Privacy Policy for ExCalendar

1. Introduction

ExCalendar ("we", "our", or "the Application") is a Windows desktop calendar widget developed by Expeditise LLC. This Privacy Policy explains how we collect, use, store, and protect your information when you use ExCalendar.

By using ExCalendar, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Calendar Data

When you connect your accounts to ExCalendar, we access the following information:

• Google Calendar: Event titles, descriptions, start/end times, locations, attendees, and calendar metadata
• Outlook/Microsoft Calendar: Event titles, descriptions, start/end times, locations, attendees, and calendar metadata
• Account Information: Your email address from connected accounts (used solely for authentication)

2.2 AI Feature Data (Optional)

If you enable AI features and provide your own OpenAI API key:

• Event Text: Natural language text you input for event creation
• Images: Images you paste or drop for AI processing (converted to text)
• Calendar Context: Limited calendar data sent to OpenAI for smart scheduling (event titles and times only, never confidential details)
• API Key: Your OpenAI API key (encrypted and stored locally in Windows Credential Manager)

2.3 Calendar Sharing Data (Optional)

If you enable calendar sharing:

• Availability Slots: Only free/busy time blocks (no event details like titles or descriptions)
• Time Zone: Your preferred time zone for display purposes
• Share Settings: Optional access controls (PIN/password) you configure

2.4 Application Settings

We store local preferences including:

• Widget position and size on your desktop
• Selected theme and opacity settings
• Refresh interval preferences
• Which calendars you've chosen to display

3. How We Use Your Information

Your information is used exclusively for the following purposes:

• Display Calendar Events: To show your upcoming events in the desktop widget
• Sync with Calendar Services: To retrieve and update your calendar information from Google Calendar and Outlook in real-time
• AI Event Creation: To process natural language and generate calendar events (using your own OpenAI API key)
• Calendar Sharing: To share free/busy availability via secure links (data stored temporarily on Cloudflare)
• Meeting Requests: To send and receive meeting invitations via email
• Offline Access: To cache events locally so you can view them without an internet connection
• Personalization: To remember your preferences and settings for the best user experience

We do NOT:

• Sell, rent, or share your data with third parties
• Use your data for advertising or marketing purposes
• Analyze your calendar content for any purpose other than displaying it to you
• Store your data on remote servers (all data is stored locally on your device)

4. How We Store and Protect Your Information

4.1 Local Storage

All your data is stored locally on your Windows computer in the following locations:

• Event Cache: SQLite database at %AppData%\ExCalendar\calendar_cache.db
• Settings: JSON file at %AppData%\ExCalendar\settings.json
• OAuth Tokens: Windows Credential Manager (DPAPI encrypted)

4.2 Security Measures

We implement industry-standard security practices:

• Encrypted Storage: OAuth tokens are encrypted using Windows DPAPI (Data Protection API)
• Read-Only Access: We only request calendar.readonly scope - we cannot modify your calendar
• HTTPS Communication: All communication with Google and Microsoft servers uses secure HTTPS connections
• No Third-Party Services: We don't use external analytics or crash reporting services
• Optional AI Processing: AI features require your own OpenAI API key - we never send data to AI services without your explicit consent and API key

4.3 Calendar Sharing

When you enable calendar sharing:

• Cloudflare Infrastructure: Free/busy data is temporarily stored on Cloudflare Workers and KV for public link access
• Privacy-First: Only time blocks are shared, never event titles, descriptions, or attendee information
• User Control: You can regenerate or revoke share links at any time
• Optional Protection: Add PIN/password protection to restrict access to your availability

5. AI Features and OpenAI API

ExCalendar offers optional AI-powered features that require your own OpenAI API key:

5.1 How AI Features Work

• You provide and manage your own OpenAI API key
• AI processing happens via OpenAI's servers (not ours)
• You control what data is sent for AI processing
• Minimal calendar context is shared (event titles/times only, never confidential meeting content)

5.2 Data Sent to OpenAI

When you use AI features, the following may be sent to OpenAI:

• Text you type for natural language event creation
• Images you paste or drop (converted to text via OCR)
• Limited calendar context for smart scheduling (dates, times, event titles only)

5.3 Your Responsibilities

• OpenAI's privacy policy applies to data processed through their API (OpenAI Privacy Policy)
• API usage costs are your responsibility
• You can disable AI features at any time in settings

6. Google and Microsoft API Services

6.1 Google Calendar API

ExCalendar's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6.2 Microsoft Graph API

When connecting Outlook/Microsoft Calendar, we comply with Microsoft's data handling requirements and the Microsoft Privacy Statement.

For both services:

• We only access the minimum data necessary to provide calendar display functionality
• We do not transfer your Google data to third parties
• We do not use your data for serving advertisements
• We do not allow humans to read your data unless required for security purposes or with your explicit consent