Calendox

Data Security at Calendox

Data Security

Last updated: October 1, 2026
This Data Security policy describes the technical and organizational measures Calendox uses to protect Your Personal Data and calendar information. By using our Service, You acknowledge the practices described in this policy.
Please read this policy alongside our Privacy Policy, which describes what data We collect, why, and for how long We keep it.

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Data Security policy:

  • Company (referred to as either “the Company”, “We”, “Us” or “Our” in this Agreement) refers to Danilix, the publisher of Calendox, established in Ajman, United Arab Emirates.
  • Country refers to: United Arab Emirates
  • Service refers to Calendox, the calendar synchronization platform that keeps your connected calendars up to date and helps you manage your schedule in one place.
  • Personal Data means any information that relates to an identified or identifiable individual.
  • Provider means a third-party calendar or meeting service You connect to the Service: Google, Microsoft, or Zoom.
  • Account means a unique account created for You to access our Service or parts of our Service.
  • You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Our Approach to Security

Calendox is built around a simple principle: We access only the calendar data needed to provide the sync and scheduling features You enable, We store as little of it as possible, and We protect what We do store with layered controls at every stage of a request — from authentication, through authorization and storage, to the connections We make with Your Providers.
This policy describes our security posture at the level appropriate for a public document. We deliberately do not publish the details of individual controls, tooling, or infrastructure, because doing so would help an attacker more than it would help You. Customers who need more detail for a security review can contact Us; We are happy to answer specific questions under a confidentiality agreement. While no method of transmission over the Internet or electronic storage is completely secure, We use commercially accepted standards and continuously review our practices to reduce risk.

Data Minimization

  • Your calendar event content — titles, descriptions, locations, attendees, and meeting passwords — is not stored in Calendox’s database. We display it by reading it live from Your connected Provider each time, and internally keep only a one-way, non-reversible fingerprint to detect whether an event has changed since the last sync.
  • We store only the metadata needed to run syncs and booking pages: calendar and event identifiers, start and end times, recurrence rules, sync state, and the booking details a booker submits directly to You.
  • We do not analyze, mine, or derive insights from the content of Your calendar events, and We do not use Your data for advertising or to train machine-learning models.
  • When You disconnect a calendar, remove a sync, or delete Your Account, the associated data is deleted automatically — including, for Business and Enterprise teams, calendar and directory data belonging to the team when it is deleted. The minimal records that survive deletion are listed in our Privacy Policy.

Encryption

  • Encryption in transit: all connections to the Service — from Your browser, from Your Providers, and between the components of the Service — are encrypted using modern TLS. Browsers are instructed to connect only over an encrypted channel.
  • Encryption at rest: the Service is hosted on Microsoft Azure, and all stored data is encrypted at rest at the storage layer.
  • Provider credentials: the OAuth access and refresh tokens issued by Google, Microsoft, and Zoom are additionally encrypted at the application layer before they are stored, using keys that are managed separately from the database. They are used only server-side and are never sent to Your browser, written to logs, or returned by any API response.

Authentication and Account Protection

  • Sign-in is passwordless: a one-time link sent to Your email, or sign-in with Google or Microsoft. There is no Calendox password for Us to store or for attackers to phish, steal, or reuse.
  • Sessions are held server-side. Your browser holds only an HTTP-only session cookie that references that session — never credentials, Provider tokens, or calendar data.
  • Every request to a protected part of the Service is independently verified on the server, so a compromised browser or network cannot bypass authentication.
  • When Your Account is used from a device We have not seen before, We email You so that You can act if the sign-in was not Yours.
  • Sensitive Account actions, such as deleting Your Account, require a fresh confirmation through Your email address.

Data Isolation and Access Control

Your syncs, calendars, and events are isolated per user at the database layer, so they can only be read or modified within the context of the user they belong to — or, for Enterprise Accounts, within Your Enterprise Account, which covers every tenant it connects. On a Business Account, this means the other members and the administrators of Your team cannot see them. This isolation is enforced by the database itself as well as by application code.
In addition, every resource You access — a sync, calendar, event, booking page, or team — is verified for ownership and for Your Account type’s entitlements on the server before any read or write occurs, and every request body is validated before it is processed.
Administrative access to production systems is restricted to the people who operate the Service, on a least-privilege basis, and production is kept separate from development and test environments with separate credentials for each.

Provider Access

  • Calendox connects to Your Providers only through OAuth, using the minimum set of permissions needed for the features You enable. The complete list of permissions is published in our documentation under OAuth Permissions, and We never ask for Your Provider password.
  • Change notifications from Your Providers are authenticated before they are processed, and duplicate or replayed notifications are ignored, so an unverified request cannot trigger changes to Your data.
  • Disconnecting a Provider deletes the stored tokens from Calendox immediately. You can also revoke Calendox’s access from Your Google, Microsoft, or Zoom account at any time.

Application and Platform Hardening

  • Industry-standard browser security headers are applied to every response to reduce the risk of clickjacking, content injection, and data leakage.
  • Sensitive operations and public surfaces are protected by rate limiting and, where appropriate, bot protection, to prevent abuse and automated attacks.
  • Secrets and credentials are never stored in source code. They are managed in a dedicated secret store and injected at runtime, separately for each environment.
  • Application logs are designed to exclude tokens, credentials, calendar event content, and payment details. Our error-monitoring tooling is configured to strip calendar content fields from server-side diagnostic reports, and any sampled session replays it captures mask all on-screen text and block media.
  • The managed platform We host on performs automated backups of the database, and We maintain procedures for restoring data and for rolling back a release.

Secure Development

We follow a documented secure development lifecycle. In practice this means:

  • Every change is reviewed and must pass automated checks before it is merged, and releases to production are made deliberately by a person, not automatically.
  • Third-party dependencies are monitored continuously for security advisories, with updates raised automatically for review.
  • New features that handle Personal Data receive a security review before release, and We periodically run automated security testing tools against the Service.
  • Security findings are prioritized and remediated according to their severity, with defined targets for each severity level.
Calendox does not currently hold a third-party security certification, and We do not claim one. The controls described on this page are what We actually operate.

Incident Response

We monitor the Service for errors and abnormal behaviour. If We become aware of a security incident that affects Your Personal Data, We will investigate it, contain it, and notify affected customers and any competent supervisory authority without undue delay, in accordance with applicable law, including a description of what happened and the steps You can take.

Reporting a Security Issue

If You believe You have found a security vulnerability in the Service, please report it responsibly rather than disclosing it publicly. We will acknowledge Your report within 2 Business Days, keep You informed of our progress, and work with You on coordinated disclosure. Please do not access other users’ data, disrupt the Service, or run automated scanners against production while researching.

Changes to This Policy

We may update this Data Security policy from time to time as our practices evolve. We will post any changes on this page and update the "Last updated" date above. We encourage You to review this policy periodically.

Contact Us

If you have any questions about this Data Security policy, You can contact us: