Your privacy is very important to us. At Sugar Calendar we have a few fundamental principles that we follow:

  • We don’t ask you for personal information unless we truly need it. (We can’t stand services that ask you for things like your gender or income level for no apparent reason.)
  • We don’t share your personal information with anyone except to comply with the law, develop our products, or protect our rights.
  • We don’t store personal information on our servers unless required for the on-going operation of our site.

Sugar Calendar LLC (“Sugar Calendar”) operates several websites including sugarcalendar.com. It is Sugar Calendar’s policy to respect your privacy regarding any information we may collect while operating our websites.

Website Visitors

Like most website operators, Sugar Calendar collects non-personally-identifying information of the sort that web browsers and servers typically make available, such as the browser type, language preference, referring site, and the date and time of each visitor request. Sugar Calendar’s purpose in collecting non-personally identifying information is to better understand how Sugar Calendar’s visitors use its website. From time to time, Sugar Calendar may release non-personally-identifying information in the aggregate, e.g., by publishing a report on trends in the usage of its website.

Sugar Calendar also collects potentially personally-identifying information like Internet Protocol (IP) addresses for logged in users and for users leaving comments on our blogs. Sugar Calendar only discloses logged in user and commenter IP addresses under the same circumstances that it uses and discloses personally-identifying information as described below, except that blog commenter IP addresses are visible and disclosed to the administrators of the blog where the comment was left.

Gathering of Personally-Identifying Information

Certain visitors to Sugar Calendar’s websites choose to interact with Sugar Calendar in ways that require Sugar Calendar to gather personally-identifying information. The amount and type of information that Sugar Calendar gathers depends on the nature of the interaction. For example, we ask visitors who comment on our blog to provide a username and email address. Those who wish to receive Sugar Calendar updates via email, we collect their emails. In each case, Sugar Calendar collects such information only insofar as is necessary or appropriate to fulfill the purpose of the visitor’s interaction with Sugar Calendar. Sugar Calendar does not disclose personally-identifying information other than as described below. And visitors can always refuse to supply personally-identifying information, with the caveat that it may prevent them from engaging in certain website-related activities.

Aggregated Statistics

Sugar Calendar may collect statistics about the behavior of visitors to its websites. For instance, Sugar Calendar may monitor the most popular pages on the Sugar Calendar.com site or use spam screened by the Akismet service to help identify spam. Sugar Calendar may display this information publicly or provide it to others. However, Sugar Calendar does not disclose personally-identifying information other than as described below.

Protection of Certain Personally-Identifying Information

Sugar Calendar discloses potentially personally-identifying and personally-identifying information only to those of its employees, contractors and affiliated organizations that (i) need to know that information in order to process it on Sugar Calendar’s behalf or to provide services available at Sugar Calendar’s websites, and (ii) that have agreed not to disclose it to others. Some of those employees, contractors and affiliated organizations may be located outside of your home country; by using Sugar Calendar’s websites, you consent to the transfer of such information to them. Sugar Calendar will not rent or sell potentially personally-identifying and personally-identifying information to anyone. Other than to its employees, contractors and affiliated organizations, as described above, Sugar Calendar discloses potentially personally-identifying and personally-identifying information only in response to a subpoena, court order or other governmental request, or when Sugar Calendar believes in good faith that disclosure is reasonably necessary to protect the property or rights of Sugar Calendar, third parties or the public at large. If you are a registered user of an Sugar Calendar website and have supplied your email address, Sugar Calendar may occasionally send you an email to tell you about new features, solicit your feedback, or just keep you up to date with what’s going on with Sugar Calendar and our products. We primarily use our various product blogs to communicate this type of information, so we expect to keep this type of email to a minimum. If you send us a request (for example via a support email or via one of our feedback mechanisms), we reserve the right to publish it in order to help us clarify or respond to your request or to help us support other users. Sugar Calendar takes all measures reasonably necessary to protect against the unauthorized access, use, alteration or destruction of potentially personally-identifying and personally-identifying information.

Cookies

A cookie is a string of information that a website stores on a visitor’s computer, and that the visitor’s browser provides to the website each time the visitor returns. Sugar Calendar uses cookies to help Sugar Calendar identify and track visitors, their usage of Sugar Calendar website, and their website access preferences. Sugar Calendar visitors who do not wish to have cookies placed on their computers should set their browsers to refuse cookies before using Sugar Calendar’s websites, with the drawback that certain features of Sugar Calendar’s websites may not function properly without the aid of cookies.

Usage Tracking

Sugar Calendar collects certain information through usage tracking. The purpose of usage tracking helps Sugar Calendar to better understand our users and their website needs by looking at a range of variables in their Sugar Calendar plugin, WordPress, and web host. This information allows us to continuously improve our product as well as our Q&A / testing process. The information may include the license key (and type), plugin activation dates, form and entry statistics to help us make sure our features and updates get tested in situations that closely match our customers’ site environments and Sugar Calendar usage. We may also collect information of active integrations and plugin settings but sensitive settings such as API keys are automatically excluded from tracking.

