OmaCal is a free, open-source desktop calendar application for Linux and macOS, developed by Extreme Labs ("we", "us"). OmaCal is a client for Google Calendar, iCloud and CalDAV servers: it runs entirely on your computer, connects directly to your calendar provider on your behalf, and stores its data locally on your device.
This policy describes what data OmaCal accesses, how that data is used, where it is stored, and the choices you have. It covers the OmaCal desktop application and this website, omacal.app.
The short version: your calendar data never reaches Extreme Labs. OmaCal has no server component, no account system of its own, no analytics, and no telemetry. Your calendar data moves only between the application on your device and your calendar provider, over encrypted connections. The two narrow exceptions, which carry no calendar data, are the update check and the optional weather display, described in section 5.
1. Data OmaCal accesses from your Google account
When you connect a Google account, you authorize OmaCal through Google's standard OAuth 2.0 consent flow. OmaCal requests the Google Calendar scope (https://www.googleapis.com/auth/calendar), which grants read and write access to your calendars. Using that authorization, OmaCal accesses:
- Your calendar list: the names, colours and access roles of the calendars on your account, so you can choose which ones to display and fetch.
- Your events: titles, start and end times, recurrence rules, descriptions, locations, guest lists with each guest's RSVP status, reminders, and conferencing links, so the application can display, search and notify you about them.
- Your account email address: used to label the connected account inside the application and to key its credentials in your operating system's keychain.
Write access is used only when you act: creating, editing or deleting events, responding to invitations, and managing guests and reminders. OmaCal never modifies your calendar on its own initiative.
If a future version of OmaCal can provide the same features with narrower Google scopes, it will request those instead.
2. iCloud and CalDAV accounts
When you connect an iCloud account, you sign in with an app-specific password generated on your Apple ID page: a scoped credential that you can revoke at any time. A CalDAV account uses the username and password, or app password, your server issues. In both cases OmaCal accesses the same categories of data as above (your calendar list, your events, and any task lists) directly from Apple's or your server's CalDAV endpoint, and writes only when you act. The credential is stored in your operating system's keychain and is never written to ordinary files or sent anywhere but the server it belongs to.
3. How OmaCal uses this data
Your calendar data is used solely to provide OmaCal's user-facing calendar features: displaying your calendars in its views, searching your events, showing event details, firing reminder notifications on your desktop, listing what is coming up in the tray and the optional bar widget, answering the omacal command on your own machine, and carrying out the create, edit, delete and RSVP actions you take. It is not used for anything else at all: no advertising, no profiling, no analytics, and no purposes unrelated to the calendar features you see in the application.
4. Where your data is stored
- Calendar data (your calendar list, events and tasks) is cached in a local SQLite database inside OmaCal's application data directory on your device. It exists there so the application can render instantly and keep working between syncs.
- Credentials: the OAuth refresh token Google issues, and any iCloud or CalDAV password, are stored in your operating system's secure credential store: on Linux the Secret Service (for example GNOME Keyring or KeePassXC), on macOS the Keychain. They are never written to ordinary files.
- Settings (chosen colours, time zone, notification preferences) are stored in the same local database. Colours you assign to calendars are local to OmaCal and are never written back to your provider.
Nothing is stored anywhere else. Extreme Labs operates no servers for OmaCal, so we cannot access, view, collect or recover any of your data, and no copy of it exists outside your device and your calendar provider.
5. Data sharing and transfer
OmaCal does not share, transfer, sell or disclose your calendar data to anyone. The only parties your data is exchanged with are the calendar providers you connected, over TLS-encrypted connections, at your direction; that exchange is the product. There are no third-party services, advertising networks, data brokers or analytics providers involved.
Two narrow, calendar-free requests exist alongside that. OmaCal checks GitHub's public release listing once a day to learn whether a newer version exists; the request carries the app's version number and your IP address, as any web request does, and nothing else. And when the weather display is on (it is by default; Settings turns it off), OmaCal fetches a forecast from Open-Meteo, a keyless public weather service, for coordinates taken from the Omarchy weather widget's setting when one exists or otherwise estimated from your IP address by wttr.in. No calendar data, account identifier or event detail is ever part of either request.
6. Google API Services User Data Policy
OmaCal's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, OmaCal does not use Google user data for advertising, does not allow humans to read it (there is no path by which we could), does not sell it, and does not use or transfer it to determine creditworthiness or for lending purposes. Google user data is not used to develop, improve or train generalized artificial intelligence or machine learning models.
7. Data retention and deletion
Because all data lives on your device, retention and deletion are entirely in your hands:
- Revoke OmaCal's access at any time from your Google account's third-party access settings, or by deleting the app-specific password on your Apple ID page or your CalDAV server. Once revoked, OmaCal can no longer read or write anything on that account.
- Delete local data by removing OmaCal's application data directory (which holds the SQLite database) and the
omacalentries in your keychain, or simply by uninstalling the application and deleting its data directory. This removes every locally cached copy of your calendar data.
Deleting local data does not affect the events on your account; those remain under your provider's own privacy policy and controls, as they were before you used OmaCal.
8. Security
OmaCal follows the security practices Google recommends for desktop applications: OAuth 2.0 with PKCE and a loopback redirect, so tokens are only ever returned to a process on your own machine; credentials kept in the operating system's credential store rather than in files; and all communication with your providers encrypted in transit with TLS. The application's full source code is public, so these claims can be verified by reading it.
9. This website
omacal.app is informational. It sets no cookies, runs no analytics and includes no third-party trackers. If you contact us by email, we use what you send us only to respond.
10. Children
OmaCal is a general-audience productivity tool and is not directed at children under 16. We do not knowingly collect data from children; as described above, we do not collect personal data at all.
11. Changes to this policy
If we change this policy, the new version will be published at this address with an updated effective date. Material changes to what OmaCal accesses from Google would also appear in the Google consent screen, which is re-approved by you.
12. Contact
Questions about this policy can be sent to info@x3me.net. Extreme Labs is based in Bulgaria.