Privacy Policy

1. Introduction

SidekickCal (“we,” “us,” or “our”) is a registered Australian business name operating the SidekickCal platform. We are committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy provides a transparent overview of how we handle personal information collected from community sports organizations (“Orgs”) and their subscribers (“Subscribers”).

2. Information We Collect

• For Org Admins: We collect your name, email address, and Organization details (Logo, Name) via Google or Microsoft OAuth.
• For Subscribers: We collect your email address and an encrypted OAuth Refresh Token provided by your calendar provider (Google/Microsoft).
• Usage Data: We collect minimal logs related to sync success/failure to ensure service reliability.
• Google Calendar Data: For both Org Admins and Subscribers, we access your Google Calendar via API Scopes to create, view, edit and delete only the specific events managed by SidekickCal.

3. Cookies and Tracking

SidekickCal uses the following cookies:

• Authentication cookies — required to keep you signed in to your account. These are set only when you log in and cannot be declined without breaking the service.
• A/B test cookie — a session-scoped cookie used to show you a consistent version of the homepage during your visit.
• Analytics cookies — with your consent, we load Google Analytics (GA4), Microsoft Clarity, PostHog, and Meta Pixel to understand how people use SidekickCal and to measure the effectiveness of advertising. These tools may collect your IP address, browser type, and pages visited. They are only loaded after you accept cookies via the consent banner. You can decline at any time.

We do not use advertising cookies or sell data to any third party.

4. Google API Limited Use Disclosure

SidekickCal's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for any purpose other than providing and improving the calendar synchronization service.

5. How We Use Your Data

We use the collected information solely to:

• Create and update sports events on your calendar.
• Notify you of schedule changes via your calendar's native notification system.
• Manage your subscription and account settings.

6. Lawful Basis for Processing

Where the EU General Data Protection Regulation (GDPR) or UK GDPR applies, we rely on the following lawful bases:

• Performance of contract — processing your data is necessary to provide the calendar synchronisation service you have requested. This applies to subscriber calendar sync and all org admin account functions.
• Consent — analytics and advertising tools (Google Analytics, Microsoft Clarity, PostHog, Meta Pixel) are only loaded after you accept cookies via the consent banner. You may withdraw consent at any time by declining cookies.
• Legitimate interests — we send onboarding and trial emails to org admins to help them get value from the service. You may opt out at any time by contacting privacy@sidekickcal.com. Interest and waitlist registrations are also processed on this basis.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — you can request a copy of the personal data we hold about you.
• Correction — you can ask us to correct inaccurate or incomplete data.
• Erasure — you can request deletion of your personal data. Subscribers can unsubscribe via sidekickcal.com/manage; org admins can delete their account from the dashboard. Upon deletion, your data is permanently removed from our systems.
• Portability — you can request a machine-readable copy of data you have provided to us.
• Objection — you can object to processing based on legitimate interests, including direct marketing.
• Withdraw consent — where processing is based on consent (e.g. analytics cookies), you can withdraw at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@sidekickcal.com. We will respond within 30 days.

If you are located in the EU or UK and believe we have not handled your data lawfully, you have the right to lodge a complaint with your local supervisory authority — for example, the Information Commissioner's Office (ICO) in the UK, or your national data protection authority in the EU. In Australia, complaints may be directed to the Office of the Australian Information Commissioner (OAIC).

8. Data Retention and Deletion

• Retention: We store OAuth Refresh Tokens as long as you maintain an active sync with an Organization.
• Deletion: You may revoke access at any time via your Google or Microsoft account settings. You may also delete your SidekickCal account via our dashboard. Upon deletion, all associated OAuth tokens and personal data are permanently purged from our AWS databases within 24 hours.

9. Data Security

All data is stored in encrypted databases via Amazon Web Services (AWS). OAuth tokens are encrypted at rest using AWS Key Management Service (KMS).

10. Third-Party Sharing

Google user data (including OAuth tokens and calendar access) is processed solely by Amazon Web Services (AWS), which provides our encrypted database and cloud infrastructure. AWS acts as a data processor on our behalf and does not have independent access rights to your data. We do not sell, trade, rent, or otherwise disclose your Google user data to any other third party, and we do not use it for advertising or any purpose beyond providing the calendar synchronisation service described in this policy.

11. Contact Us

If you have any questions about this Privacy Policy or wish to make a privacy complaint, please contact us at privacy@sidekickcal.com. We will respond to all enquiries within a reasonable time.