Privacy Policy

OgeSync is operated by Chukwunonso Ukwandu, a sole trader based in Nigeria, under the brand name "OgeSync." When we say "we," "us," or "OgeSync," we mean this business.

Our website is www.ogesync.com. For any privacy question or request, email us at ify@ogesync.com.

We collect different data depending on how you use OgeSync:

If you create an organiser account:

• Your email address and name. If you sign in with Google, our login provider also receives your Google profile details, such as your profile picture.
• Your password, which our login provider stores only in scrambled (hashed) form
• The calendars and events you create, including logos, links and reminder settings
• Messages you send us through support, including any screenshots you attach

If you add a calendar to Apple Calendar or Outlook (no account needed):

• When your calendar app downloads a calendar, we record which calendar, the day, how many downloads, and a scrambled code (hash) of your app's name and version. Many downloads are answered by our hosting provider's cache and never reach us.
• With each download we record, we also store a scrambled code made from your IP address and your app's name and version. It doesn't show your IP address, but it isn't anonymous: the same address and app always give the same code.
• When you tap a button on a calendar's subscribe page (for example "Add to Apple Calendar"), we record which button, on which page and when, with the same kind of scrambled code.
• Some calendars give you a personal subscription link. For those, we store only a scrambled form of the link, the app it was made for, when it was made, and how many times it's downloaded each day.

If you use Google Instant Sync (no account needed):

• Your Google account ID and email address, and the permissions you granted
• A credential that lets us keep the OgeSync calendar in your Google account updated, stored encrypted
• Which public calendar you follow, the ID of the calendar we created in your Google account, and records of the updates we send (such as event IDs and whether each update worked)
• A short-lived security record of each Google sign-in, deleted after about 10 minutes

With Google Instant Sync we can only see and change calendars that OgeSync creates. We can't see your other calendars, events, contacts or files.

To keep the service safe:

• To limit abuse, we keep a scrambled code of your IP address for up to 31 days.
• Our hosting provider processes your IP address and browser details to deliver pages and protect the service.
• When something breaks, we may send a technical error report to PostHog (see section 4).

• To provide the service: delivering calendars and Google Instant Sync updates, running accounts, and answering support requests
• To give organisers reports: numbers such as calendar downloads, button taps, Google Instant Sync subscriptions and personal-link use. Reports show counts only, never your email address or Google account.
• To email organisers: account emails such as welcome messages, event reminders they set up, monthly reports and support replies. We don't email Google Instant Sync subscribers.
• To prevent abuse: detecting spam, enforcing our Acceptable Use Policy, and protecting our users

Information from Google

We use information from Google only to create and update the OgeSync calendar in your Google account, show you its status, and let you pause, resume or disconnect it. We don't sell it, use it for advertising, or use it to train AI models. Calendar organisers don't receive your Google email address.

OgeSync's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use these services to run OgeSync. Each processes data according to its own privacy policy:

• Supabase — database, logins and encrypted credential storage (in Ireland, in the European Union)
• Vercel — website hosting and scheduled jobs (in the United States)
• Google — Google sign-in and the Google Calendar API, for Google Instant Sync
• Resend — emails to organisers
• Bachs (Bachs Technologies Limited, Nigeria) — payment processing for paid plans. You enter your card details on Bachs's own checkout and billing pages. Your full card number and security code (CVC) go to Bachs's card-processing partners, including Stripe: Bachs says it never stores them, and OgeSync never receives them. Bachs keeps masked card details (card type and last four digits) with your name, email, billing address, payment history and technical data such as your IP address, for payments and fraud prevention. We send Bachs your account email and a random reference. We keep the Bachs IDs of your customer record, checkouts, subscriptions and invoices, your subscription's status and dates, and each payment's amount, currency and date. Bachs says it may process data in the countries where its payment partners and service providers are located.
• PostHog — optional dashboard usage analytics, only after you choose to allow it. We send a coarse section name and a random ID held in page memory, without account identifiers or calendar content. Withdraw consent in the same dashboard control. Reloading resets your choice.
• PostHog (error reports) — when enabled, a technical report when something breaks on our site or servers: the error type, code locations (file name, line and column), the app version and environment, whether it happened in a browser or on our servers, and a coarse page area or route pattern. Reports never include error messages, page addresses, account data or calendar content. We send them from our servers, so PostHog doesn't receive your IP address. They don't depend on your usage-analytics choice.
• Sentry — application error monitoring when configured. Reports contain generic error types and sanitized code locations, without error messages, request details, account data or calendar content. Browser reporting connects to Sentry, which receives the connection IP address as part of delivery. We do not enable recordings, performance tracing or advertising.

