View as Markdown

What leaves your device

Calendite has no account, no sign-up, and no default cloud. Your calendar lives on your phone.

But "no account" isn't the same as "no network". This page is the complete list of everything the app can send anywhere, when, and to whom. It's written so you can check it rather than take our word for it.

The short version

Sends anything? When
Using the calendar normally No never
Creating, editing, deleting events No never
Alarms, reminders, notifications No never
Notes and descriptions No files on your device
Natural-language input No the models run on your phone
Address search Yes while you type in the location field
Map preview Yes when a location with coordinates is shown
Data source feeds Yes to the URL you configured
Calendar sharing, same network Yes phone to phone, direct
Calendar sharing, via relay Yes, encrypted only if you turn a relay on
Push wake-ups Yes, metadata only if a relay is configured

The two rows in bold are the ones people don't expect. Everything else is either nothing, or something you switched on.

The two you might not expect

Address search → photon.komoot.io

When you type into an event's location field, what you type is sent to Photon, an open-source geocoder over OpenStreetMap data, to be turned into suggestions. It's debounced (350 ms after you stop typing, minimum two characters), but it is still the text you're typing, as you type it.

Nothing else goes with it: no identity, no event details, no other field. Just the query and a Calendite/1.0 (Android) user agent.

Map preview → tiles.openfreemap.org

The little map under a picked address fetches its tiles, fonts and icons from OpenFreeMap. So that server sees the area you're looking at.

This happens even though the map's styling ships inside the app: the styling is local, the map data isn't.

To avoid both: don't use address search. Type a plain label into the location field instead. It saves perfectly well; you just get no suggestions and no map.

Both endpoints are defined in a single place, so a self-hosted geocoder or tile server can be swapped in.

The ones you switch on

Data source feeds

A feed fetches the URL you gave it. It goes where you pointed it, and nowhere else. Feeds refresh when you save one and when you bring the app to the foreground; there's no background polling.

Feed URLs are currently stored as plain text in the app's preferences, not in the platform keychain. Don't put a URL containing a secret token in one.

Calendar sharing

Off entirely until you pair with someone. Then:

On the same Wi-Fi: the two phones talk directly. No server is involved at any point. This is the default and the only way to pair in the first place.

Through a relay**: off by default. You choose it explicitly in Settings → Sync Server: the Calendite relay, your own deployment, or none. When on, it holds sealed blobs it cannot open, and only until the other phone collects them.

What a relay can see is traffic shape: that some mailbox received some data of some size at some time, plus 16-character device identifiers. It cannot see your events, titles, times, locations, notes, tags, the names you gave people, or any key.

Push wake-ups: only if a relay is configured. Google's or iOS push service learns that a given install was pinged, and when. No calendar content, not even ciphertext.

*Note: The relay is only available via our paid service after the app moves out of preview.

This is all encrypted though our encryption service for more details see. How the encryption works

What is never shared, even when sharing is on

  • Alerts and notes. Deliberately excluded. Your partner sees the event, not your reminders about it or what you wrote.
  • Anything created before you paired. It never travels, whatever the settings say.
  • Names you give people. Stored on your device only.
  • The details of a hidden event. Only the timing is encrypted under the shared key, so a modified client on the other end has nothing to reveal. It renders as "Busy" because that is all that was sent.

On-device, not cloud

Two things other calendars send to a server, Calendite doesn't:

  • Natural-language input. Typing "every other Tuesday except bank holidays" is parsed by models bundled with the app (about 57 MB of them). Your phrasing never leaves the phone, and it works offline.
  • Matching names to your own data. Working out that "karate days" means your Karate event is done by comparing on-device vectors against your own tags and events.

Limitations

  • Revocation and hiding protect the future. What a partner already synced is on their device.
  • Sharing is Android only for now.

Next