58 lines
2.1 KiB
Markdown
58 lines
2.1 KiB
Markdown
|
# Privacy Policy for CalCalist
|
||
|
|
|
||
|
|
_Last updated: 14 September 2026_
|
||
|
|
|
||
|
|
CalCalist is a command-line program that runs on your own computer. It has no
|
||
|
|
servers, no accounts and no operator. Nobody but you can see what it does.
|
||
|
|
|
||
|
|
## What data is handled
|
||
|
|
|
||
|
|
CalCalist reads calendar events from the endpoints you configure and writes them
|
||
|
|
to the other endpoints you configure. Those events stay on your computer and on
|
||
|
|
the calendar services you already use. They are never sent anywhere else.
|
||
|
|
|
||
|
|
## Use of Google user data
|
||
|
|
|
||
|
|
If you configure a Google endpoint, CalCalist requests a single OAuth scope,
|
||
|
|
`https://www.googleapis.com/auth/calendar`. It is used for one purpose: reading
|
||
|
|
events from, and writing events to, the Google calendars you have named in your
|
||
|
|
own configuration file.
|
||
|
|
|
||
|
|
Google calendar data is not shared with any third party, is not used for
|
||
|
|
advertising, is not used to train any model, and is not transferred to anyone.
|
||
|
|
|
||
|
|
## Credentials
|
||
|
|
|
||
|
|
The OAuth client belongs to you — you create it in your own Google Cloud
|
||
|
|
project. CalCalist never receives it.
|
||
|
|
|
||
|
|
Only the refresh token is stored, under
|
||
|
|
`$XDG_STATE_HOME/calcalist` (by default `~/.local/state/calcalist`), in a
|
||
|
|
directory created with `0700` permissions and a file created with `0600`. It is
|
||
|
|
never written into the configuration file, so the configuration stays portable.
|
||
|
|
|
||
|
|
Authorisation uses the loopback redirect flow with PKCE. The authorisation code
|
||
|
|
never leaves your machine except in the direct exchange with Google.
|
||
|
|
|
||
|
|
## Network connections
|
||
|
|
|
||
|
|
CalCalist connects only to:
|
||
|
|
|
||
|
|
- `accounts.google.com` and `oauth2.googleapis.com`, to authorise and refresh.
|
||
|
|
- `www.googleapis.com`, for the Calendar API.
|
||
|
|
- The CalDAV servers and iCal feed URLs you put in your own configuration.
|
||
|
|
|
||
|
|
There is no telemetry, analytics, crash reporting or update check. No connection
|
||
|
|
is made to any host operated by the author.
|
||
|
|
|
||
|
|
## Removing your data
|
||
|
|
|
||
|
|
Revoke CalCalist's access at
|
||
|
|
[myaccount.google.com/permissions](https://myaccount.google.com/permissions),
|
||
|
|
and delete `~/.local/state/calcalist` to remove the stored token and local sync
|
||
|
|
state.
|
||
|
|
|
||
|
|
## Contact
|
||
|
|
|
||
|
|
kiritanflux@googlemail.com
|