Privacy policy

Last updated: September 16, 2026

This policy explains what information Across ("the service"), run by an individual developer ("we"), accesses, how it is used, stored, shared and deleted, and the choices you have. Across is a private, invitation-only service for keeping calendars in sync and summarizing them. What the service does is described on the Across home page.

Information we access

• Account information. When you sign in with Google or connect a Google account: the account's email address and unique Google account ID, for Google Workspace accounts the organization's domain, and the permissions you granted. For each sign-in session: when it started and was last used, and your browser's user-agent string.
• Calendar information. For the accounts you connect: the list of your calendars (name, colour, time zone and your access level). For the calendars used by your sync rules, your summaries and the calendar view, the events as the provider returns them: times, title, description, location, event type, visibility, identifiers, recurrence, your own response and whether the event has guests (not who they are). Descriptions and locations are read even when copies do not include them. Until you choose which calendars count toward your summaries, every calendar Across can read is used.
• Other calendar providers. For Apple iCloud Calendar, an Apple ID and app-specific password that the operator configures on the server, and the events in its calendars. For calendar subscriptions, the subscription link you provide and the events in the feed.
• Operational information. Records of sync runs (when they ran, what they would change or changed, and errors), needed to run the service and fix problems.

How we use information

Information is used only to provide and maintain the features you use:

• to sign you in and check that your account is invited;
• to copy events between the calendars you choose, with the level of detail you choose, and to keep those copies up to date or remove them;
• to show your calendars side by side, the sync history, and why an event was or was not copied;
• to show summaries of your day and week and to produce images of them;
• to keep the service secure and working.

We do not sell your information and do not use it for advertising. Data obtained through Google Workspace APIs is not used to develop, improve, or train generalized or non-personalized AI and/or ML models.

Google user data

Across's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs, including Google Calendar, will adhere to the Google Workspace API User Data and Developer Policy.

Google user data is used only to provide or improve the user-facing features described on the Across home page. It is transferred to others only as described under "Sharing", and it is not read by people except with your consent, for security purposes, or as required by law. The Google permissions Across requests, and why, are listed on the home page.

Sharing

We do not sell or rent your information. It is shared only:

• with the calendar providers of the target calendars you chose, when Across writes copies there. A target can be at another provider than the original, for example Google Calendar events copied into Apple iCloud Calendar;
• through the day and week images: event times, calendar names and colours, and titles for calendars that allow titles are copied to a separate image service about every 15 minutes, and anyone who has that service's private access key can view the current images;
• with providers that host the service and deliver its web traffic, acting on our behalf;
• when required by law.

Storage and security

Information is stored on a server operated for the service. Google refresh tokens and calendar subscription links are encrypted with AES-256-GCM; short-lived Google access tokens are kept in memory only. An Apple iCloud app-specific password is kept in the server's configuration, not in the database. Connections to Google, Apple and calendar feeds use HTTPS, and access to the service is restricted.

Across stores: for each copy it made, its time and the title it shows; the titles of original events in sync previews, approvals and run history; a full cached copy of the data in connected Apple iCloud calendars and calendar subscriptions; and a snapshot of event times, plus titles where allowed, for the day and week images. It does not store the descriptions or locations of Google events, except inside the copies it makes.

Retention and deletion

• Run logs are deleted after 30 days, and sync history and previews after 90 days. Sign-in sessions end 30 days after they were last used (after 90 days at most) and are then deleted. Nightly database backups are kept for 7 days.
• Records of the copies Across made are kept while those copies exist. Cached calendar data and summary snapshots are kept while the calendar is connected and in use.
• Removing an account in Across deletes its stored credentials and its calendars' cached data, and for a Google account asks Google to revoke Across's access. Encrypted copies in backups are gone within 7 days. Remove the copies Across made in an account's calendars, and the rules that use the account, before removing it; an account that a sync rule has used can currently be removed only by the operator.
• You can revoke Across's access to your Google account at any time in your Google Account settings, and you can ask for your information to be deleted.

Your choices

You decide which accounts and calendars Across can use, how much detail copies contain, which calendars count toward your summaries, and whether the images may include event titles for each calendar. You can change these choices or stop using the service at any time.

Children

Across is not intended for children and is not knowingly used to collect information from them.

Changes to this policy

This policy may be updated. The date at the top shows when it last changed. Significant changes will be communicated to users before they take effect.

Contact

Questions about this policy, and requests to have your information deleted, can be sent to the operator of the service through the contact details provided with your invitation.