Golcad CalendarSync Privacy Policy

Effective date: 6 November 2026

This Privacy Policy explains how Golcad CalendarSync ("Golcad CalendarSync", "we", "us") handles information in connection with the Golcad CalendarSync service, the Golcad MAX appliance, and this website at golcad.com.

1. Who we are

Golcad CalendarSync is a private, self-hosted synchronization service operated by the owner of the Golcad MAX appliance. The service is not a public social network and is not offered to the general public.

Privacy contact: privacy@golcad.com.

2. Information we collect

When an operator connects an account, we may process:

Account information: name, email address, profile image, and account identifiers from Google or Microsoft.
Calendar information: calendar names, event titles, descriptions, locations, attendees, dates, times, recurrence information, calendar sharing settings, and access-control information.
Email information: sender, recipients, subject, date, message body, labels, and attachments that the operator authorizes us to read.
OAuth credentials: access and refresh tokens needed to maintain the authorized connection.
Appliance information: technical logs, diagnostic information, sync status, and service health needed to operate and secure the service.
Website information: standard web-server or hosting logs such as IP address, browser type, and requested pages, if our hosting provider records them.

3. How we use information

We use the information only to:

synchronize and display the operator's authorized calendars and email;
when calendar mirroring is enabled, create, update, move, or delete mirrored calendar events, create an archive calendar, and manage calendar sharing/access-control entries authorized by the operator;
index authorized content so the operator can search and ask questions about their own records;
create operator-requested reports and summaries;
maintain security, diagnose failures, and protect the service; and
comply with applicable legal obligations.

We do not sell Google user data, use it for advertising, or use it to determine creditworthiness or for lending purposes. We do not use Google user data to create public profiles.

4. Google API Limited Use

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data is used only to provide or improve the user-facing features described in this policy. It is not transferred to third parties except as necessary to provide those features, comply with law, or protect against abuse, and it is not used for advertising.

The Golcad CalendarSync Google OAuth application requests Google Calendar scopes only. It does not request Gmail data. Email synchronization described for the wider MAX appliance is provided separately through Microsoft Graph.

5. Sharing and service providers

We do not sell personal information. We may share limited information with:

Google and Microsoft: to authenticate the account and retrieve the data the operator authorizes.
Hosting and infrastructure providers: to operate this website and the private appliance.
Optional AI processing: if the operator enables the optional DeepSeek research feature, selected indexed content may be sent to DeepSeek's API solely to answer the operator's question. The operator controls whether this feature is enabled.
Legal and safety recipients: when required by law or necessary to protect rights, safety, and security.

Service providers are expected to protect information and to use it only for the service they provide to us.

6. Storage and security

Golcad CalendarSync runs on a private appliance controlled by the operator. OAuth tokens are stored in encrypted form. Access is restricted to the operator and the configured service components. No method of storage or transmission is completely secure, but we use reasonable technical and organizational safeguards.

7. Retention and deletion

OAuth tokens are retained until the operator disconnects the account or revokes access. Indexed calendar and email data is retained according to the operator's configuration and may remain in backups until those backups expire. The operator may request deletion of indexed data by contacting us. Revoking access in the Google Account permissions page prevents future access but does not automatically delete data already stored by the appliance.

8. Your choices and rights

Review or revoke Google access at myaccount.google.com/permissions.
Disconnect an account in the Golcad CalendarSync or MAX settings.
Request access, correction, export, or deletion of stored data by emailing privacy@golcad.com.
Ask us to stop optional AI processing by disabling the research feature.

9. International transfers

The service is operated on the operator's appliance. Authorized third-party providers, including Google, Microsoft, hosting providers, and optional AI processors, may process information in other countries subject to their safeguards and terms.

10. Children

Golcad CalendarSync is a private operator tool and is not directed to children. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this policy to reflect changes in the service or legal requirements. The effective date at the top of this page will be updated when we do. Material changes will be communicated to the operator.

12. Contact

Questions about this policy or our data practices: privacy@golcad.com.