Privacy Policy

Last updated: March 2026

CalendarTunnel is operated by Zoldytech. This policy explains how CalendarTunnel handles your data. For Zoldytech's general privacy policy, visit zoldytech.com/privacy-policy.

Privacy-First Architecture

CalendarTunnel is designed to minimize data storage. We do not store event titles, descriptions, attendees, locations, or timestamps in our database. Change detection uses SHA-256 content hashes — the engine compares hashes to detect changes without persisting event content. Event data is held exclusively in memory during sync cycles.

Controller Information

Zoldytech is the data controller for CalendarTunnel. You can contact us at [email protected] for privacy requests.

What We Store

  • Your Clerk authentication profile (email, name) for account management
  • Calendar provider account identifiers (email address, calendar ID)
  • OAuth tokens encrypted with AES-256-GCM at rest (used to access your calendars on your behalf)
  • SHA-256 content hashes of events (not the event content itself)
  • Mirror mappings: which source event maps to which destination event ID
  • Sync state: timestamps, statistics, and configuration preferences

What We Never Store

  • Event titles, descriptions, or notes
  • Attendee lists or email addresses from events
  • Event timestamps as readable content (only as part of the opaque hash)
  • File attachments or meeting links

Legal Bases (GDPR Art. 6)

  • Contract performance — to provide and operate calendar sync functionality you request
  • Legitimate interests — to secure, monitor, maintain, and improve reliability of the service
  • Consent — where required, for connecting third-party calendar providers and optional communications
  • Legal obligations — where processing is needed to comply with applicable laws

How We Access Your Calendars

CalendarTunnel uses OAuth 2.0 to connect to Google, Microsoft, and Zoho calendars. For iCloud, we use Apple's app-specific passwords over encrypted CalDAV (HTTPS). We request only the permissions needed to read events and create/update/delete mirror busy blocks. You can revoke access at any time by disconnecting a calendar in Settings, revoking the OAuth app in your provider's security settings, or revoking the app-specific password at account.apple.com.

Google Calendar Data & Limited Use Disclosure

CalendarTunnel's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect a Google Calendar account, we access the following Google user data via the Google Calendar API: event metadata (titles, times, descriptions, attendees, locations, recurrence rules, response status, color, and event type) and your Google account email address. This data is used exclusively to provide CalendarTunnel's calendar sync functionality — detecting your availability and creating mirror busy-block events on your other connected calendars.

Google Calendar data is held only in memory during sync cycles and is never persisted to our database. Only SHA-256 content hashes and mirror event ID mappings are stored.

We do not use Google user data for advertising, retargeting, or interest-based profiling. We do not sell, rent, or provide Google user data to data brokers or information resellers. We do not use Google user data to train AI or machine-learning models. We do not use Google user data for creditworthiness, lending, or any purpose unrelated to providing or improving CalendarTunnel.

Google user data is not shared with any third party except the subprocessors listed in this policy, and only as necessary to operate the service. No human reads your Google Calendar data unless you explicitly request debugging assistance.

Token Security

OAuth refresh tokens are encrypted with AES-256-GCM before storage. The encryption key is stored separately from the database. Tokens are never logged or exposed in API responses.

Data Retention & Deletion

  • Account-linked records are kept only while your account remains active and calendars are connected
  • OAuth state records are short-lived (5-minute expiry) and automatically cleaned up
  • Soft-deleted mirror records are retained for operational cleanup windows, then purged
  • When you disconnect a calendar, associated account records are removed and tokens are revoked where supported
  • When your account is deleted via Clerk, we delete data associated with your user across connected calendars

Your Rights (GDPR)

Depending on your location, you may have rights to access, correct, delete, restrict, object to processing, and request portability of personal data we hold. To exercise these rights, email [email protected]. You also have the right to lodge a complaint with your local data protection authority.

Subprocessors & Third Parties

  • Hetzner (Germany/EU) — infrastructure hosting
  • Clerk — authentication and user management (Clerk Privacy Policy)
  • Google Calendar API — calendar data access
  • Microsoft Graph API — calendar data access
  • Zoho Calendar API — calendar data access
  • Apple iCloud CalDAV — calendar data access via CalDAV protocol

International Transfers

Some subprocessors may process data outside your country, including outside the EEA/UK. Where required, we rely on transfer safeguards such as Standard Contractual Clauses and equivalent legal mechanisms provided by our subprocessors.

Cookies

CalendarTunnel uses essential cookies and similar technologies required for authentication, session security, and core product functionality. We do not use ad tracking cookies on the product experience.

Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via email or in-app notification. The "Last updated" date at the top reflects the most recent revision. Continued use of CalendarTunnel after changes constitutes acceptance of the updated policy.

Contact

For privacy questions, contact us at [email protected] or visit calendartunnel.com.

This is the authoritative English version.