DeckCal Privacy Policy

Effective date: 14 August 2026

DeckCal is an open source Stream Deck plugin that turns a key into a live countdown to your next Google Calendar meeting. It reads your calendar to show this information. It never modifies your calendar. The plugin runs entirely on your own computer. The developer operates no servers and collects no data.

Google user data the app accesses

With your permission, DeckCal accesses your Google Calendar data on a read-only basis, using the https://www.googleapis.com/auth/calendar.readonly scope. This is the only Google scope the plugin requests. It allows the plugin to read your events. It does not allow the plugin to create, change, or delete any calendar data.

How the data is used

Your calendar data is used solely to display meeting information on your Stream Deck keys. It shows:

• A countdown to your next meeting, and the time remaining in a meeting you are currently in.
• A progress bar and the visual state of the upcoming or ongoing meeting.
• Details of the next or ongoing meeting (such as its title and join link) so you can open or join it.

The data is not used for any other purpose.

How the data is stored and handled

DeckCal has no backend. There is no server operated by the developer. OAuth tokens are stored locally on your own computer, inside Stream Deck's plugin settings, and the calendar events the plugin fetches are kept only in the plugin's memory while it runs. No data is ever sent to, or stored on, any server operated by the developer.

Your data is not shared with, transferred to, or disclosed to any third party. The plugin contains no analytics and no tracking.

DeckCal does not sell your Google user data. It does not transfer it to data brokers or information resellers, does not use it for advertising of any kind (including targeted, personalised, or retargeted advertising), does not use it to determine credit-worthiness or for lending purposes, and does not use it to train or improve any generalised artificial intelligence or machine learning model. No human, including the developer, ever reads your calendar data: it never leaves your computer, so there is nothing for anyone else to read.

How the data is protected

Calendar events are sensitive data. DeckCal touches as little of them as it can, for as short a time as it can.

• In transit: all communication with Google is over HTTPS (TLS), using Google's official @googleapis/calendar and google-auth-library client libraries. The plugin sends calendar data nowhere else.
• At rest: OAuth tokens are written only to Stream Deck's own settings storage in your user account on your computer, protected by your operating system's user account and file permissions, and by full disk encryption if you have it enabled (FileVault on macOS, BitLocker on Windows). Fetched calendar events are held in memory only and are discarded when the plugin stops. The one exception is the opaque event ID of an alert you have dismissed, which is kept locally so the same meeting does not alert you twice, and is deleted as soon as that event leaves the plugin's time window.
• Access control: only the read-only calendar scope is requested, so the plugin cannot create, change, or delete anything in your Google account. Sign-in uses the OAuth 2.0 authorization code flow with PKCE against a short-lived local loopback listener, so your Google password is never seen by the plugin and the authorization code cannot be intercepted and reused. Only you, signed in to your own computer, can see the data on your Stream Deck.
• Minimisation: the plugin requests only events inside a short window around the present time, and only from the calendars you explicitly select. Its local log file records event counts and error messages; no event titles, attendees, or meeting links are ever written to it.
• Development practices: DeckCal is open source, so all of the above is publicly auditable at github.com/ewels/DeckCal. Dependencies are kept up to date and monitored for security advisories, and every change runs through automated linting, type checking, and tests before release.

No system is perfectly secure. If you find a security issue in DeckCal, please report it privately using the contact details below rather than opening a public issue.

Data retention, deletion, and revoking access

All data is stored locally, so you stay in control of it. Sign out within the plugin at any time to remove the stored tokens from your computer. You can also revoke DeckCal's access to your Google account at any time from your Google Account permissions page: https://myaccount.google.com/permissions.

Limited Use disclosure

DeckCal's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Changes to this policy

This policy may be updated as the plugin changes. The effective date at the top of this page tracks the current version, and every revision is public in the plugin's GitHub repository. If DeckCal ever changes how it uses your Google user data, that change will be described here and in the release notes, before the version making it is released.

Contact

If you have any questions about this privacy policy, please contact the developer, Phil Ewels, at ewelsphil@gmail.com.