Privacy Policy

Information we collect

• Account details: your name, email address, and password. Passwords are stored only as a secure one-way hash; we never see or store the password itself.
• Calendar content you create: events, assignments, notes, locations, tags, and the invites and RSVP status you manage in the app.
• Linked inbox addresses: the email addresses you choose to link, and when you linked them.
• Security information: if you turn on two-step verification, an encrypted authenticator secret and backup codes. We also record your IP address and browser type for each signed-in session so you can review devices and we can detect abuse.
• Abuse-prevention data: short-lived counters tied to your IP address that limit repeated sign-in and password-reset attempts.

Voice input

When you add an event by voice, speech-to-text is performed by your web browser's built-in speech recognition, not by OneCal. Depending on your browser, your audio may be processed by the browser maker (for example, Google for Chrome or Apple for Safari) under their own privacy policies. OneCal receives only the resulting text, and only stores it if you save the event.

How we use your information

• To create and secure your account, including email confirmation, password resets, and two-step verification.
• To show, organize, and remind you about your events and invites.
• To send essential service emails, such as confirmation links and password reset links. We do not send marketing email.
• To protect OneCal and its users from fraud, abuse, and unauthorized access.

Password breach checks

When you create or change a password, we check whether it has appeared in a known data breach using the Have I Been Pwned service. Only the first five characters of a one-way hash of your password are sent, so neither the service nor anyone else can learn your password from this check.

Service providers

We share information only with the providers we need to run OneCal:

• Vercel hosts the app and processes web requests.
• Neon stores our database.
• Resend delivers account emails to your email address.
• Have I Been Pwned receives the partial password hash described above.

These providers may process data in the United States and other countries. We may also disclose information if required by law or to protect the rights and safety of our users.

Cookies

We use only the cookies needed to keep you signed in and to complete two-step verification. We do not use advertising or cross-site tracking cookies.

Retention and deletion

We keep your information for as long as you have an account. You can delete your account at any time from Account & security → Delete my account. This immediately and permanently removes your account, events, invites, linked inboxes, and settings. Copies may remain in encrypted database backups for up to 30 days before they are overwritten. Unconfirmed accounts may be removed automatically.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can update or delete most information directly in the app. For anything else, contact us at support@realcal.one. We will respond within 30 days.

Security

We protect your information with encrypted connections, hashed passwords, optional two-step verification, per-account data separation, and limits on repeated login attempts. No system is perfectly secure, so we recommend using a unique password and turning on two-step verification.

Children

OneCal is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, contact us and we will delete it.

Changes and contact

If we make material changes to this policy, we will update the effective date above and notify you by email or in the app. Questions? Email us at support@realcal.one.