TourSync (“we,” “our,” or “us”) operates tour-sync.app. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using TourSync, you agree to the practices described here.
1. Information We Collect
Account Information
When you create an account, we collect your email address and name via Clerk, our authentication provider. Clerk handles password storage and authentication security — we never store your password directly.
Master Tour (Eventric) Credentials
To connect your Master Tour account, you provide your Eventric email and password. We immediately exchange these for an API keypair from Eventric's servers, then discard your raw password. The API keypair is stored in our database encrypted with AES-256-GCM using a server-side encryption key. Your Eventric login credentials are never stored in our systems.
Google Calendar Credentials
If you connect Google Calendar (VIP and All Access tiers), we store OAuth access and refresh tokens. These tokens are encrypted with AES-256-GCM before being written to our database. We request only the minimum necessary scope: https://www.googleapis.com/auth/calendar. You can revoke this access at any time in your Google Account settings.
Billing Information
Payments are processed by Stripe. We store only your Stripe customer ID — we never see or store your credit card number, CVV, or full billing address. Stripe's privacy policy governs how payment data is handled.
Tour & Calendar Data
We fetch tour data (dates, venues, hotels, travel) from the Eventric API on your behalf and use it to generate calendar events. We store tour identifiers and sync history (what was synced and when) to support auto-sync. We do not sell or share your tour data with any third party.
Usage Data
We may collect basic usage analytics (pages visited, features used) to improve the product. We do not use third-party advertising trackers or sell behavioral data.
2. How We Use Your Information
- To authenticate you and maintain your session
- To connect to the Eventric API and fetch your tour schedule on your behalf
- To generate .ics calendar files and webcal subscription feeds
- To sync events to your Google Calendar when you authorize it
- To process subscription payments and manage your plan tier
- To run daily auto-sync for active subscriptions
- To send transactional emails (e.g., receipts) via Clerk's email system
- To improve and debug the service
We do not use your data for advertising, sell it to third parties, or use it to train AI models.
3. Data Storage & Security
Your data is stored in Supabase (hosted on AWS). All tables have Row Level Security enabled. Sensitive credentials (Eventric API keys, Google OAuth tokens) are encrypted at the application layer with AES-256-GCM before being written to the database — meaning even a full database breach would not expose usable credentials.
Our servers and database are located in the United States. If you are accessing TourSync from outside the United States, your information may be transferred to and processed in the United States.
4. Third-Party Services
TourSync integrates with the following third-party services:
5. Data Retention & Deletion
We retain your account data for as long as your account is active. Sync history is retained for up to 12 months. If you delete your account, we will delete your personal data, encrypted credentials, and tour data from our systems within 30 days. Stripe may retain billing records as required by law.
To request account deletion, email us at support@tour-sync.app.
6. Your Rights
Depending on your location, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate information
- Request deletion of your account and associated data
- Revoke Google Calendar access at any time via your Google Account
- Cancel your subscription at any time
To exercise any of these rights, contact us at support@tour-sync.app.
7. Children's Privacy
TourSync is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us and we will promptly delete it.
8. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page with an updated date and, where appropriate, by emailing registered users. Your continued use of TourSync after changes are posted constitutes acceptance of the updated policy.
9. Contact
Questions about this Privacy Policy? Reach us at support@tour-sync.app.