Privacy Policy

Calendar for Outlook is published by Respawn Icons. Effective September 10, 2026.

Information used

With your consent the widget accesses Microsoft account identity, calendars and events, saved contacts for guest suggestions, profile photos, and Microsoft To Do tasks. Calendar changes and task actions occur only when you use the corresponding controls. The app requests no mailbox-reading or mail-sending permission and never receives your Microsoft password.

Storage and processing

Calendar, task, contact and photo content travels directly between the widget on your device and Microsoft Graph. Display caches are in memory. Saved OAuth access and refresh tokens and account/calendar metadata are encrypted with AES-GCM in local IndexedDB using a non-extractable key. Loss of local storage can require sign-in again.

The Cloudflare-hosted sign-in service transiently processes authorization codes, provider tokens, basic account identity and calendar metadata for sign-in and renewal. An encrypted sign-in handoff is stored for up to 15 minutes and consumed when collected. Session records contain random-token hashes and installation bindings with expiry. Provider refresh-token bindings are keyed hashes retained for up to 90 days of inactivity. The service does not retain plaintext provider tokens, calendar-event content, tasks or contacts. The previous provider-token hash can remain bound to the same installation to recover interrupted renewal.

External links use an encrypted handoff lasting up to 60 seconds. The decryption key remains in the browser URL fragment and is not sent to the server. Cloudflare processes network traffic as infrastructure provider. Application request logging and tracing are disabled in the deployment configuration.

Your choices

Removing an account deletes its connection from widget storage. You may separately revoke the app in your Microsoft account or your organization’s application portal. Removing the widget connection does not delete Microsoft calendar events or tasks. Explicit deletion controls act on Microsoft’s service and its recovery rules apply.

Use and sharing

Data is used to provide the requested widget functions, not for advertising, sale or profiling. Invitations and meeting responses are sent by Microsoft when you request those calendar actions. No analytics or third-party scripts are included.

Security and contact

Controls include HTTPS, PKCE, same-browser callback checks, same-network pairing checks, atomic one-use handoffs, encrypted storage, restricted API destinations and installation-bound token renewal. No software can guarantee perfect security. Contact respawnicons@gmail.com for privacy questions. This app is not directed to children under 13.