# Privacy Policy for CalCalist

_Last updated: 14 September 2026_

CalCalist is a command-line program that runs on your own computer. It has no
servers, no accounts and no operator. Nobody but you can see what it does.

## What data is handled

CalCalist reads calendar events from the endpoints you configure and writes them
to the other endpoints you configure. Those events stay on your computer and on
the calendar services you already use. They are never sent anywhere else.

## Use of Google user data

If you configure a Google endpoint, CalCalist requests a single OAuth scope,
`https://www.googleapis.com/auth/calendar`. It is used for one purpose: reading
events from, and writing events to, the Google calendars you have named in your
own configuration file.

Google calendar data is not shared with any third party, is not used for
advertising, is not used to train any model, and is not transferred to anyone.

## Credentials

The OAuth client belongs to you — you create it in your own Google Cloud
project. CalCalist never receives it.

Only the refresh token is stored, under
`$XDG_STATE_HOME/calcalist` (by default `~/.local/state/calcalist`), in a
directory created with `0700` permissions and a file created with `0600`. It is
never written into the configuration file, so the configuration stays portable.

Authorisation uses the loopback redirect flow with PKCE. The authorisation code
never leaves your machine except in the direct exchange with Google.

## Network connections

CalCalist connects only to:

- `accounts.google.com` and `oauth2.googleapis.com`, to authorise and refresh.
- `www.googleapis.com`, for the Calendar API.
- The CalDAV servers and iCal feed URLs you put in your own configuration.

There is no telemetry, analytics, crash reporting or update check. No connection
is made to any host operated by the author.

## Removing your data

Revoke CalCalist's access at
[myaccount.google.com/permissions](https://myaccount.google.com/permissions),
and delete `~/.local/state/calcalist` to remove the stored token and local sync
state.

## Contact

kiritanflux@googlemail.com