Your data.
Clearly explained.

1. Service and scope

FAI Calendar Read Only is a private calendar-viewing service for explicitly authorised household members. It reads Google Calendar data to display an agenda. It does not create, edit or delete Google Calendar events.

For privacy questions or requests, use the established private family channel through which access to this service was arranged. Ask the service operator about FAI Calendar Read Only. These information pages do not provide a contact form, inbox, account connection or privacy-request endpoint.

2. Google permissions and account selection

The calendar connection requests these two permissions:

Read the list of calendars

https://www.googleapis.com/auth/calendar.calendarlist.readonly

Read calendar events

https://www.googleapis.com/auth/calendar.events.readonly

Google’s grant is broader than the app’s selected-calendar allowlist. It may permit reading calendar metadata and events outside that allowlist. The operator explicitly selects the connected account and calendars; the server checks the allowlist and each viewer’s access before fetching events or returning an agenda.

Available calendar names, identifiers and access roles are read during owner onboarding so the selection can be made. Calendar metadata is also checked when validating access. Unselected calendars are not used to fetch events.

Family-app login uses separate Google sign-in permissions, openid email, to verify identity. Signing in does not itself connect a calendar or grant calendar visibility.

3. Data we handle

• Calendar connection: account and primary-calendar identifiers, which may include an account email address; calendar identifiers and labels; permissions; local account/viewer mappings; and access and refresh tokens.
• Agenda requests: selected calendars, requested dates, event identifiers, titles, start/end dates or times, time zones, recurrence identifiers, event status and visibility. Google supplies expanded recurring instances. Cancelled instances are omitted and provider-redacted details are not disclosed.
• Sign-in and membership: a validated Google account identifier and issuer, local viewer and household mapping, enabled status, language, region and time-zone settings. Google sign-in can also return an email address.
• Explicit enrollment: when an operator enables enrollment, the latest verified unmapped identity, timestamp and verified email, when supplied, may be saved for manual review. This record grants no access and is not automatically deleted when enrollment is turned off.
• Preferences and sessions: saved language choice, temporary login state, a session identifier and security values. Calendar consent and browser sessions are separate.
• Operations: lifecycle/health timestamps and enumerated results. Operator-maintained activation and recovery records can include local process and configuration metadata.

The event query requests a limited set of fields; event descriptions, attendees and attachments are not requested. Calendar visibility checks can return additional calendar metadata, which is processed to validate access. Event results are handled in memory for the request and are not written to an event database.

4. Purpose, sharing and Limited Use

We use Google data only to provide the disclosed calendar-viewing service: authenticate approved viewers, enforce calendar permissions, display the requested agenda and remember language preferences. Authorised viewers receive only the agenda permitted by their local access mappings and Google access.

We do not sell Google data, use it for advertising or use it to train AI models. This calendar-viewing release performs no AI processing and does not send calendar data to AI services. There is no advertising or calendar-data analytics integration.

Human access to Google data is restricted to support with your specific affirmative permission, necessary security investigation, or another applicable exception allowed by Limited Use requirements. These are operating restrictions adopted for this service, not a claim that an independent audit has established every past human practice.

FAI Calendar Read Only’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

Google processes authentication, consent and Calendar API requests under its own policies. Private access infrastructure processes connections and associated network metadata. These static information pages do not receive calendar data.

5. Storage and retention

Account and calendar-connection records are retained while connected. After a verified removal request, the relevant records are removed manually within the verified scope, while protecting other viewers’ or shared records. The implementation has no automatic deletion endpoint or age-based purge for these records. Disconnection, grant expiry or revocation does not by itself erase stored records.

Calendar credentials and bindings are held in private server files. Membership and optional enrollment records use a separate profile store; language preferences use a local database. Relevant membership, preferences and enrollment records are included in the scope review of a verified removal request.

Privacy-case records are retained while a request is being handled. After closure, they are retained for 90 days and then manually removed. This is a manual operating commitment, not a scheduled purge implemented by the application.

Sign-in does not persist a login refresh token, and its returned access token is discarded. Login flows last up to five minutes and sessions expire after fifteen minutes. Flow/session state is held in process memory; expired entries are pruned as requests are handled. A restart clears sessions. Signing out invalidates the current session and clears its cookie; it does not revoke the separate calendar grant.

Event results are processed for a request, without an event database or cross-request event cache in the viewer. No-store response instructions do not guarantee erasure from Google, browser or operating-system memory.

Managed lifecycle logs rotate by size, keeping a current file and two archives without automatic age-based expiry. Operator-maintained recovery records and earlier copies may remain separately and must be considered when reviewing a privacy request; they are not all subject to the privacy-case retention rule.

Existing backups are unchanged. Retained backup and other copies may remain under their existing retention arrangements. We do not promise immediate removal from every copy or invent a backup purge schedule. A response will distinguish active-record removal from remaining or unconfirmed retained copies. Recovery must reapply verified access/removal decisions before restoring viewer access.

6. Configured security and bounded validation

Google requests use HTTPS. Private viewer access requires HTTPS and verified sign-in, explicit local membership and server-side calendar visibility. Essential security cookies use Secure, HttpOnly and SameSite protections. Calendar responses instruct no-store.

Private directories and files use operating-system access restrictions; the app adds no encryption of those local files at rest. The active managed pilot is configured to discard raw application stdout/stderr. Its lifecycle logger accepts only timestamps, enumerated events and results. Those settings and a bounded startup/restart/logging trial were checked, with owner-reported browser confirmation. They do not certify infrastructure logging or every human practice.

Local access bindings are revalidated before returning results. Google permission checks are sequential network operations, not an atomic Google-side permission snapshot. These implementation measures do not guarantee absolute security.

7. Privacy requests, revocation and deletion

Use the established private family channel through which access to FAI Calendar Read Only was arranged. Ask the service operator to review, correct or remove relevant local records or disable access. We acknowledge requests within 7 days and provide a response or a plan within 30 days. These are manual operating commitments; the website has no form, inbox or automated request/deletion feature.

The operator verifies the requester and authority through the established private relationship and existing access mapping. An email sender address alone is insufficient. The request scope, account ownership and effects on shared records are checked before manual removal. Do not send passwords, OAuth codes, tokens or calendar contents with a request.

The operator inventories relevant active records and retained copies, plans scoped changes, and records what was removed or disabled and what remains. Necessary live maintenance or Google-side changes are separately controlled. If further work is needed, the response or plan identifies the remaining steps and retained-copy limitations rather than promising that all data has already been erased.

You can sign out. The calendar account owner can also review or revoke app access through Google Account third-party connections. Revocation does not automatically delete local mappings, preferences, credentials or enrollment records. Local removal does not delete source events or calendars in Google Calendar.

8. Public information pages and hosting

These pages consist of static HTML, CSS and a graphic. They include no analytics, advertising, third-party fonts, scripts, forms, login or API connection and set no cookies. They do not connect a Google account. Following a link to a Google service is governed by that service’s policies.

Cloudflare Pages is the selected static hosting platform. When serving the pages, it may process connection/request metadata such as an IP address, requested path and browser details to deliver and protect the site. Its infrastructure, caching and retained-deployment behavior are separate from the viewer’s application logs. This service does not assert zero host logging or a fixed host-retention/storage-location guarantee.

Essential sign-in cookies belong to the separate private viewer. Hosting these information pages does not expose that viewer or its account-connection and login endpoints.

9. Changes and questions

We update this page when the service’s data practices change. Material new uses of Google data require updated disclosure and any necessary consent before that new use begins. Questions and privacy requests use the established private family channel for FAI Calendar Read Only.