CalSync privacy policy
בקצרה
- CalSync קורא רק את הקבוצות והצ׳אטים שבחרתם, מחלץ מהם אירועים, משימות ותשלומים, ושומר רק את הפריטים שחולצו. את טקסט ההודעות עצמו אנחנו לא שומרים.
- כדי לחלץ פריטים, טקסט ההודעות מהצ׳אטים שבחרתם נשלח לעיבוד ב-Google Gemini (שירות AI בתשלום, שלפי תנאי Google לא משמש לאימון המודלים שלה).
- תוסף ה-Chrome קורא בלבד: הוא לא שולח הודעות, לא מסמן כנקרא ולא פועל באתרים אחרים. שמות הצ׳אטים ומספרי הטלפון נשלחים אלינו כדי שתוכלו לבחור צ׳אטים באפליקציה.
- אין פרסומות ואין כלי אנליטיקה של צד שלישי. באתר עצמו אנחנו סופרים ביקורים בצורה אנונימית (מזהה אקראי בעוגייה, בלי כתובת IP), כדי לדעת אילו חלקים בעמוד נקראים. אנחנו לא מוכרים מידע. אפשר להוריד את כל המידע או למחוק הכול בכל רגע מדף הפרופיל.
- תשלום על מסלול בתשלום מתבצע דרך Paddle. פרטי הכרטיס נמסרים ישירות ל-Paddle ולא מגיעים אלינו.
Who we are
CalSync ("we") is operated by Ben Goldstein (בן גולדשטיין), Feierberg St 11, Tel Aviv, Israel, reachable at [email protected]. We are the controller (in Israeli terms, the database owner) of the personal data described in this policy. CalSync reads the WhatsApp groups and chats you choose, extracts the dates, tasks, payments, forms and announcements in them, and shows them to you as a daily summary, as notifications and, if you connect it, in your Google Calendar. This policy covers the web app at calsyncai.com, its server, and the CalSync Chrome extension.
How your WhatsApp is connected
Each account uses one of two connection methods; the app shows you which one.
- Chrome extension (default for new accounts). You install the CalSync extension in Chrome on your computer and keep WhatsApp Web open. The extension reads, inside that tab, the chats you selected in the app and sends their new messages to our server for extraction. Details in The Chrome extension.
- Server link (some existing accounts). You scan a QR code and our server becomes a linked device of your WhatsApp account. It connects a few times a day, receives new messages of the chats you selected, and disconnects. The link credentials are stored on our server encrypted; you can unlink at any time from the app or from WhatsApp's "Linked devices" screen.
With either method, only chats you selected are processed. Message text is held in memory only for the few seconds to minutes an extraction takes, and is not written to our database or our logs.
What we process
| Data | Why | Where it is kept | How long |
|---|---|---|---|
| Google sign-in: your e-mail, name, profile photo and Google account id | Your CalSync account | Our database | Until you delete your account |
| Your settings: the people and projects you create, which chats you selected, keywords, digest times, the name you are called by | To run the service the way you configured it | Our database | Until you change them or delete your account |
| Chat list: names of your WhatsApp groups and their member counts, names and phone numbers of your WhatsApp contacts and chats, the time of each chat's latest activity | So you can pick chats in the app. Never message text | Our database | Refreshed while connected; until you delete your account |
| Message text, sender names and times from the chats you selected | To extract items | Memory only, during extraction; sent to Google Gemini (see AI processing) | Not stored by us |
| Extracted items: titles, dates and times, places, amounts, links, who a task is for, and the WhatsApp message ids they came from | Your summary, notifications and calendar | Our database | Until you delete them or your account |
| Google Calendar access token (only if you connect Calendar) | To create events | Our database, encrypted | Until you disconnect Calendar or delete your account |
| Browser push subscription (only if you enable notifications) | To send you notifications | Our database | Until you turn notifications off or the browser revokes it |
| Connection health: your WhatsApp phone number, connection status, extension version, last-seen time and counts (how many messages were read, skipped or uploaded) | To show you whether capture works and to warn you when it stops | Our database (status) and our logs (counts) | Status: until you delete your account. Counts: see logs |
Website visits (calsyncai.com landing, start and sign-in pages): a random visitor id from the cs_vid cookie, which pages and sections were viewed and for how many seconds, scroll depth, which buttons and FAQ questions were clicked, the referring site and campaign tags, language, screen width and whether the device is touch. No IP address, no browser fingerprint, nothing you type. When you sign up, your account id is linked to that visitor id once | To understand which parts of the site help visitors and where they stop | Our database | Until the data is no longer needed; the account link is deleted with your account |
