Privacy Policy

Last updated: 13 March 2026

1. Who We Are

Calendar Circle is operated by MelbourneOnline (ABN 86 433 101 336), based in Melbourne, Australia. We provide a calendar sharing service that connects Google Calendar, Microsoft 365, and Apple iCloud calendars between family members and friends.

2. What Data We Collect

• Account information: Your name and email address (provided during sign-up or via Google/Microsoft OAuth).
• Calendar data: Event titles, times, locations, and descriptions from your connected calendars. This data is cached temporarily to enable syncing between circle members.
• OAuth tokens: Encrypted access and refresh tokens for your connected calendar providers (Google, Microsoft, Apple iCloud).
• Usage data: Page views, IP addresses, and browser information for analytics and security purposes.
• Payment data: Subscription payments are processed by Stripe. We do not store your credit card details.

3. How We Use Your Data

• Calendar syncing: We read events from your connected calendars and create mirror copies on other circle members' calendars. Synced events are marked as "free" so they don't block your availability.
• Notifications: We send emails for account verification, password resets, trial expiry notices, and help request updates.
• Service improvement: Aggregated, anonymised usage data helps us improve the service.

4. Calendar Data Access

Calendar Circle requests access to your calendar data through official APIs provided by Google, Microsoft, and Apple. Specifically:

• Google Calendar: We request calendar scope to read and write events, and userinfo.email to identify your account.
• Microsoft 365: We request Calendars.ReadWrite to read and write events, and User.Read to identify your account.
• Apple iCloud: You provide an app-specific password for CalDAV access to your calendars.

We only access calendar data necessary for the syncing service. We do not read your email, contacts, files, or any data outside of calendars.

Calendar Circle's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Data Sharing

Your calendar events are shared only with members of your circle — the people you explicitly invite. We do not sell, rent, or share your data with third parties, except:

• Stripe: For payment processing.
• Brevo: For transactional emails (account verification, password resets).
• Legal requirements: If required by Australian law.

6. Data Storage & Security

• All data is stored on servers located in Australia (AWS Sydney region).
• OAuth tokens are encrypted at rest using AES-256 encryption.
• All connections use HTTPS/TLS encryption in transit.
• Passwords are hashed using bcrypt.

7. Data Retention

• Calendar events: Cached events are retained only while your account is active and your calendar is connected. Disconnecting a calendar removes its cached events.
• Account data: Retained while your account exists. You can request deletion at any time.
• Synced copies: When you leave a circle or disconnect a calendar, synced event copies are automatically removed from other members' calendars.

8. Your Rights

Under the Australian Privacy Act 1988, you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your account and data
• Disconnect your calendars at any time (revoking our access)
• Complain to the Office of the Australian Information Commissioner (OAIC)

9. Cookies

We use session cookies to keep you logged in. We do not use third-party tracking cookies or advertising cookies.

10. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated date.

11. Contact

For privacy-related enquiries, contact us at [email protected].