on your primary calendar.
  • openid — to identify which Google account you linked.
  • https://www.googleapis.com/auth/userinfo.email — to display the connected Google account email on the /calendar settings page so you can confirm the right account is connected.

What Sync reads

A single call to POST https://www.googleapis.com/calendar/v3/freeBusy against your primary calendar for a rolling 14-day window. Sync reads only the busy array — a list of { start, end } ISO timestamps.

What Sync does NOT read

  • Event titles or summaries
  • Event descriptions or notes
  • Attendees, organizers, or guest lists
  • Locations or conferencing links (Google Meet, Zoom, etc.)
  • Attachments
  • Any secondary, shared, or subscribed calendars
  • Calendar list or calendar metadata beyond primary

Why this scope is necessary

Google does not publish a free/busy-only scope. Every calendar.events.* scope grants access to full event bodies (titles, attendees, locations), which is strictly more data than Sync needs. calendar.readonly is the least-privileged scope that permits the freeBusy endpoint on your primary calendar.

Storage & retention

Sync stores rows of { user_id, calendar_id: "primary", starts_at, ends_at, synced_at } only. No event content is stored because none is fetched. The cache is a rolling 14-day window and is overwritten on each sync. Google refresh and access tokens are stored server-side only, never sent to the browser, and never logged.

Revocation & deletion

You can disconnect Google Calendar at any time from the /calendar page inside Sync. Disconnecting deletes your stored Google tokens, marks your calendar connection as disconnected, and deletes all cached busy/free ranges for your account. You can additionally revoke Sync's access at myaccount.google.com/permissions.

Limited Use disclosure

Sync's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, Sync requests the https://www.googleapis.com/auth/calendar.readonly scope solely to call Google Calendar's freeBusy endpoint on the user's primary calendar. Sync reads only busy/free time ranges — never event titles, descriptions, attendees, locations, or attachments — and stores only those { start, end } ranges to display anonymized availability overlaps in the user's Sync groups and connections.

Sync does not:

  • transfer Google user data to third parties except as necessary to provide or improve the availability-overlap feature, or as required by law;
  • use Google user data for serving advertisements, including personalized or retargeted advertisements;
  • allow humans to read Google user data, unless we have your affirmative agreement for specific messages, doing so is necessary for security purposes (such as investigating abuse), to comply with applicable law, or for Sync's internal operations, and then only when the data has been aggregated and anonymized;
  • use Google user data to develop, improve, or train generalized or non-personalized AI or machine learning models.

Users can revoke access at any time by disconnecting Google Calendar from within Sync or via myaccount.google.com/permissions, which deletes all cached calendar data held by Sync.

6. Data sharing

We share personal data only with the following categories of recipients:

  • Service providers (processors) — cloud hosting, database and authentication, email delivery, and error monitoring, each under written contract and only for the purpose of operating Sync.
  • Merchant of Record — Paddle, for subscription sale, tax compliance, invoicing, and refunds (see §4).
  • Other Sync users — only what you choose to share (e.g. a share link, a group invite, availability you publish to a connection).
  • Professional advisers — legal, accounting, or auditors, under confidentiality.
  • Authorities — where required by law, valid legal process, or to protect our rights or the safety of users.
  • Successors — in a merger, acquisition, or asset sale, subject to this notice.

Google user data (calendar busy/free ranges obtained via calendar.readonly) is never shared with Paddle, analytics providers, advertisers, or any other third party. It is used solely to compute availability overlaps within the Sync groups and connections you choose, and is handled under the Limited Use commitments in §5.

7. International transfers

Sync is operated from the United States and stores personal data with providers that may process it in the US and other countries. Where personal data of users in the UK or EEA is transferred outside those regions, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision.

8. Retention & deletion

We retain your data for as long as your account is active. You can delete your account and all associated data at any time from Settings. Upon deletion, your personal information is removed from our active systems within 30 days and from backups within 90 days, except where we are required to retain limited records (e.g. tax or billing records held by Paddle) to comply with legal obligations. Google Calendar busy/free data is additionally deleted immediately when you disconnect Google Calendar from the /calendar page (see §5).

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to withdraw consent. Users in the UK/EEA also have the right to lodge a complaint with a supervisory authority. To exercise these rights, email privacy@sync-me.app. We will respond within one month.

10. Security

We use industry-standard encryption in transit (TLS) and at rest. Access to data is restricted to authorized personnel and systems required to run the service, and we maintain administrative, technical, and organizational safeguards appropriate to the sensitivity of the data.

11. Cookies

Sync uses only strictly necessary cookies and local storage required to keep you signed in and remember preferences. We do not use advertising or third-party tracking cookies. Paddle may set cookies on its own checkout pages under its own privacy notice.

12. Changes to this notice

We may update this notice from time to time. Material changes will be announced in the app or by email. The "Last updated" date above always reflects the current version.

13. Contact

Hedge Financial Group, LLC — privacy@sync-me.app