Privacy policy — the whole story, in plain English.

Who I am

I’m Nate, and Finicky Fox is my one-person shop in St. Paul, Minnesota. RecurSync is a side project of mine — I built it because recurring meetings have never synced properly between Google Calendar and Zoho CRM, and after fourteen years of that gap going unfixed, I got tired of waiting.

One person wrote this extension, and one person answers the email about it. That’s me.

Where RecurSync runs — this is the important part

RecurSync is not a web service with a login. It is a set of functions that install into your own Zoho CRM org and execute there, on Zoho’s infrastructure, under your organization’s account. When it needs calendar data it talks directly from your Zoho org to Google’s API.

There is no Finicky Fox server anywhere in that path. I don’t have a database, a log collector, or a backend that receives your events — not because I promise not to look, but because no such thing exists. Your calendar data moves between two parties you already have a relationship with: Google and Zoho.

What it asks Google for

When you click Connect, Google shows you a consent screen listing two permissions. Here they are, and here is precisely why each one is needed:

Both are needed for the product to work at all — without write access the sync is one-directional, and without the calendar list you couldn’t pick a calendar. RecurSync asks for nothing beyond these two.

What it reads from Google Calendar

Only from the single calendar you selected, and only these fields:

• Title — becomes the CRM meeting title.
• Description — copied to the CRM description.
• Location — copied to the CRM venue.
• Start and end times, plus whether it’s an all-day event.
• The recurrence rule — the pattern that makes it a weekly or monthly series. This is the whole reason the extension exists.
• The event’s ID and version tag, so it can match an event to its CRM record and tell whether it changed.
• Whether the event was cancelled, so the deletion can follow through.

What it deliberately does not touch

No attendees or guest lists. No organizer or creator identity. No Google Meet or conferencing links. No attachments, colors, visibility flags, or reminders. No other calendar on your account, and no free/busy lookups of anyone else.

What it writes, and where

Into your Zoho CRM

Into the standard Meetings module: the title, description, venue, start and end times, all-day flag, recurrence pattern, and the CRM user who owns it. It also stamps a small hidden marker on meetings it created, so it can tell its own records apart from ones you made by hand.

It also keeps two hidden bookkeeping modules in your org:

• Sync Maps — the pairing table. It holds identifiers only: the Google event ID, the calendar ID, the CRM record ID, the owner’s email, a version tag, and which side wrote last. No meeting titles, descriptions, locations, or people.
• Sync Profiles — one record per connected person: your Zoho login email, your CRM user ID, which calendar you picked, whether sync is on, a position marker for where the last sync left off, the notification channel details, and the last sync status or error.

Back into Google Calendar

When you create or edit a meeting in CRM, RecurSync writes the title, description, location, start and end times, your time zone, and the recurrence rule to the matching Google event — plus a hidden marker linking it back to the CRM record. When you delete the meeting in CRM, it deletes the Google event.

It never adds attendees, invitations, or conferencing to your Google events. Nobody gets emailed because of RecurSync.

Google API Services User Data Policy

RecurSync’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Concretely, that means Google Calendar data obtained through RecurSync is:

• used only to provide and improve the calendar-to-CRM sync you turned on;
• never transferred to anyone except as needed to provide that sync, or where the law requires it;
• never used for advertising, ad targeting, or building any profile of you;
• never sold, rented, or licensed to anyone, under any circumstances;
• never read by a human — including me — except in the narrow case described below, and then only with your explicit involvement.

That last exception is simply this: if you ask me for help and choose to send me a screenshot or an error message from your own org, I’ll read what you sent me in order to answer you. I have no way to obtain it otherwise, and I don’t keep it afterward.

Sign-in and tokens

The connection to Google is handled by Zoho’s built-in connector system. When you authorize RecurSync, Google issues the access and refresh tokens to Zoho, which stores and refreshes them inside your org’s account. RecurSync’s own code never sees, handles, or stores a token — it asks Zoho to make the call on your behalf.

