We value your privacy and only access Google user data necessary to provide the core functionality of this application. This app allows users to create, update, and delete events in their Google Calendar. All Google Calendar data accessed by the app is used solely to display calendars, allow calendar selection, and manage events at the user's explicit request.
Data Accessed
This app requests the following Google OAuth scopes:
Accessed data: All calendars the user can view, including shared or subscribed calendars. All event details the user can normally see, including title, description, start/end times, attendees, location, and recurring events.
Purpose: Allows users to view and select a calendar for event creation and view available times to prevent scheduling conflicts.
Important: While this scope technically allows access to private events if the user has permission to view them, any such data is only read transiently in the user's browser to check for scheduling conflicts. Private event data is never stored, logged, cached, or transmitted to any destination other than back to the Google Calendar API.
Limitations: This scope does not access profile information, Gmail, Drive, or other Google services.
Accessed data: Read and manage events on calendars the user can access, including creating, updating, or deleting events.
Purpose: Enables the app to create, update, or delete events in the calendar chosen by the user and ensure event details are accurate.
Limitations: Does not provide access to profile information or other Google account data.
Justification: These are the minimum scopes required to provide the app's core functionality. No narrower scopes can achieve this functionality while allowing users to select calendars and manage events.
How We Use Your Data
Google Calendar data is used exclusively for the following purposes:
Display all calendars the user can access for selection
Verify available times and prevent scheduling conflicts when creating events
Create, update, or delete events only when the user explicitly requests
No other processing of Google Calendar data occurs. All data access happens in real-time in response to user actions.
Data Sharing
Google Calendar data is never shared with third parties under any circumstances
No third-party libraries, analytics services, or advertising platforms have access to Google Calendar data
Data is transmitted only between the user's browser and the Google Calendar API to perform the requested functionality
No Google user data is used for any purpose other than providing the core calendar management features
Data Storage & Protection
Client-Side Processing
All Google Calendar data is processed in the user's browser in real-time
No calendar data persists in browser storage after the user completes their action
OAuth access tokens are stored temporarily in browser session storage and are automatically discarded when the session ends
Server-Side Processing
Our backend serverless functions facilitate OAuth authentication and API request routing
No access logs, error logs, or any other logs contain Google Calendar data or tokens
No Google Calendar event data (titles, times, attendees, etc.) is ever written to disk, databases, or any persistent storage — that data is only ever processed in memory during a request
If, and only if, you check "Keep me signed in": a Google refresh token is stored, encrypted (AES-256), in our database, tied to a random session ID kept in an HttpOnly browser cookie your browser never lets scripts read. This lets you stay signed in across visits without re-approving access every time. The database never stores your Google password, your calendar events, or any calendar content — only this encrypted token and your Google account ID.
If you leave "Keep me signed in" unchecked, nothing is stored server-side at all — the flow is unchanged from before: an access token is held only in the browser's memory for that visit.
Security
All communications with Google services use HTTPS/TLS encryption
OAuth tokens are handled securely and never exposed to third parties
Access controls ensure only authorized API calls are made on behalf of authenticated users
Data Retention & Deletion
Retention Policy
Zero retention of calendar content: no event data (titles, times, attendees, descriptions) is ever retained after the requested action completes
If "Keep me signed in" was left unchecked: OAuth access tokens live only in the browser's memory for that visit and are discarded when the tab is closed — nothing is stored server-side
If "Keep me signed in" was checked: an encrypted refresh token and your Google account ID are retained server-side until you sign out or revoke access (see below)
No historical data, event information, or scheduling content is ever stored, regardless of this setting
User Deletion Rights
If you never checked "Keep me signed in," there is no server-side data to delete — nothing was ever stored
If you did check it, clicking "Sign out" deletes the stored encrypted token immediately and revokes it at Google
Users may contact us at any time to verify what, if anything, is stored for their account
User Rights & Control
Revoking Access
Clicking "Sign out" in the app deletes any stored encrypted token and revokes it with Google
Users can also revoke this app's access at any time through their Google Account security settings, which invalidates any stored token even if "Sign out" wasn't clicked first
Revoking access immediately and permanently stops all access to Google Calendar data
Transparency
Users are prompted for explicit consent before any Google Calendar data is accessed
All calendar operations (create, update, delete) occur only at the user's direct request
Contact
For questions or concerns about this Privacy Policy, please contact: [email protected]