Last updated: October 14, 2026
MiCal ("we," "our," or "us") is a calendar bridging service that connects multiple calendar providers to help you synchronize events and manage scheduling. We take your privacy seriously. This policy explains what data we collect, how we use it, and how we protect it.
Account Information: When you sign up via Google or Microsoft OAuth, we receive your email address, name, and profile information from the provider. We use this to create your account and identify you.
Calendar Data: With your explicit permission, we access calendar event metadata (titles, times, locations, attendees) to perform synchronization. We do not read the content of event descriptions unless necessary for sync operations.
Contacts: With your explicit permission, MiCal reads your Google Contacts and "Other contacts" (via the Google People API) and your Microsoft contacts (via Microsoft Graph) solely to suggest email addresses when you are sending an invitation — for meeting polls, family/team group invites, and booking-page recipients. Contacts are fetched fresh from the provider on demand each time you open a recipient picker and are returned to your browser for autocomplete only. MiCal servers do not store or persist your contact data, it is never shared with third parties, and it is never used to train AI/ML models. Access ends when you click Disconnect on the account in MiCal (which also revokes it at Google), or when you revoke it at myaccount.google.com/permissions.
OAuth Tokens: We store encrypted refresh and access tokens for connecting to your calendar providers. These are encrypted at rest using AES-256-GCM encryption.
Usage Data: We collect basic operational data such as sync run logs, error reports, and API request timestamps to maintain service reliability.
We do not sell your data. We do not use your calendar data for advertising. We do not train AI models on your data.
Your data is stored in Turso (libSQL) databases with encryption at rest. OAuth tokens are encrypted with AES-256-GCM using keys stored separately from the database. Sessions are secured with HMAC-signed cookies.
All data transmission occurs over TLS (HTTPS). We use timing-safe comparisons for authentication checks.
If you connect a Google account, MiCal requests these Google permissions and uses them only as described:
MiCal's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, MiCal does not use Google user data for advertising, does not sell it, does not use it to train AI or machine-learning models, and does not let people read it except with your consent, for security, to comply with the law, or in aggregated, anonymized form for operations.
We share your data only in these cases:
We never sell your data or share it with advertisers or data brokers. Microsoft data (Outlook Calendar and Contacts) is handled the same way as Google data.
You may remove calendars from MiCal at any time; removing a calendar stops MiCal reading or writing it. Disconnecting an account removes its calendars and deletes its stored access tokens. You may also revoke MiCal's access in your Google or Microsoft account settings, delete your account, or request a copy of your data at any time by contacting us.
MiCal is not directed to children under 13 and we do not knowingly collect data from them.
If we change this policy, we will update the date at the top of this page and, for significant changes, notify you by email.
For privacy questions or data requests, contact: privacy@mical.net