How One-Way Synchronization Works
Designed specifically for salons, studios, clinics, and service businesses running Wix Bookings.
Connect Staff Google Calendar
A merchant or staff member authorizes read-only Google
Calendar access
(https://www.googleapis.com/auth/calendar.readonly)
and maps that connection to a specific Wix Bookings staff
resource.
Detect Busy Time Windows
SyncCal evaluates event timing, status
(confirmed, tentative,
cancelled), transparency
(opaque vs. transparent), and
whether the connected user declined the event.
Write Generic “Busy” Slots
SyncCal creates, updates, or cancels corresponding
DEFAULT blocked-time events titled
"Busy" on the assigned Wix Bookings staff
schedule after checking for existing customer appointments.
Strictly One-Way & Privacy-Preserving: SyncCal never requests write access to Google Calendar, never modifies or deletes Google Calendar events, and does not write Google Calendar event titles, descriptions, meeting links, or attendee lists to Wix Bookings or Firestore mapping records.
Key Architecture & Safety Features
Built with explicit safeguards for live merchant schedules and staff privacy.
Confirmed Booking Protection
Before creating or moving a blocked-time slot on Wix, SyncCal
queries Wix Calendar V3 and Wix Bookings V2 in that time window.
If a confirmed customer booking (APPOINTMENT,
CLASS, or COURSE) overlaps, SyncCal
skips the block and never modifies or cancels customer
appointments.
6-Invariant Ownership Ledger
SyncCal tracks every DEFAULT blocked-time event it
creates in its Firestore ownership ledger and verifies six
invariants (id, scheduleId,
externalScheduleId, type === "DEFAULT",
createdDate, and revision) before any
update or cancellation.
Quarantine Diagnostics
If an upstream API returns an ambiguous response or a Wix
event’s ownership invariants no longer match the ledger,
SyncCal places that mapping into a QUARANTINED
state rather than risking unintended edits to a merchant’s
schedule.
Encrypted OAuth Credentials
Google OAuth 2.0 tokens and Wix site tokens are encrypted in
application memory prior to Firestore storage using
AES-256-GCM with keys derived via
HKDF-SHA256 and bound via Additional
Authenticated Data (AAD) to the specific tenant,
Wix site, and credential ID.
Incremental Sync & Manual Trigger
SyncCal uses Google Calendar incremental sync tokens
(nextSyncToken) alongside background polling and an
on-demand Sync Now dashboard action, protected
by per-connection concurrency locks to prevent overlapping runs.
Clean Disconnect & Uninstall
Disconnecting a calendar attempts best-effort Google token
revocation, immediately overwrites stored Google token
ciphertexts with null (status: "PURGED"),
and optionally cancels future verified SyncCal-owned
"Busy" blocks on Wix Bookings.
Subscription Plans
Simple monthly plans billed through Wix App Market Billing once publicly released.
starter
- Up to 1 connected staff Google Calendar
- Automated background sync every 15 minutes
- On-demand manual Sync Now button
-
Pre-write customer appointment conflict protection
(
APPOINTMENT,CLASS,COURSE) - 6-invariant Wix event ownership verification & safe disconnect cleanup
pro
- Up to 10 connected staff Google Calendars
- Automated background sync every 5 minutes
- On-demand manual Sync Now button
-
Pre-write customer appointment conflict protection
(
APPOINTMENT,CLASS,COURSE) - Quarantine inspection & safe recovery controls in the merchant dashboard
Google API Services User Data Policy & Support Contact
SyncCal’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. SyncCal does not sell user data to third parties and does not use Google Calendar data to train, fine-tune, or prompt AI or LLM models.
Support & Privacy Contact: seancg2.me@gmail.com · Read the SyncCal Privacy Policy · Read the SyncCal Terms of Service