Privacy Policy

This is the reference copy

Your deployment’s actual privacy policy is served by your own instance at ${APP_BASE_URL}/privacy. It describes only what that deployment really does — a deployment without Google connected does not claim Google processing, and the retention section reflects the window you configured. This page describes the software with every optional feature enabled, for evaluation. Link the instance URL, not this one, from your OAuth consent screen.

For operators

calit is self-hosted: each deployment is run and controlled by whoever installs it, and that operator is the data controller for their instance. This page documents how the calit software handles data. Your instance serves its own policy, naming you through OPERATOR_NAME and PRIVACY_CONTACT_EMAIL; see the GDPR operator guide and Customising the legal pages. Review it against your own legal requirements before relying on it.

Last updated: 2026-10-17

What calit is

calit is open-source scheduling software you host yourself. It stores all data in a database you control. The maintainers of the project do not operate a central service, do not receive your data, and have no access to any deployment’s database.

Data calit stores

• Account data — your username, email address, display name, timezone, and an argon2id hash of your password (never the password itself).
• Scheduling data — your meeting types, availability rules, and the bookings made by invitees (invitee name, email, and any answers to custom booking questions you configure).
• Google account data — when the deployment has Google configured and you connect Google Calendar: the Google account’s email and stable subject identifier (from the OpenID id_token), and the OAuth access and refresh tokens. Tokens are encrypted at rest in the deployment’s database.
• CalDAV account data — when you connect a CalDAV calendar (optional): the server URL, your username, and the app password, which is encrypted at rest like Google tokens.

Booking details on the host’s calendar

When a host has connected a calendar account and selected a calendar to write bookings to, calit copies each booking to that calendar as an event. The event is stored by the host’s calendar provider — Google, or the CalDAV server the host connected. It carries:

• the title “meeting title with invitee name” and the booking’s description;
• the start and end time, and the meeting location (or a generated Google Meet link);
• the email addresses of the invitee, the host(s) and any active guests. On Google they are added as event attendees, so Google stores them and emails them invitations. On a CalDAV server they are written into the event description, and the server stores them.

If you book a meeting, your name, email address and these booking details are therefore stored by the host’s calendar provider as well as by calit. If you are a host, this is the copy on your own calendar. That copy is held under the provider’s own privacy policy and retention. calit deletes the event when the booking is cancelled or erased, but it cannot remove copies the provider keeps in its trash or backups. When a host deletes their account, calit cancels their upcoming bookings first, which deletes those events; events of past bookings remain on the provider’s calendar until the host removes them. No such event is created when the host has no connected calendar or no write calendar selected.

How CalDAV data is used

When you connect a CalDAV account, calit fetches the full event objects from the CalDAV calendars you select, within the booking window. It uses only their times to compute busy intervals and discards the rest: the content of events calit reads is never stored. When bookings are made, rescheduled, or cancelled, calit creates, updates, and deletes the event on the calendar you chose as write target; that event carries the booking details listed above.

How Google user data is used (when Google is configured)

When you connect a Google account, calit requests the Google Calendar scope and uses it only to provide scheduling:

• Read free/busy information from the calendars you select, to compute which time slots are available.
• Create, update, and delete events on the single write-target calendar you choose, when bookings are made, rescheduled, or cancelled.

calit does not read the content of your calendar events beyond busy intervals (the events calit writes for bookings carry the booking details listed above), and does not use Google data for advertising, profiling, or any purpose other than the scheduling features you initiated.

Limited Use disclosure

calit’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not sold, not transferred to third parties except as needed to provide the scheduling features, not used for advertising, and not read by humans except where required for security, to comply with law, or with your explicit consent.

Data sharing

calit does not sell or share your data. A deployment sends data only to the services its operator has configured, and its own /privacy page lists exactly which ones:

• The CalDAV server you connect, if you connect one, for the calendar operations above, including the booking details copied to your calendar.
• Google (when configured), for the calendar operations above, including the booking details copied to your calendar.
• A single sign-on identity provider (when configured), when you sign in with it.
• The SMTP server the operator configures, which delivers booking and notification emails.
• Chat or push services (when a host has configured notification channels, for example Telegram, Slack, Discord or ntfy). Messages already delivered there cannot be recalled.
• Cloudflare Turnstile (when configured), which checks booking requests for abuse.

Retention and deletion

• Disconnecting a calendar account in Settings → Calendars (/me/calendars) deletes its stored credentials and calendar selections from the site. For Google this does not withdraw the grant at Google — revoke calit’s access in your Google account to do that.
• Deleting your account at Settings → Delete my account (/me/settings/delete) removes your account, settings, meeting types, availability, bookings, connected calendar accounts and notification channels. It does not revoke the grant at Google either.
• A hash of a deleted account’s username is kept permanently, so that name can never be re-registered and used to take over a stale login.
• If you booked a meeting, the manage link in your confirmation email lets you download your data or erase it from that booking. Bookings are not linked to each other by email address, so erasure reaches only the booking whose manage link you used. An operator may turn self-service erasure off; the instance then tells you whom to contact instead.
• Booking details are anonymised a set number of days after the meeting ends (when the operator or host has configured a retention window). Without one, bookings are kept until removed by the host or the operator.
• Emails queued for sending are deleted about 30 days after they are sent (or after they were queued, if never sent). Password-reset, invitation and sign-in tokens are deleted about a day after they expire.

Security

Passwords are hashed with argon2id; Google OAuth tokens and CalDAV app passwords are encrypted at rest. Production deployments run behind TLS with secure cookies. The operator is responsible for securing the host and database.

Contact

For questions about a specific deployment, contact that deployment’s operator. For questions about the calit software itself, open an issue at github.com/asm0dey/calit.