How we protect your accounts

RefSynced acts for you on the platforms you use to get games. That takes trust, so here's exactly how it works, in plain English.

The short version

• We never ask for or store your password. You sign in to each platform yourself.
• What we keep to stay signed in is encrypted.
• Nothing is posted without your OK, and RefSynced checks that every change saved.
• We play by the platforms' rules: no tricks to get around their protections.
• You can disconnect or delete your account at any time.

You sign in yourself

RefInsight, GotSport and RefQuest. When you connect one of these, a live browser window opens right on our Connect screen, showing the platform's own sign-in page. You type your username and password there, plus any code the platform sends you, just as you would on your own computer.

• We never ask for or store your password. It goes to the platform, not into RefSynced's database.
• Session recording is turned off.
• The window is locked to that platform's websites. It can't be used to browse anywhere else.
• It closes as soon as you're signed in, or after about 15 minutes.

After you sign in, the platform gives the browser a session, the same "stay signed in" cookies your own browser keeps. That session is what RefSynced keeps.

Assignr. RefSynced uses Assignr's official API, with keys from your Assignr account, never your password.

Signing in to RefSynced uses your Google account, on Google's own page. RefSynced only learns your verified email address.

What we keep is encrypted

Your saved sessions, Assignr keys, Google access and private calendar links work like keys to your accounts, so we treat them that way:

• They're encrypted by RefSynced before they're saved, with a key kept separately from the database.
• Keys are versioned, so they can be replaced.
• Everything travels over encrypted connections (HTTPS).
• Every account's data is kept separate, and we test that one user can never see or act on another's.
• Nightly backups are encrypted with a key that's kept offline, and each one is test-restored before it's saved.

Nothing is posted without your OK

• Every new blackout waits for your approval, in the app or with the Approve button on a phone notification. When a game is cancelled, RefSynced asks before removing the blackout too.
• RefSynced only changes your availability. It never accepts or declines games, messages anyone, or changes your profile.

RefSynced checks its work

• After every change, RefSynced checks that the platform saved it and keeps a screenshot as proof for up to 30 days.
• It never retries a change blindly. If it can't confirm one saved, it marks it "please check" and tells you, rather than risk posting it twice.
• It checks your connections regularly. If a sign-in has expired, your dashboard shows that platform as needs reconnecting until you sign in again.

We play by the platforms' rules

• No tricks. We don't solve CAPTCHAs, disguise our browsers, or route traffic through proxy networks to look like someone else.
• If a platform objects, we stop. If a platform blocks us or asks us to stop, we switch it to by-hand mode: RefSynced tells you exactly what to enter, and you do it yourself.
• Safety switch. If several users have trouble on the same platform at once, RefSynced pauses that platform for everyone until we've looked into it.
• We've asked permission. We've contacted each platform about RefSynced and asked for an official way to connect.

Assignr, RefInsight, GotSport and RefQuest aren't affiliated with RefSynced. Because RefSynced acts for you automatically, a platform could still ask you to sign in again, or limit your account. The Connect screen says so before you connect.

Who can see your information

• You.
• RefSynced's owner, only to run RefSynced, help you, or keep it safe.
• The companies that run parts of RefSynced for us: Railway (app, database and backups), Browserbase (the sign-in browser), Google (sign-in and Calendar), ntfy.sh (phone notifications), Sentry (error monitoring), Vercel (this website) and Porkbun (our email forwarding). Our Privacy Policy explains what each one handles.

We don't sell your data, and there are no ads.

You're in control

• Disconnect Google Calendar on the Setup page at any time; we revoke our access at Google.
• Disconnect a platform or delete your account by emailing support@refsynced.com during the beta. We delete your saved sessions and keys right away, and your data within 30 days.
• Want to be extra sure? On many sites, changing your password also signs out other sessions, which would include the one RefSynced holds.

What we can't promise

No online service is perfectly secure, and RefSynced is new. If something goes wrong with your information, we'll tell you promptly by email: what happened, what it means for you, and what we're doing about it.

RefSynced can also miss things. A platform can change its website or a session can expire. That's why your dashboard shows which days and platforms are covered, and why you remain responsible for your schedule (see our Terms).

Found a security problem?

Please email support@refsynced.com with "Security" in the subject line. We'll reply quickly and keep you updated. We welcome good-faith reports and won't take action against anyone who reports a problem responsibly: don't access other people's data, and give us a chance to fix it before sharing it.