SyncCal Privacy Policy

1. Overview & Scope

SyncCal (operated via the SyncWix synchronization service) is a one-way availability synchronization application for Wix Bookings merchants and their staff members. SyncCal connects a staff member’s Google Calendar in read-only mode to their assigned Wix Bookings staff schedule so that busy times on Google Calendar automatically block availability on Wix Bookings.

This Privacy Policy describes what information SyncCal receives and stores, how OAuth credentials are protected, what happens when a calendar is disconnected or the app is uninstalled, and how merchants or staff members can request complete deletion of stored records.

2. Google Calendar Read-Only Access

When a Wix merchant or staff member authorizes a Google Calendar in the SyncCal dashboard, SyncCal requests the following Google OAuth 2.0 scope (with include_granted_scopes=true and offline access for background synchronization):

https://www.googleapis.com/auth/calendar.readonly

• How Google Calendar Data Is Processed: During a synchronization check, SyncCal queries the Google Calendar REST API v3 using HTTP GET requests. While the raw API response payload parsed transiently in server memory includes standard event fields (id, etag, status, updated, summary, transparency, start, end, and attendees), SyncCal’s classification engine evaluates only the event’s status (confirmed, tentative, or cancelled), start and end timestamps, transparency (opaque vs. transparent), and whether the connected user’s own attendee entry (self === true) has responseStatus === "declined" to determine whether a time window is Busy or Free.
• Strictly One-Way Operation: SyncCal never requests write permissions to Google Calendar and never creates, modifies, or deletes any events on Google Calendar.

3. Google API Services User Data Policy & Limited Use

• SyncCal uses Google Calendar data solely to provide the user-facing one-way availability synchronization to the merchant’s authorized Wix Bookings schedule.
• SyncCal does not sell, rent, license, or transfer Google user data to third-party data brokers, advertising networks, or third-party analytics services.
• SyncCal does not include artificial intelligence (AI) or large language model (LLM) integrations and never uses Google Calendar data to train, fine-tune, or prompt AI models.

4. Wix Bookings Blocked-Time Updates & Customer Appointment Protection

• Generic Blocked-Time Slots Only: For each Busy time window detected on the connected Google Calendar, SyncCal creates, updates, or cancels a corresponding DEFAULT blocked-time event on the assigned Wix Bookings staff schedule with the generic title "Busy".
• Pre-Write Customer Booking Conflict Check: Before creating or moving a blocked-time slot on Wix, SyncCal queries Wix Calendar V3 and Wix Bookings V2 in that time window. If a confirmed customer booking (APPOINTMENT, CLASS, or COURSE) overlaps the window, SyncCal skips creating or moving the block and never modifies or cancels customer appointments.
• Ownership Verification: SyncCal only updates or cancels Wix events whose IDs exist in SyncCal’s Firestore ownership ledger and match six invariant fields (id, scheduleId, externalScheduleId, type === "DEFAULT", createdDate, and revision).

5. Information Stored in Firestore, Transient Processing & Error Logs

SyncCal stores operational synchronization records in its Google Cloud Firestore database (project syncwix-d54fa):

• Wix Tenant & Subscription Records (syncwix_tenants, syncwix_tenant_directory): Tenant ID, Wix Site ID (wixSiteId), Wix App Instance ID (wixInstanceId), business display name, active subscription tier (starter or pro), subscription status, Wix billing order ID, assigned connection IDs, and installation/verification timestamps.
• Staff Connection & Lock Records (syncwix_staff_connections, syncwix_connection_locks): Wix Bookings staff resource ID, staff display name, Wix schedule IDs (wixScheduleId and wixExternalScheduleId), connected Google Calendar ID, connected Google account email address, connection and health status, active block / protected conflict / quarantine counts, list of tracked Google event IDs, last sync timestamp, short-lived concurrency lock metadata, and a status/error summary string (lastSyncSummary).
• Synchronization Ledger & Cursors (syncwix_event_mappings, syncwix_sync_cursors): Google event ID, Google event ETag and updated timestamp, mapped Wix DEFAULT event ID (wixEventId), Wix schedule IDs, Wix event revision and creation timestamp, blocked time window (startIso and endIso), mapping state/quarantine reason, and incremental Google sync cursor (nextSyncToken).
• OAuth State & Credential Records (syncwix_oauth_states, syncwix_wix_oauth_states, syncwix_oauth_credentials): Short-lived OAuth state parameters, PKCE codeVerifier values, staff/tenant binding metadata, and encrypted token records.
• Transient In-Memory Processing vs. Database Fields: SyncCal’s Firestore mapping and cursor schemas do not contain fields for Google Calendar event titles (summary), descriptions, locations, meeting links, or attendee lists, nor Wix customer names, phone numbers, or payment card details; those fields from raw Google/Wix API responses are processed only transiently in memory during active API calls.
• Error Diagnostics & Cloud Runtime Logs: When an upstream Google or Wix API call fails, SyncCal redacts Bearer authorization headers and JSON token fields (access_token, refresh_token, client_secret, id_token), and may record up to the first 300 characters of the upstream HTTP error response in the connection’s lastSyncSummary field in Firestore and in standard Google Cloud / Firebase runtime logs for troubleshooting.

6. OAuth Token Storage & Encryption

• Application-Layer Encryption: Before writing Google OAuth 2.0 tokens or Wix site access/refresh tokens to Firestore, SyncCal encrypts each token in application memory using AES-256-GCM with a key derived via HKDF-SHA256 from the server’s master secret and bound via Additional Authenticated Data (AAD) to syncwix_token_aad:{tenantId}:{wixSiteId}:{credentialId}.
• Token Redaction: Plaintext access and refresh tokens are not written to Firestore documents and are redacted by SyncCal’s error formatting helpers.

7. Data Retention, Token Revocation, Disconnection & Deletion

• Disconnecting a Staff Calendar: When a merchant or staff member disconnects a calendar in the SyncCal dashboard:
  • SyncCal attempts a best-effort token revocation request to Google’s revocation endpoint (https://oauth2.googleapis.com/revoke). If Google’s endpoint is temporarily unavailable or returns a network error, remote revocation at Google may not complete automatically; users can also revoke SyncCal’s access directly at any time in their Google Account Permissions.
  • Regardless of whether Google’s revocation endpoint is reachable, SyncCal immediately updates that staff connection’s Google credential record (cred_google_*) in Firestore to status: "PURGED" and overwrites its encryptedAccessToken and encryptedRefreshToken fields with null. (The merchant’s Wix site credential cred_wix_* remains active while SyncCal stays installed on the Wix site.)
  • If the merchant selects the option to remove future blocks, SyncCal cancels future (or ongoing) SyncCal-owned DEFAULT blocked-time events on Wix Bookings that pass all six ownership invariant checks; any record with an invariant mismatch or uncertain API response is placed in quarantine rather than modified.
• Uninstalling SyncCal from Wix (APP_REMOVED): When SyncCal receives and verifies an RS256-signed APP_REMOVED webhook from Wix, SyncCal marks the tenant UNINSTALLED, performs best-effort Google token revocation and overwrites encryptedAccessToken and encryptedRefreshToken with null (status: "PURGED") for each staff connection registered in the tenant’s connectionIds, and overwrites the tenant’s Wix site credential (cred_wix_*) encryptedAccessToken and encryptedRefreshToken fields with null (status: "PURGED").
• Non-Secret Metadata Retained After Disconnect or Uninstall: Overwriting token ciphertexts with null (status: "PURGED") disables token use, but does not automatically delete the Firestore document shells or non-secret metadata records (tenant records, staff connection records containing staff name, Google account email, and calendar ID, OAuth state records, sync cursors, and event ID mapping records). Additionally, if a Google OAuth flow was completed without subsequently assigning that connection to a tenant’s staff list, its credential record is removed upon explicit disconnect or a manual deletion request.
• Requesting Complete Deletion of All Records: Merchants or staff members may request permanent deletion of all Firestore documents associated with their Wix site or Google account (including all tenant, staff connection, credential shell, OAuth state, cursor, and event mapping documents) at any time by emailing seancg2.me@gmail.com.

8. Privacy Contact

For questions about this Privacy Policy, data access requests, or complete record deletion requests regarding SyncCal, please contact:

SyncCal Privacy & Support
Email: seancg2.me@gmail.com