2.1 KiB
Privacy Policy for CalCalist
Last updated: 14 September 2026
CalCalist is a command-line program that runs on your own computer. It has no servers, no accounts and no operator. Nobody but you can see what it does.
What data is handled
CalCalist reads calendar events from the endpoints you configure and writes them to the other endpoints you configure. Those events stay on your computer and on the calendar services you already use. They are never sent anywhere else.
Use of Google user data
If you configure a Google endpoint, CalCalist requests a single OAuth scope,
https://www.googleapis.com/auth/calendar. It is used for one purpose: reading
events from, and writing events to, the Google calendars you have named in your
own configuration file.
Google calendar data is not shared with any third party, is not used for advertising, is not used to train any model, and is not transferred to anyone.
Credentials
The OAuth client belongs to you — you create it in your own Google Cloud project. CalCalist never receives it.
Only the refresh token is stored, under
$XDG_STATE_HOME/calcalist (by default ~/.local/state/calcalist), in a
directory created with 0700 permissions and a file created with 0600. It is
never written into the configuration file, so the configuration stays portable.
Authorisation uses the loopback redirect flow with PKCE. The authorisation code never leaves your machine except in the direct exchange with Google.
Network connections
CalCalist connects only to:
accounts.google.comandoauth2.googleapis.com, to authorise and refresh.www.googleapis.com, for the Calendar API.- The CalDAV servers and iCal feed URLs you put in your own configuration.
There is no telemetry, analytics, crash reporting or update check. No connection is made to any host operated by the author.
Removing your data
Revoke CalCalist's access at
myaccount.google.com/permissions,
and delete ~/.local/state/calcalist to remove the stored token and local sync
state.