Security & privacy
Calendaria connects to your calendar, so trust is the product. This page explains, in plain terms, how we protect your data, how little we ask for, and how you stay in control.
Trust at a glance
Calendaria never asks for or stores your Google or Microsoft password.
Provider tokens are encrypted at rest with authenticated encryption.
Calendar writes are staged first and run only after you confirm them.
Your calendar and message content is not used to train general-purpose AI models.
Disconnecting deletes Calendaria's encrypted token copy for that provider account.
Booking and invite pages are rate-limited; form submissions use Turnstile.
We connect through your provider — never your password
You connect Google Calendar or Microsoft Outlook using the provider's official OAuth sign-in. We never see or store your password, and you grant access on the provider's own consent screen. You can review or revoke that access at any time from your provider's account settings — for Google, that's yourGoogle account permissions; for Microsoft, use your Microsoft account permissions page.
Provider permissions
For every provider we integrate, we request only the minimal permissions our features actually use — to read your agenda, find free time, and create or update the events you ask us to.
| Provider | Permission | Why Calendaria requests it |
|---|---|---|
calendar.events | List, create, get, update, and delete calendar events you ask us to manage. | |
calendar.events.freebusy | Check availability and find free time. | |
calendar.calendars.readonly | Read calendar metadata such as the primary calendar timezone. | |
calendar.calendarlist.readonly | List calendars so you can choose accounts and calendars for reads, writes, and availability. | |
openid, email, profile | Identify the connected Google account in your dashboard. | |
| Microsoft | Calendars.ReadWrite | Read and write Outlook calendar events through Microsoft Graph. |
| Microsoft | User.Read | Read the connected Microsoft account profile and email shown in your dashboard. |
| Microsoft | offline_access, openid, profile, email | Keep the connection active and identify the connected Microsoft account. |
Google exposes narrower Calendar scopes, so Calendaria doesnot request Google's broad unrestricted calendar scope. Microsoft Graph uses Calendars.ReadWrite for Outlook calendar read/write operations. Calendaria doesnot request Gmail, Google Drive, Google Contacts, Microsoft Mail, OneDrive, or Microsoft Contacts permissions.
Your data is encrypted
- In transit: every connection uses HTTPS/TLS, with HSTS enforced.
- At rest: the tokens that let us reach your calendar are encrypted in our database with authenticated encryption — a database leak alone does not expose usable tokens.
- We store calendar data only as needed to run the features you use, not to build a profile of you.
You confirm before anything changes
Calendaria never silently edits your calendar. Every create, reschedule, or delete is shown to you and happens only after you tap Confirm — so you always know exactly what is about to change. Read-only actions (like “what's on tomorrow?”) run directly.
AI and your calendar data
Calendaria sends your message and the calendar context needed for the request to the AI provider so it can interpret what you asked. We do not use your calendar or message content to train general-purpose AI models. Calendar writes are not solely automated: you see the proposed action and choose whether to confirm it before anything changes.
AI agents and MCP access
When you connect Calendaria from ChatGPT, Claude, Cursor, or another OAuth-capable MCP client, that client receives Calendaria-scoped MCP tokens only. MCP clients do not receive your dashboard cookies, Google or Microsoft provider tokens, or encrypted token data. You can revoke connected AI agents from the dashboard.
Public booking and invite links
Booking and invite links use unguessable slugs as public credentials. Guests see only sanitized link details, computed availability, or RSVP state — not the contents of your calendar. Public booking and invite pages are rate-limited, and booking/join submissions are protected against bots with Cloudflare Turnstile.
Disconnect in one tap
You can disconnect a connected calendar at any time from your dashboard. When you do, we delete our encrypted copy of that provider account's tokens. For Google connections, Calendaria also calls Google's token revocation endpoint on a best-effort basis. For Microsoft/Outlook, you can additionally revoke Calendaria from your Microsoft account permissions page. If you want your Calendaria account data deleted as well, emailsupport@calendaria.cofrom the address on your account and we will handle the deletion request.
Auditability
Calendar mutations are recorded in an audit log so activity can be reviewed, including what action was requested and the result.
Compliance & certifications
Calendaria is operated by Overload Tech Ltd(registered in England & Wales) and processes personal data in line with UK GDPR — see our Privacy Policy. We follow the data-minimization and least-privilege principles described above.
Every integration we add goes through the provider's official OAuth review before it ships. Formal compliance reports are not available yet; we will publish updates here as they become available.
Reporting a vulnerability
Found a security issue? Please emailsupport@calendaria.co and we will respond promptly. Responsible disclosure is welcome and appreciated.