Is your calendar data private? What SaaS tools know about you

You signed up for a calendar sync tool to stop getting double-booked. You connected your work and personal accounts, set up a few rules, and it works.

Now ask what you handed over. Can that company see your doctor's appointments, your confidential board meetings, your kid's school pickups?

A calendar says a lot about a person. Health, money, career moves and relationships all show up in it. Giving a company access to it is a big decision, and plenty of SaaS companies are vague about what they do with it.

This post covers what calendar tools can read, what they keep, and how to check one before you connect it.

The price of "free": how data becomes the product

Plenty of online services are free because they make money from your data. They collect it, analyze it and sell what they learn to advertisers. Social media runs on this model, and productivity tools can too.

A tool that reads every event on your calendar can learn a lot:

Which doctors you see.
That you meet a "Financial Advisor" every quarter.
That you have an interview with a competitor next Tuesday.
That Thursday is "Date Night."

Data brokers and advertisers pay for exactly this kind of detail. A shady company could sell it or use it to target ads at you. A well-meaning company still takes on risk just by storing it. If their database leaks, your schedule leaks with it.

OAuth: the handshake that grants access

When you connect a calendar tool, Google or Microsoft shows you a pop-up asking whether to grant access. That's OAuth. You give the tool specific permissions, and it never sees your password.

Read that screen. It lists exactly what the app wants. A calendar sync tool usually asks for:

Read access to your calendars, so it can see what to sync.
Write access to your calendars, so it can create "Busy" blocks on the other ones.
Your name and email address.

If a sync tool asks for more, ask why. It has no reason to read your email or your contacts.

The big question: what do they store?

After you grant access, the tool can read your events. What it does with them next is where privacy-first tools and the rest part ways.

The standard approach: store everything

A tool that copies full events into its own database may keep:

Event titles (Project X-Ray - Confidential Debrief)
Attendees, with names and email addresses
Descriptions and notes, which often hold agendas, addresses and personal reminders
Video call links

Developers do this because it's easier. Working with your own copy of the data is simpler than fetching it each time.

The cost lands on you. That database now holds a detailed record of your life. A breach exposes all of it, and even without one, the company's staff could look at it.

The privacy-first approach: store as little as possible

A privacy-first tool like Caltsu follows the principle of least privilege. It reads and keeps only what the job needs.

Caltsu reads each event when Google or Microsoft reports a change. It writes a block with the start and end time, the word Busy and the source calendar's name. It stores the event ID and a change fingerprint built from the title and times. It doesn't store the description, attendees, location or meeting link.

That's harder to build, and we think it's the right call. The title inside the fingerprint is there only to notice edits, and Caltsu never writes it to another calendar. The security page lists every field Caltsu reads and keeps.

How to check your calendar tool's privacy

Three things to look at before you connect a calendar:

Read the privacy policy. It's boring, so search it. Look for "event data", "attendees" and "event descriptions". Check whether they sell data or use it for ads. A good policy says plainly what they don't store.
Look at how the company talks about privacy. A company with a strong privacy model will say so on its website and explain the details.
Check the OAuth permissions. Read the screen when you sign up. If the list looks long for a calendar tool, it probably is.

Your calendar is your life story. Protect it.

Nobody else is going to check this for you. Pick a sync tool that works and that you trust with your calendar.

You don't have to give up privacy to stop double-booking. Choose a tool that keeps as little of your data as it can, and your schedule stays yours.