Data Security
What data Calendox stores and never stores, how it is encrypted and isolated per account, and how long each kind of record is retained after deletion.
Calendox stores only the metadata needed to run sync and bookings — never the content of your calendar events — and protects it with encryption in transit and at rest, plus database-level isolation between accounts. This page details what is stored, how it's protected, and how long it's kept. For the posture summary, see How Calendox Protects Your Data.
What data does Calendox store?
Calendox stores the minimum data required to operate the sync service:
| Data | Purpose |
|---|---|
| Calendar metadata (IDs, names, provider) | Identify which calendars are part of a sync |
| Event metadata (event ID, iCalUID, sync state, a one-way content fingerprint) | Track which events have been synced and detect whether one has actually changed, without storing its content |
| OAuth tokens (server-side only) | Maintain calendar access without requiring you to re-authorize |
| Account profile (email, name) | Identify your account in the Calendox interface |
| Booking records (booker name, email, timezone, optional guests, answers, topic, meeting time and link, booking status and lifecycle metadata, a hashed manage-link token) | Operate booking pages: show your bookings, send confirmations/reminders, let the booker reschedule or cancel |
Calendox does not store the content of your calendar events — titles, descriptions, locations, and meeting passwords are never written to our database. For recurring events, Calendox stores only a one-way cryptographic hash of an event's content, used solely to detect whether it has changed since the last sync; the hash cannot be reversed to recover the original text. Your event titles, descriptions, and locations are read live from Google or Microsoft each time they're displayed in the Unified Calendar.
Booking records are different in kind: they are information the booker submits directly to you through your booking page — not calendar content read from your providers. The calendar event created for a booking, subject line included, lives on your provider calendar like any other event; Calendox stores only the booking record itself — the details the booker submitted plus scheduling and lifecycle metadata — never your calendar contents. The public booking page itself never exposes your calendar contents — bookers see only computed free/busy slots, never event titles, attendees, or details.
Encryption
- All data in transit is protected by TLS 1.2 or higher.
- The Calendox database is hosted on Azure, which encrypts data at rest at the storage layer.
- OAuth access and refresh tokens are stored server-side only. They are never sent to or exposed in your browser, included in logs, or returned by any API response.
Access controls
- Calendox uses row-level security enforced at the database layer, so every database query is scoped to the authenticated user, or to the tenant for Business/Enterprise accounts — a user cannot read or write another user's data through the application, even if application code has a bug.
How long is data retained?
- Your calendar data and sync configuration are retained as long as your Calendox account is active.
- When you delete your Calendox account, your subscription is cancelled, your connected calendars are removed, and your account record is deleted as part of that process — including calendars and directory data belonging to a Business or Enterprise team when the team itself is deleted.
- Calendox retains a minimal record linking your email address (and any calendar provider accounts you connected) to free-trial usage after account deletion, for as long as necessary to prevent re-using the free trial by deleting and re-creating an account. See Plans and billing.
- Records of devices used to sign in (kept to alert you to new sign-ins) are removed after 180 days of inactivity.
- Booking records are deleted when the booking page they belong to is deleted — deleting a page deletes its booking history. Deleting your account deletes all of your booking pages and their records.
- The manage links bookers use to reschedule or cancel are stored only as one-way cryptographic hashes, so a manage URL cannot be recovered from the database.
- OAuth tokens are deleted from Calendox immediately when you disconnect a calendar provider or delete your account. This removes Calendox's stored copy of the token; it does not revoke the token on the provider's side — see Revoking access to fully remove Calendox's access from your Google, Microsoft, or Zoom account.
Compliance
Calendox is hosted on Microsoft Azure. For detailed compliance and privacy information, see our Privacy Policy and the Data Security statement.
Vulnerability disclosure
To report a security vulnerability, email security@calendox.com. Do not disclose vulnerabilities publicly until they have been resolved.
Next steps
- How Calendox Protects Your Data — the security posture at a glance
- OAuth Permissions — every scope requested and how to revoke access
- What is Bookings? — what public booking pages do and don't expose