Callie
the missing Linux calendar
Privacy Policy
Summary
Callie is a desktop application that runs entirely on your computer. It has no servers, no accounts, no analytics, and no AI. It does not collect, transmit, or sell your data. Your calendar information travels between your computer and the calendar providers you choose to connect, and nowhere else. Two things reach other services, and you can turn either off: place search, which sends what you type as an event's place to a map search service, and a daily check for a new release, which asks GitHub for Callie's latest version. A problem report reaches one only when you send it.
What Callie accesses
When you connect a Google account, Callie requests access to your Google Calendar data so it can show and edit your events. Callie requests the narrowest permissions that allow it to function. It also reads your Google Calendar display settings, such as the day your week starts on, so Callie can match them; the names and email addresses of your Google contacts, the people you have been in touch with, and, for a Google Workspace account, your organization's directory, so it can suggest guests as you type them; and your Google profile photo, to show beside the account in Settings.
Microsoft accounts
When you connect an Outlook.com or Microsoft 365 account, Callie signs in through
Microsoft and asks for these permissions: Calendars.ReadWrite, to show and
edit your events and answer invitations; User.Read, for your address, name and
profile photo; People.Read, for the people you work with, so it can suggest
guests as you type them; and offline_access, so you stay signed in. Callie
talks to Microsoft Graph directly from your computer.
How that information is used
Calendar data is used only to display your calendar, create and modify events at your direction, and show reminders. Processing happens locally on your computer. Callie does not send your calendar data to us or to any third party, apart from the place text that place search, below, sends.
CalDAV accounts and subscriptions
When you connect a CalDAV account, such as Fastmail, iCloud or Nextcloud, Callie talks only to the server you name, over HTTPS, signing in with the user name and app password you give it. It reads and changes your calendars there as you direct, and sends the password to no one else. When you subscribe to a calendar by its link, Callie fetches that link about once an hour; the site behind it receives the request and, like any website, your IP address.
Place search
When you type an event's place, Callie suggests places from your own events, and, once the field holds three letters, asks Photon, an OpenStreetMap search service run by komoot, for matching places. Photon receives the text in the place field as you type, including any that was there before, and, like any website, your IP address. It receives nothing else, such as the event's title, times or guests. You can turn this off in Settings, under General, with "Search OpenStreetMap for places". Clicking an event's place opens it in the map app or website you choose there, which then receives the place.
Update checks
Once a day, the Callie app and the callie command ask GitHub for the version
number of Callie's latest release, so they can say when a newer one is out. GitHub
receives a request for that public information and, like any website, your IP address;
nothing about your calendars or accounts. You can turn this off in Settings, under
General, with "Say when a new release is out", or with
callie settings checkForUpdates false, or by setting
CALLIE_NO_UPDATE_CHECK in the environment. callie upgrade and
callie downgrade download a release from GitHub only when you run them.
Problem reports
"Report a problem" in the ? menu sends what you write, and the diagnostics if you leave them
included, to the Greylock Labs report service, which files it as a public issue in
Callie's GitHub repository, where
anyone can read it. Nothing is sent until you press Send, and "Show what is sent" shows the
diagnostics first. They hold Callie's version, your system, your accounts' kinds and sync
state, and the end of Callie's logs, with email addresses and your home folder's name masked;
logs hold event details only while "Log debug details" is on. The service runs on Cloudflare,
which receives the request and, like any website, your IP address. The service stores no
copy of the report beyond the issue it files, Cloudflare keeps its usual short-lived request
logs, and it allows a few reports a minute from one address. With
callie doctor --report, or if sending fails, the report opens on GitHub in your
browser instead, for you to check and submit yourself.
Package updates
If you install Callie with its installer, it adds the Greylock Labs package repository to
your system, so your package manager, dnf or apt, then checks
packages.greylocklabs.org for updates on its own schedule, as it does every
repository it knows. That site is static files on GitHub Pages: it receives your package
manager's requests and, like any website, your IP address, and nothing from Callie itself.
Removing the repository's file from /etc/yum.repos.d or
/etc/apt/sources.list.d stops it.
Where information is stored
- Calendar data is cached in your user directory, so the app works offline: Google calendars in a local database, and Outlook and CalDAV calendars, subscriptions and calendars on this computer as .ics files.
- Contact names and email addresses are cached in a file in your user directory, for guest suggestions.
- The address of a Google account's profile photo is kept in Callie's settings, and the photo is loaded from Google when shown; a Microsoft account's photo is saved in your user directory.
- Logs of what Callie did, such as syncs and their errors, are kept in your user directory. They never hold tokens, and hold event details only while "Log debug details" is on under Settings, Developer.
- Google and Microsoft sign-in tokens and CalDAV app passwords are stored in your system keyring through the Secret Service API, not in plain text.
- Nothing is stored on any server operated by Callie, because there is none.
How your data is protected
- Callie talks to Google and Microsoft directly from your computer, over HTTPS, so your data is encrypted on the way and passes through no server of ours.
- Signing in happens in your web browser, on Google's or Microsoft's own page; Callie never sees your password. The sign-in uses PKCE and returns only to Callie on your own computer.
- Sign-in tokens and app passwords are kept in your system keyring, which stores them encrypted, and never in plain text or in logs.
- Everything else Callie keeps, such as cached events and contact names, stays in your user directory on your computer. Apart from the place text that place search sends, none of it is copied anywhere else.
- Disconnecting an account deletes its cached data and its stored token.
No AI
Callie has no AI features and does not use, include, or connect to any artificial intelligence or machine learning service or model, whether run by another company or on your own computer. Nothing you keep in Callie, and no data from Google, Microsoft or any other account you connect, is sent to an AI service or used to develop, improve or train AI or machine learning models.
Google API Limited Use disclosure
Callie's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Callie does not transfer Google user data to third parties, does not use it for advertising, does not use it to build profiles, does not use it to develop, improve or train generalized AI or machine learning models, and does not allow humans to read it. The only exception is the place of an event you are editing, which place search sends to Photon while you type so it can suggest places, and which you can turn off, as described under Place search; and a problem report you choose to send, which goes to a public GitHub issue with what you see before sending, as described under Problem reports. Its diagnostics carry no event or contact details unless "Log debug details" is on.
Removing access
You can disconnect an account inside Callie at any time, which deletes its cached data
and its stored token from your keyring. You can also revoke Callie's access to your
Google account at
myaccount.google.com/permissions,
to a personal Microsoft account at
account.live.com/consent/Manage, and to
a work or school account at
myapps.microsoft.com.
Uninstalling Callie leaves its files in your user directory, as Linux packages do; delete
the callie folders in ~/.cache, ~/.config,
~/.local/share and ~/.local/state to remove them.
Children
Callie is not directed at children under 13 and does not knowingly collect their information.
Changes
If this policy changes, the updated version will be posted here with a new date. The history of this document is public in the Callie repository.
Contact
Questions can be sent to privacy@callieapp.org.