Our usage tracking includes collecting information as to the WordPress active theme/plugins, locale, timezone, whether SSL enabled, or if a site is a multisite, and the site URL. In addition, the usage tracking includes determining the PHP and MySQL Versions in order to help us make sure our testing procedures have proper coverage to avoid compatibility issues, and determining the server software, which is used for testing purposes.

Opting Out of Usage Tracking

If you have a paid license with Sugar Calendar, then you will by default be opted into usage tracking. To disable this, please reach out to support and they will happily help out. If you’re using Sugar Calendar Lite and would like to enable usage tracking so that our team can keep making our product better, then please go to Sugar Calendar > Settings > Misc. On this screen, you’ll need to check the Allow Usage Tracking checkbox.

Business Transfers

If Sugar Calendar, or substantially all of its assets were acquired, or in the unlikely event that Sugar Calendar goes out of business or enters bankruptcy, user information would be one of the assets that is transferred or acquired by a third party. You acknowledge that such transfers may occur, and that any acquirer of Sugar Calendar may continue to use your personal information as set forth in this policy.

Ads

Ads appearing on any of our websites may be delivered to users by advertising partners, who may set cookies. These cookies allow the ad server to recognize your computer each time they send you an online advertisement to compile information about you or others who use your computer. This information allows ad networks to, among other things, deliver targeted advertisements that they believe will be of most interest to you. This Privacy Policy covers the use of cookies by Sugar Calendar and does not cover the use of cookies by any advertisers.

Comments

Comments and other content submitted to Akismet anti-spam service are saved on our servers unless they were marked as false positives, in which case we store them long enough to use them to improve the service to avoid future false positives.

How We Handle Your Payment Information

Payments are processed by Stripe, a PCI DSS Level 1 certified provider. We never receive or store your full card number. To reduce failed renewals, Stripe may receive updated card numbers or expiration dates directly from your card network or issuing bank when your card is reissued or expires.

Zoom Integration

When you use the Zoom integration feature in Sugar Calendar Bookings, the following applies:

What Data We Access

When a site administrator connects their Zoom account to Sugar Calendar Bookings, the plugin accesses the following information from Zoom via OAuth 2.0 authorization:

  • User profile information: Your Zoom display name, email address, and account ID. This is used to display the connected account in the plugin settings.
  • Meeting data: The plugin creates and reads Zoom meetings on your behalf in connection with bookings made through Sugar Calendar.

What Data We Store

On your WordPress site:

  • Encrypted OAuth tokens: An encrypted access token and refresh token are stored in your WordPress database to maintain your Zoom connection. These tokens are encrypted using AES-256-CBC encryption and cannot be read or decrypted by the plugin itself — they are used only to authenticate API requests through our secure relay service.
  • Zoom user information: Your Zoom display name and email address are stored to identify the connected account in the plugin settings.

On our servers (Product API relay):

  • Our OAuth relay service processes your Zoom authorization and API requests but does not permanently store any Zoom data. OAuth tokens are temporarily held in memory for up to 60 seconds during the initial authorization exchange, then discarded. The relay is fully stateless.

Meeting data:

  • Zoom meeting details (meeting ID, join URL) are passed through transiently when a booking is created. Meeting join URLs are included in booking confirmation emails but are not stored in a persistent database.

How We Use Your Zoom Data

Zoom data is used solely to:

  • Create Zoom meetings when new bookings are made
  • Include Zoom meeting links in booking confirmation communications
  • Update Zoom meetings when bookings are rescheduled
  • Delete Zoom meetings when bookings are cancelled
  • Display your connected Zoom account information in the plugin settings

Sugar Calendar does not use your Zoom data for advertising, marketing, analytics, profiling, or any purpose other than the booking integration described above.

Zoom Data Sharing

Sugar Calendar does not sell, rent, trade, or share your Zoom data with any third party. Zoom meeting join URLs are shared with booking participants as part of the booking confirmation — this is the core functionality of the integration. All Zoom API communication is routed through our Product API relay service, which acts as a secure intermediary. The relay encrypts and decrypts tokens server-side and forwards API requests to Zoom. No Zoom data is shared with any other service or third party.

Zoom Data Retention

Encrypted OAuth tokens are stored in your WordPress database until you disconnect your Zoom account, at which point they are immediately deleted. Zoom user information (name, email) is stored until you disconnect your Zoom account, at which point it is immediately deleted. Meeting data (join URLs) is transient and included in booking confirmation emails at the time of booking. It is not stored in a persistent database. On our relay servers, no Zoom data is retained beyond the 60-second authorization exchange window.

Disconnecting Zoom & Data Deletion

You can disconnect your Zoom account at any time from the Sugar Calendar Bookings settings in your WordPress admin. Disconnecting immediately deletes your stored encrypted OAuth tokens and Zoom profile information from your WordPress database. To request deletion of all Zoom-related data, disconnect your Zoom account from the plugin settings.

