added privacy page

PRIVACY.md

@@ -0,0 +1,57 @@
+# Privacy Policy for CalCalist
+
+_Last updated: 14 September 2026_
+
+CalCalist is a command-line program that runs on your own computer. It has no
+servers, no accounts and no operator. Nobody but you can see what it does.
+
+## What data is handled
+
+CalCalist reads calendar events from the endpoints you configure and writes them
+to the other endpoints you configure. Those events stay on your computer and on
+the calendar services you already use. They are never sent anywhere else.
+
+## Use of Google user data
+
+If you configure a Google endpoint, CalCalist requests a single OAuth scope,
+`https://www.googleapis.com/auth/calendar`. It is used for one purpose: reading
+events from, and writing events to, the Google calendars you have named in your
+own configuration file.
+
+Google calendar data is not shared with any third party, is not used for
+advertising, is not used to train any model, and is not transferred to anyone.
+
+## Credentials
+
+The OAuth client belongs to you — you create it in your own Google Cloud
+project. CalCalist never receives it.
+
+Only the refresh token is stored, under
+`$XDG_STATE_HOME/calcalist` (by default `~/.local/state/calcalist`), in a
+directory created with `0700` permissions and a file created with `0600`. It is
+never written into the configuration file, so the configuration stays portable.
+
+Authorisation uses the loopback redirect flow with PKCE. The authorisation code
+never leaves your machine except in the direct exchange with Google.
+
+## Network connections
+
+CalCalist connects only to:
+
+- `accounts.google.com` and `oauth2.googleapis.com`, to authorise and refresh.
+- `www.googleapis.com`, for the Calendar API.
+- The CalDAV servers and iCal feed URLs you put in your own configuration.
+
+There is no telemetry, analytics, crash reporting or update check. No connection
+is made to any host operated by the author.
+
+## Removing your data
+
+Revoke CalCalist's access at
+[myaccount.google.com/permissions](https://myaccount.google.com/permissions),
+and delete `~/.local/state/calcalist` to remove the stored token and local sync
+state.
+
+## Contact
+
+kiritanflux@googlemail.com