Security & Privacy

JoinCal requests calendar access plus read-only people scopes used to find attendees. We do not request access to email message contents. Contact and directory searches run only when you type in the attendee picker.

• Google: Calendar read/write, contacts.readonly, and contacts.other.readonly
• Microsoft: Calendars.ReadWrite, Contacts.Read, People.Read, and basic organisation directory access
• Microsoft rooms: Place.Read.All when approved by a work or school tenant administrator; personal accounts do not support this capability
• Apple iCloud / CalDAV: Read-only CalDAV access to your selected calendars
• Yahoo, GMX, WEB.DE, Fastmail, Zoho, Nextcloud, mailbox.org, and Posteo: Read-only CalDAV access using an app-specific password
• Generic CalDAV: Read-only access to the public HTTPS server you configure
• ICS feeds: Read-only URL fetch

If you revoke JoinCal's access in your provider's security settings, we immediately stop syncing that account and mark it as needing re-authorisation.

OAuth access and refresh tokens are encrypted with AES-256-GCM before being written to the database. Each token has a unique 96-bit IV and a 128-bit authentication tag — providing both confidentiality and tamper detection.

The encryption key is stored only in environment variables and never appears in the codebase or database. A database breach does not expose usable tokens. Share-link passwords are stored as HMAC-SHA256 hashes using a separate secret, never in plaintext.

Events are synced to our database for fast rendering and sharing. We store:

• iCalUID (provider's unique event identifier)
• Title, start/end time (UTC), all-day flag
• Location, description, conference URL (Zoom/Meet link)
• Organiser display name and email
• Attendee email addresses added to the event

Contact search results and profile photos are fetched on demand and are not copied into JoinCal as an address book.

JoinCal enforces three permission levels on every shared calendar response — server-side, before data leaves our API:

• Free/busy: Only the time slot is returned. Title, location, and description are stripped.
• Titles only: Time slot and event title. Location and description are stripped.
• Full details: All stored fields are returned.

This filter is applied in code on every API response. It cannot be bypassed by the client. Share links can be revoked instantly — revocation takes effect on the next request.

Every share-link access, permission change, invite sent, and link creation is written to an append-only audit log. Each entry records: timestamp, action type, IP address (first IP from the forwarding chain), user-agent string, and permission level at time of access.

Audit logs are visible to the calendar owner in their dashboard settings.

You control your data:

• Disconnecting a calendar account immediately stops syncing and deletes all synced events for that account.
• Deleting a combined calendar removes all associated share links, invites, and audit log entries.
• Deleting your JoinCal account removes all your data permanently — connected accounts, synced events, calendars, share links, and audit logs.

We do not retain your data after deletion. There are no backups that persist calendar content beyond our standard database backup window (7 days), after which deleted data is unrecoverable.

• We do not show ads or use calendar data for advertising.
• We do not sell or share your calendar data with third parties.
• We do not run machine learning models on your calendar content.
• We do not store data beyond what is necessary for sync-and-share.
• We do not read email message contents or persist a copy of your Google or Microsoft address book.

In the event of a security incident affecting user data, we will notify affected users within 72 hours by email with details of what was affected and what steps we've taken.

Because OAuth tokens are encrypted at rest, a database breach does not automatically give an attacker usable calendar access. Our primary response to a database compromise is to rotate the encryption key — invalidating all stored tokens. To report a vulnerability, email . We aim to respond within 24 hours. security@joincal.net.