Zoom’s Privacy Policy

The Zoom integration is subject to Zoom’s Privacy Policy and Zoom’s Terms of Service. By connecting your Zoom account, you also agree to Zoom’s terms. If you have questions about how your Zoom data is handled, or wish to exercise your data protection rights, please contact us.

Google Calendar and Google Meet Integration

This section covers the Google Calendar and Google Meet integration in Sugar Calendar Events. It applies only when a site administrator connects a Google account to the plugin. Visitors to a Sugar Calendar website never sign in with Google.

What Data We Access

When a site administrator connects their Google account, the plugin asks for access through Google OAuth 2.0. You can approve Google Calendar and Google Meet separately, and the plugin turns on only the features you approved.

  • Basic profile information: your name, email address and profile photo. This is used to show which Google account is connected in the plugin settings.
  • Calendar list: the calendars you can edit, so you can choose which one your events go to.
  • Calendar events: when you create, edit or delete an event in Sugar Calendar, the plugin makes the same change on the calendar you chose. If sync from Google is turned on, the plugin also reads events created or changed in that calendar, including their title, description, dates and Google Meet link, and adds them to Sugar Calendar.
  • Google Meet: the plugin creates a Google Meet meeting for each event where you choose Google Meet, and saves its link. It cannot access Google Meet meetings it did not create.

What Data We Store

On your WordPress site:

  • Encrypted OAuth tokens, used to send requests to Google through our relay service. They are encrypted with AES-256-CBC.
  • Your Google account name, email address and profile photo, and the ID of the calendar you chose.
  • Events imported from Google Calendar, saved as Sugar Calendar events. By default, imported events are published on your site, and this includes invitations you accepted on that calendar.
  • Google Meet links, saved with the events they belong to.

On our servers (Product API relay):

  • When sync from Google is turned on, the relay keeps an encrypted refresh token, the calendar ID and the details of Google’s change notification channel. It uses them to renew that channel every day and to tell your site when the calendar has changed, so your site can fetch the changes.
  • Event details and Meet links pass through the relay on their way to your site. The relay does not keep them.

How We Protect Your Google Data

We use these safeguards to protect Google user data:

  • Encryption in transit: all traffic between your WordPress site, our relay and Google uses HTTPS with TLS 1.2 or higher.
  • Encrypted credentials: OAuth access and refresh tokens are encrypted with AES-256-CBC before they are stored, on your site or on our relay. Your site holds only the encrypted tokens and cannot decrypt them. The encryption key is kept in the relay’s server configuration, never in source code.
  • Authenticated requests: requests from your site to our relay are signed, and the relay only passes requests to an approved list of Google API endpoints.
  • Verified notifications: the relay accepts a change notification from Google only if it carries the secret token set for that channel, and it signs what it forwards to your site.
  • Secure sign-in: the authorization code is exchanged for tokens on our server, never in the browser, and a random state value protects the sign-in flow against forgery.
  • Secure infrastructure: our relay runs on Google Cloud. Production credentials are stored separately from source code, and changes are code-reviewed before they reach production.

How We Use Your Google Data

Google user data is used only to run this integration: keeping your Sugar Calendar events in sync with the Google Calendar you chose, creating Google Meet links for your online events, and showing the connected account in the plugin settings. We do not use it for advertising, marketing, analytics or profiling.

Google Data Sharing

We do not sell, rent or trade Google user data, and we do not share it with third parties. All requests to Google go through our Product API relay. Events published on your site, including imported events and their Meet links, are visible to your visitors like any other event.

Google Data Retention and Deletion

Google data on your site is kept until you remove the connection. When you click Remove in the plugin settings, the plugin stops Google’s change notifications, the relay deletes its stored record, and the encrypted tokens and account details are deleted from your WordPress database. Events that were already synced stay in Sugar Calendar and in Google Calendar until you delete them. You can also revoke Sugar Calendar’s access at any time from your Google Account at myaccount.google.com/permissions. To ask us to delete Google data we hold, contact us.

Limited Use of Google Data

Sugar Calendar’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve or train generalized AI or machine learning models. Our team does not read your Google data unless you ask us to as part of a support request, or when it is needed for security reasons or to comply with the law.

Google’s Privacy Policy

The Google integration is also subject to Google’s Privacy Policy and Google’s Terms of Service. If you have questions about how your Google data is handled, or wish to exercise your data protection rights, please contact us.

Privacy Policy Changes

Although most changes are likely to be minor, Sugar Calendar may change its Privacy Policy from time to time, and in Sugar Calendar’s sole discretion. Sugar Calendar encourages visitors to frequently check this page for any changes to its Privacy Policy. Your continued use of this site after any change in this Privacy Policy will constitute your acceptance of such change.

Last updated: October 2, 2026