Privacy Policy

Effective 2026-09-12

gcal-sync is open-source software. This page describes this specific instance at https://gcal.nbse.space, operated by nbse and available to Google accounts on the nbseconsulting.com domain. Unlike a self-hosted deployment of this same software — where the operator is you, and no data reaches anyone else — using this instance means nbse stores the account and token data described below on infrastructure it controls, in order to run the sync on your behalf.

Google data this software accesses

gcal-sync requests two narrow Google Calendar API scopes and nothing else:

• calendar.events — to read events on the calendars you configure, and to create, update, or delete the private “Busy” placeholder events it uses to mirror availability across them.
• calendar.calendarlist.readonly — to list the calendars visible to an authorized account, so you can pick which calendar ID to sync (used only by the calendars command).

gcal-sync never requests access to Gmail, Drive, Contacts, or any other Google product.

What gets copied between calendars

The Calendar API returns full event data (including title, description, attendees, location, and conferencing links) when gcal-sync reads your calendar. By default, only the start/end time, busy/free status, and recurrence pattern are copied into a placeholder mirror event on the other calendars. Events marked “Free” are ignored entirely.

You can explicitly opt a specific direction between two of your own calendars into “full copy” mode, which additionally mirrors the event's title, description, location, and meeting link. This is off by default for every calendar and must be turned on deliberately per direction from your dashboard (or, for a self-hosted instance, via configuration). Attendees are never copied, under either mode.

For any calendar direction where full copy is not enabled, titles, descriptions, attendees, locations, and conferencing links exist only in memory for the moment it takes to process each event during a sync pass, and are discarded immediately afterward — they are never written to disk, to the database, to logs, or anywhere else.

Where data is stored

On this instance, gcal-sync stores the Google account email address you sign in with (to identify your account), your OAuth tokens (encrypted at rest), and a record of which source events map to which mirror events, in a database on the server nbse operates. None of it is transmitted to analytics providers, advertisers, or any other third party — the only outbound requests this service makes are to Google's Calendar API, described below.

How this data is protected

All requests to Google's Calendar API are made over HTTPS/TLS; gcal-sync never transmits OAuth tokens or calendar data over an unencrypted connection.

On this instance, OAuth tokens are encrypted at rest in the database using symmetric authenticated encryption (Fernet, AES-128-CBC with an HMAC integrity check) before being written to storage, and are decrypted only in memory, only when needed to make a Calendar API call on your behalf. The encryption key is held separately from the database and is not accessible to anyone without direct access to nbse's server environment. Access to the underlying database and server is restricted to nbse; no other party, and no other connected account, can read your tokens or synced event data.

Data sharing

gcal-sync makes outbound HTTPS requests only to Google's Calendar API. It does not include analytics, tracking, advertising, or any other third-party integration.

To uphold this policy, the open-source Archivo interface font files are downloaded at development time, bundled with gcal-sync, and served locally by this instance. Your browser does not contact Google Fonts or another external font provider when displaying this site.

Data retention and deletion

On this instance, disconnecting a calendar from your dashboard immediately deletes its stored OAuth tokens from the database. To have your account record and all connected calendars removed entirely, contact us as described below. You can also revoke gcal-sync's access to your Google account at any time from Google Account → Security → Third-party access.

Contact

For any question about this instance or your account, email support@nbseconsulting.com. Please use GitHub Issues on the source repository only for questions or problems related to the gcal-sync code itself.

← Back