How Calendox Protects Your Data

How Calendox protects your data: no event content stored, OAuth-only access with no passwords, per-account isolation, and encryption in transit and at rest.

Calendox is designed to know as little about you as possible: it never stores the content of your calendar events, connects to your calendars only through OAuth — never a password — and isolates and encrypts the little it does store. This page summarizes that posture; the pages linked below cover each area in detail.

Security at a glance

Area	What Calendox does
Event content	Never stored — titles, descriptions, locations, and meeting passwords are never written to the Calendox database
Change detection	A one-way content fingerprint that cannot be reversed to recover the original text
Calendar access	OAuth 2.0 with scoped, provider-issued tokens stored server-side only — Calendox never sees your Google or Microsoft password
Sign-in	Passwordless — magic links or Google/Microsoft sign-in; there is no Calendox password to phish or reuse
Account isolation	Isolated per account at the database layer — on a Business account, per member
Encryption	TLS 1.2 or higher in transit; encrypted at rest at the storage layer
Hosting	Microsoft Azure

Does Calendox store my calendar events?

No. Calendox stores only the metadata needed to run the sync service — calendar and event identifiers, start and end times, recurrence rules, and sync state. The content of your events — titles, descriptions, locations, and meeting passwords — is never written to our database. To detect whether an event has changed since the last sync, Calendox keeps only a one-way content fingerprint that cannot be reversed to recover the original text; event details shown in the Unified Calendar are read live from Google or Microsoft each time.

Calendar data is never sold, never used for advertising, and never used to train machine-learning or AI models — see the Privacy Policy.

Booking pages follow the same principle: visitors see only computed free/busy slots — never event titles, attendees, or any other calendar contents.

See Data Security for exactly what is stored and for how long.

How does Calendox access my calendars?

Through OAuth 2.0 only. You authorize Calendox on Google's or Microsoft's own consent screen, and Calendox receives a scoped token in return — it never sees or stores your provider password, and you can revoke access from your provider account at any time. Tokens are stored server-side only and are never exposed to your browser, included in logs, or returned by any API response. The complete scope list, and why each scope is needed, is on OAuth Permissions.

Signing in to Calendox itself is passwordless too — magic links or Google/Microsoft sign-in — so there is no Calendox password to store, leak, or reuse.

How is my data isolated and encrypted?

Calendox isolates data per user at the database layer: your syncs, calendars, and events can be read or changed only on your behalf — or, on an Enterprise account, within that account, across every tenant it connects. On a Business account, other members and the admins of your team cannot see them. The isolation is enforced by the database itself as well as by application code.

All data in transit is protected by TLS 1.2 or higher. Calendox is hosted on Microsoft Azure, and the database encrypts data at rest at the storage layer.

Learn more

Data Security — storage, encryption, retention, and deletion in detail
OAuth Permissions — every scope requested from Google, Microsoft, and Zoom, and how to revoke access
Privacy Policy and the Data Security statement — the formal policies
Vulnerability disclosure — how to report a security issue