Each CRM user connects their own Google account. Your calendar syncs to the meetings you own. Connecting doesn’t give your colleagues or your admin access to your calendar contents through this extension.

You can withdraw access at any time from either end: click Disconnect in the RecurSync settings widget, or revoke it directly at myaccount.google.com/permissions. Either one stops the sync.

Logs and error messages

When something goes wrong, RecurSync records the reason so you can see it in the settings widget. I want to be straight about one detail: an error message can include the title of the meeting that failed — for example, “Push to Google failed for ‘Q3 budget review’.” That’s there so the message is actually useful rather than a mystery.

That error text is stored in your own Zoho org, on your Sync Profile record, and it is overwritten and cleared the next time a sync succeeds. It is not sent anywhere. It never reaches me unless you decide to show it to me.

Routine execution logs stay in your Zoho org too, under Setup → Functions, where your admin can read them. Those record record IDs and API responses — not meeting contents. Zoho controls how long they’re kept; I don’t have access to them.

Analytics and tracking — there aren’t any

The extension contains no analytics, no telemetry, no crash reporting, no advertising SDK, and no third-party scripts. The settings screen talks to exactly one thing: your own Zoho org. It has no external network permissions at all, which you can verify in the extension’s manifest.

I don’t know how many meetings you sync, when you sync them, or what they’re called. I know how many organizations bought the extension, because Zoho tells me that on the payout report.

Keeping data — and deleting it

Since everything lives in your Zoho org, you are the one holding it, and you decide how long to keep it. Here is exactly what happens, including the parts that might surprise you:

When you click Disconnect:

• The notification channel with Google is shut down and syncing stops immediately, in both directions.
• The sync position marker and channel details are cleared from your profile.
• Meetings already synced into CRM stay where they are. They’re your business records at that point, and silently deleting a chunk of someone’s calendar history would be the wrong default.
• Your Sync Profile record and the Sync Map pairing rows are also kept, so that reconnecting later doesn’t duplicate everything.

If you want it all gone: delete the synced meetings in CRM, and have your admin delete your RecurSync Profile record and the associated Sync Map rows — they live in two hidden custom modules in your own org and your admin can remove them like any other records. Then revoke access at myaccount.google.com/permissions.

There’s nothing for me to delete on my end, because there’s nothing on my end. If you email me asking for deletion, the honest answer will be to walk you through the steps above in your own org — and I’m happy to do that.

Security

The strongest security property here is architectural: there is no extra place for your data to leak from. No server of mine to breach, no database of mine to steal, no credentials of yours in my possession.

All traffic between your Zoho org and Google runs over HTTPS. Access to the extension and its records is governed by your own Zoho CRM permissions — if someone can’t see a record in your org, RecurSync doesn’t change that. Your data’s security also depends on Google’s and Zoho’s own protections, which are documented in their respective privacy policies.

If you ever find a security problem in RecurSync, please tell me directly at hello@finickyfox.com. I’ll take it seriously and I won’t be defensive about it.

Your rights

Because RecurSync stores nothing outside your organization’s own systems, your organization — not me — controls the data and can access, correct, export, or delete it directly. For a copy of your data or its removal, your Zoho administrator is the fastest route, and the section above explains where everything sits.

If you’re in a place with rights under laws like the GDPR or the CCPA: I don’t hold your personal data, I don’t sell or share it, and there’s no profiling or automated decision-making in the extension. If you have a request I can actually help with, write to me and I’ll do what I can — including telling you plainly when the answer has to come from your own admin instead.

RecurSync is a business tool sold to organizations. It isn’t directed at children, and I don’t knowingly collect anything from anyone under 16.

Changes to this policy

If RecurSync ever starts handling data differently, I’ll update this page and change the “last updated” date at the top. If a change is significant — a new permission, a new place data goes — I’ll say so on the Zoho Marketplace listing too, rather than quietly editing this page and hoping nobody notices.

This URL is the permanent home of the policy. It won’t move.