Privacy Policy
Last updated: August 8, 2026
What Kalenda is
Kalenda is a multi-account calendar application. You connect one or more Google accounts and Kalenda displays their calendars together, checks for scheduling conflicts, and creates events on your behalf.
Data we access
With your explicit OAuth consent, Kalenda accesses: your basic profile (name, email, photo), your calendars and events, your contacts for attendee autocomplete, and your organization's directory where applicable. Access is read/write for calendars and read-only for contacts.
Data we store
We store your account identifiers, calendar names and settings, and encrypted OAuth tokens (AES-256-GCM) needed to sync with your calendar providers. Event and contact data is fetched live from your provider and is not retained on our servers beyond caching necessary for operation. We never see or store your passwords — authentication happens on Google's servers via OAuth.
How we protect your data
All data moves between your browser, our servers, and Google exclusively over encrypted connections (TLS 1.2+). Sensitive credentials — your OAuth access and refresh tokens — are encrypted at rest with AES-256-GCM and are never transmitted to the browser or exposed in logs; decryption happens only server-side at the moment a request to your calendar provider is made. Our databases enforce row-level security so each user's records are accessible only to that authenticated user, and the app is hosted on SOC 2-audited infrastructure (Vercel and Supabase). Production access is limited to the developer, protected by multi-factor authentication. Calendar and contact data is processed transiently to render your requested views and is not written to long-term storage. In the event of a data breach affecting your data, we will notify affected users promptly via the email on their account and revoke compromised credentials immediately.
Data retention
Stored data (account identifiers, calendar settings, encrypted tokens) is retained only while the associated account remains connected. Disconnecting an account, or deleting your Kalenda account, permanently deletes this data from our systems. Server-side caches expire automatically within hours.
What we never do
We do not sell your data. We do not share it with third parties for advertising. We do not use your calendar or contact data for anything other than showing it to you and performing the actions you request. Use of Google user data complies with the Google API Services User Data Policy, including its Limited Use requirements.
Deleting your data
Disconnecting an account immediately deletes its stored tokens and calendar records. You can also revoke Kalenda's access at any time from your Google account's security settings. You can delete your entire Kalenda account and all associated data at any time from within the app (account menu → Delete account) or by contacting us.
Contact
Questions or data requests: minkowicz.mendel@gmail.com