Privacy Policy
Calendario is a personal scheduling assistant that connects to a Google Calendar so its owner can ask about their schedule and create, reschedule, or cancel events in plain language. This policy explains exactly what data it touches, where that data goes, and how to remove it.
Who runs this service, and who can use it
Calendario is an independent, individually operated project. It is not affiliated with, endorsed by, or sponsored by Google. Questions go to support@calendario.db444.xyz.
This is a single-account deployment. It is not an open service. Exactly one Google account — the operator's — is permitted to connect. If you sign in with any other account, the authorisation is refused at the point it comes back from Google: nothing is stored, and the access you granted is immediately revoked. The rest of this policy describes how the operator's own calendar data is handled.
What Calendario accesses
At sign-in, Calendario requests two permission scopes, and no others:
-
calendar.readonly— to read your list of calendars and the events on them, including titles, descriptions, dates, times, and durations. This is read-only: it grants no ability to change anything. -
calendar.app.created— to create a secondary calendar and manage events only on calendars Calendario itself created.
The practical effect is that Calendario cannot modify or delete anything on your existing calendars, including your primary one. That isn't a promise about how the app behaves — it's a limit Google enforces on the access it was given. Events Calendario creates go into a separate calendar named Calendario and are marked as created by the app, so they stay distinguishable from the rest of your schedule.
Calendario does not request https://www.googleapis.com/auth/calendar, the broad
scope that would allow managing every calendar on the account.
Calendario does not request access to your Gmail, Drive, Contacts, location, or any other Google service, and does not ask for your Google password at any point. Sign-in happens entirely on Google's own consent screen.
What is stored, and where
- Authorization tokens. After access is approved, Google issues tokens that let Calendario act on the account's behalf. These are stored in a private Vercel KV (Redis) datastore used only by this application, and are the only credential retained. The Google client secret is not stored alongside them.
- A session cookie. Signing in sets one signed, HTTP-only cookie so the app knows the request is coming from the connected account. It holds the account's email address and nothing else, and it is what the calendar routes check before answering.
- Calendar content. Events are read on demand to answer your request and are not copied into a database or retained after the response is produced.
- Conversation history. Messages you type live in your browser for the duration of the session and are not stored on the server.
Third parties that receive data
Calendario relies on three providers, and nothing is sold or shared for advertising:
- Google — the source of your calendar data, accessed under the permission you grant.
- Vercel — hosts the application and provides the datastore holding your authorization tokens. Vercel's Web Analytics and Speed Insights also run on these pages, recording page views, referrer, approximate location, and browser and device type so it is possible to see whether the site is working and being used. These are cookieless and do not build a persistent profile of you, and calendar data is never included.
- Cohere — the text you type into the chat box is sent to Cohere's language model to work out what you are asking for. Please be aware that if your message mentions details of an event, that text is included. Calendar data is not otherwise sent to Cohere.
Beyond these providers, your information is disclosed only where required by law.
Limited Use disclosure
Calendario's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained through Google APIs is never used for advertising, never sold or transferred to data brokers or information resellers, and never read by humans except where you have explicitly asked for support, where required for security or legal reasons, or where the data has been aggregated and anonymised.
Revoking access and deleting your data
You can withdraw Calendario's access to your Google Account at any time, without asking anyone, at myaccount.google.com/permissions. Revoking immediately invalidates the stored tokens, and Calendario can no longer reach your calendar.
Revoking at Google is the complete remedy: it invalidates the stored tokens wherever they are. To have the stored blob deleted from the datastore as well, email support@calendario.db444.xyz and it will be removed by hand — there is no self-service deletion endpoint, because there is only one account. Events Calendario created remain on the calendar and are yours to keep or delete; removing the app's access does not delete them.
Security
Traffic is served over HTTPS, and tokens are held in a private datastore that is not exposed publicly. No system is perfectly secure, and Calendario is a personal project rather than a commercially audited service — please weigh that when deciding what to connect.
Children
Calendario is not directed at children under 13 and is not intended for their use.
Changes to this policy
If this policy changes, the date at the top of this page will be updated. Material changes to how your data is handled will be reflected here before they take effect.
Contact
Questions or requests about this policy or your data: support@calendario.db444.xyz.