This means your data is processed outside Nigeria, including in the United States and the European Union.

We do not sell your data to anyone. We do not share your personal information with advertisers.

• Organiser accounts: kept while your account is active. To delete your account, email ify@ogesync.com; we delete it within 30 days of your request. We keep support messages after an account is deleted, so we can answer follow-ups.
• Calendar records: download records, scrambled codes, button taps and personal-link records are kept for as long as the calendar exists. When an organiser deletes a calendar, we keep it for 30 days in case of mistakes, then delete it with its events and these records.
• Abuse limits: the scrambled code of your IP address is kept for up to 31 days.
• Google Instant Sync: if you pause updates, we keep your subscription and the Google access you granted, so you can resume. When you choose "Disconnect Google access", updates stop at once and we ask Google to revoke our access, retrying if Google doesn't confirm; when Google confirms, we delete the stored credential. Thirty days after you disconnect, we delete your Google account ID, email address, connection, stored credential, subscriptions and their update records, even if Google hasn't confirmed the revocation, unless you connect again before then. This normally finishes within a day after the 30 days. Records of individual updates are deleted after 30 days. If you remove OgeSync's access in your Google Account instead of using Disconnect, we keep your records until you use "Disconnect Google access" or ask us to delete them. You can remove OgeSync's access yourself at any time at myaccount.google.com/connections; if Google hasn't confirmed our revocation, OgeSync may still be listed there until you do. If you connected Google Calendar from an OgeSync account, this data is deleted when your account is deleted.
• Your Google calendars: they stay in your Google account; delete them in Google Calendar if you no longer want them. After we delete our records we can no longer recognise them, so check Google Calendar for older "· OgeSync" calendars before subscribing again.
• Backups: backups we keep to recover the service after a failure may still contain deleted information until those backups are deleted.

You have the right to:

• Access the personal data we hold about you
• Correct any inaccurate data
• Delete your account and associated data
• Get a copy of your data, which we send to you
• Object to processing of your data

To exercise any of these rights, email ify@ogesync.com. We will respond within 30 days. If you use Google Instant Sync, you can also pause or disconnect at any time from Manage subscription.

We comply with the Nigeria Data Protection Regulation (NDPR) and the Nigeria Data Protection Act 2023. We process your data lawfully, fairly, and transparently. We collect only what is necessary to provide our service.

As a data controller, we are responsible for protecting your data. If you believe your data protection rights have been violated, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC).

If you are visiting from the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR), including the right to data portability and the right to lodge a complaint with your local data protection authority.

Our legal basis for processing your data is: legitimate interest (providing and improving our service), contractual necessity (fulfilling our service to you), and consent (where you have explicitly opted in).

OgeSync is not intended for children under 16. We do not knowingly collect data from anyone under 16 years old. If you believe a child under 16 has provided us with personal data, please contact us at ify@ogesync.com and we will delete it promptly.

We use industry-standard security measures to protect your data, including encrypted connections (HTTPS/TLS), hashed passwords, an encrypted store for Google credentials, and secure database hosting. However, no system is 100% secure. If you discover a security vulnerability, please report it to ify@ogesync.com.

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email or by placing a prominent notice on our website. The "Last updated" date at the top of this page shows when it was last revised.