Security, stated plainly

Payments never touch our servers

All payments run on Stripe. Checkout happens on Stripe's hosted pages, card numbers go directly to Stripe, and Calendary stores only the booking's payment status and Stripe's reference IDs. Your clients pay into your own Stripe account (Stripe Connect); we never hold your funds.

Sign-in is handled by Google's identity platform

Accounts run on Firebase Authentication, Google's managed identity service: Google, Microsoft, and Apple sign-in, plus email with confirmation codes. Passwords are never stored or seen by Calendary itself. Account deletion is password-gated and cancels any active subscription.

Your data is locked down by rules, not habits

Data lives in Google Cloud Firestore. Access is enforced by deployed security rules: only you can write your profile, events, and schedule, and sensitive records (calendar tokens, bookings, payment references) are readable only by our server code, never directly by other users. Plan and billing state can only be changed by our payment webhooks, not from a browser.

Calendar access stays narrow

When you connect Google or Outlook, Calendary reads free/busy times to prevent double-booking and creates the booking events it makes. OAuth tokens are stored server-side, are never exposed to the browser, and connections can be revoked in Settings (or from your Google/Microsoft account) at any time.

In transit and at rest

All traffic is TLS-encrypted (HTTPS with HSTS). Data at rest is encrypted by Google Cloud's infrastructure defaults.

Analytics without surveillance

Visitor analytics are first-party and cookie-light: no third-party trackers, no ad pixels. Per-visit detail (used by the Insights plan) is kept for 90 days and only for visitors who accepted analytics cookies. Full details are in the privacy policy.

Reporting a vulnerability

Found something? Email cx@thecalendary.com with steps to reproduce. We read every report and respond to genuine findings.