| Billing (only if you buy a paid plan): your plan and its renewal date, your Paddle customer and subscription ids, and the payment notices Paddle sends us, which can include your e-mail, country, amounts, and your card type with its last four digits. Your full card number and payment details go directly to Paddle; we never see or store them | To give you the plan you paid for, and to handle refunds and billing disputes | Our database | Plan: until you delete your account. Payment notices: as long as tax and accounting law requires (in Israel, up to 7 years), including after you delete your account |
| Operational logs: account id, request paths and timings, chat names, item counts. On a processing error, a short excerpt (under 500 characters) of the AI's structured output. Never message text | Security, debugging and reliability | Our server | Rotated by size; today they reach back a few months |
| Database backups: copies of our database taken before updates, containing the stored data above (never message text, which is not in the database) | To recover if an update goes wrong | Our server | Deleted within 90 days. Data you delete from the app can remain in a backup until that backup is deleted, and is never restored into the service |
One session cookie keeps you signed in. One first-party cookie, cs_vid, holds a random visitor id for the website statistics above (kept for a year), and a short-lived cs_src cookie remembers the campaign a visitor came from. We use no advertising cookies, no third-party analytics SDKs, and no cross-site trackers; the statistics never leave our server.
The Chrome extension
What it reads. The extension runs only on web.whatsapp.com, in your own signed-in WhatsApp Web tab. It reads your chat list (names, member counts, phone numbers, latest-activity times) and the messages of the chats you selected in CalSync: text messages and image captions, the sender's name and phone number, the time, whether you wrote it, and whether it mentions you. It ignores voice notes, images without captions, video, stickers, documents, reactions, polls, status updates and channels.
What it sends, and where. Only to our server at calsyncai.com, over HTTPS, signed in as you: the chat list above; the new messages of your selected chats; and a small status report every few minutes (connection state, your WhatsApp phone number, extension version, counts). Nothing is sent anywhere else.
What it decides on your computer. Before sending, the extension checks each new message against a list of Hebrew words and patterns (times, dates, amounts, links, "please bring" and similar) to decide when a chat is worth sending: sooner for urgent-looking messages, otherwise before your next digest. Every pending message of a selected chat is still sent at least once a day. If Chrome's built-in on-device model is enabled for your account, it may be used for the same "send now or later" decision; that model runs inside Chrome on your computer and sends nothing out.
What it stores on your computer. In the extension's own storage: which chats to read, their names, the id and time of the last message sent for each chat, counts, and your extension settings. It does not store message text. Removing the extension deletes this storage.
What it never does. It does not send, delete, forward or react to messages, does not mark messages as read, does not change anything in WhatsApp, does not read chats you did not select, and does not run on any other website.
Permissions it asks for. storage (the local state above), alarms (to check in every few minutes), access to web.whatsapp.com (to read the chats you chose) and to calsyncai.com (to send them to your account).
AI processing
Extraction is done by Google's Gemini API. For each extraction we send Google the message text, sender names and times of the chats involved, plus instructions and your chat settings (such as the name of the person or project the chat belongs to). We use Gemini as a paid service; under Google's Gemini API terms for paid services, Google does not use this data to improve its products, and it may keep it for a limited period to detect abuse. Google processes it under its own privacy terms. We do not use your data to train any model.
Who else receives data
- Hetzner (Germany): hosts our server and database.
- Google: sign-in; Gemini (extraction, above); Google Calendar, only if you connect it. With Calendar we can only reach calendars CalSync created for you (
calendar.app.created), never your other calendars. - Your browser's push service (for example Google, Apple or Mozilla): delivers notifications you enabled; it sees the notification, which lists new item titles.
- Paddle (Paddle.com Market Ltd, UK), only if you buy a paid plan: Paddle is the merchant of record. It collects your payment details, billing address and tax information, charges you, issues invoices and handles taxes and refunds, as an independent controller under Paddle's privacy notice.
We do not sell or rent your data, share it for advertising, or give it to data brokers. We would disclose data only if the law requires it.
Transfers outside Israel
Our server and database are in Germany (Hetzner, in the EU). Google may process data for Gemini, sign-in and Calendar in the United States and other countries, Paddle processes billing data in the UK and other countries, and your browser's push service may be anywhere. These transfers rely on the grounds permitted by Israel's rules on transferring data abroad and, where they apply, on the providers' data-processing terms, including the EU Standard Contractual Clauses. Not every country protects personal data at the same level as Israel or the EU.
Chrome Web Store and Google API limited use
CalSync's use of information received from the Chrome extension and from Google APIs adheres to the Chrome Web Store User Data Policy and the Google API Services User Data Policy, including their Limited Use requirements. We use this data only to provide the features described here, never for advertising, and no person reads it except when you ask us for support, when needed for security, or when the law requires it.
The other people in your chats
Your groups and chats contain messages from other people. CalSync processes them only because you, a member of that chat, selected it, and only to show you what concerns you. Their messages are not stored by us; items extracted from them are visible only in your account. Please select only chats you are comfortable having processed this way. We do not build profiles of anyone.
If you are not a CalSync user and think a CalSync user's account holds items or contact details about you (for example your name and phone number in their chat list), write to [email protected] with enough detail for us to find it, such as the group name. We will delete data about you as the law requires, and we may tell the user whose account it was in so they can stop selecting that chat. We cannot search all accounts by your messages, because we do not store them.
Security
All traffic uses HTTPS. Google tokens and WhatsApp link credentials are stored encrypted. Session tokens are stored only as hashes. Access to the server is limited to the developer.
No system is perfectly secure. If a security incident affects your data, we will notify the relevant authority (in Israel, the Privacy Protection Authority) and you as the law requires, and tell you what happened, what data was involved and what we did about it.
Your choices and rights
- Download everything: Profile → "הורד את כל הנתונים שלי".
- Delete everything: Profile → "מחק את כל המידע שלי" deletes your account and all its data, deletes the calendars CalSync created, revokes Google access, and unlinks the server link if you have one. Two exceptions, both in the table above: payment notices we must keep for tax law, and database backups until they are deleted (within 90 days).
- Stop capture: pause or remove the Chrome extension, log out of WhatsApp Web, unselect chats, or unlink the server link.
Depending on where you live (for example under Israel's Protection of Privacy Law or the EU/UK GDPR) you may have rights of access, correction, deletion, restriction, portability and objection, and the right to complain to your data-protection authority. Write to [email protected]; we answer within one month. We process your data to provide the service you asked for (performance of a contract) and, for optional features such as Calendar and notifications, with your consent, which you can withdraw in the app.
CalSync is meant for adults. It is not directed to children and children should not create accounts.
Changes
We will update this page when what we collect or how we use it changes, and tell you in the app before a change that reduces your privacy.
- 2.2 (24 October 2026): names the operator and controller; adds billing through Paddle, database backups, transfers outside Israel, security-incident notice, and how people who are not users can reach us.
- 2.1 (20 October 2026): adds the website visit statistics and the
cs_vid/cs_srccookies. - 2.0 (23 September 2026): first public version; covers the Chrome extension, the chat list, Gemini processing, connection health reports, logs, and Limited Use.