Privacy policy

1. Scope

This policy explains how Cocal handles information when you use cocal.io, mcp.cocal.io, the account management interface, public invite and booking pages, and related sign-in and calendar-connection flows (together, the "Service").

2. Account and authentication data

Cocal stores the email address for your Cocal account and, when available from Google sign-in, your profile name. For each Google Calendar account you connect, Cocal stores its email address and Google account identifier, a label you can edit, connection status, granted permissions, access and refresh tokens, and token-expiration information. We use these records to sign you in, route calendar requests to the right account, and access Google Calendar on your behalf. Outlook accounts are described under Outlook accounts below. An iCloud Calendar account works differently, and section 3 describes what Cocal stores for it.

To run the website and clients you connect, Cocal also stores an opaque website session identifier, short-lived sign-in and authorization records, client access and refresh tokens, and a record of the most recently connected client. The website session cookie contains an opaque identifier rather than your email address.

Google permissions

When you sign in with Google, Cocal requests the identity permissions named openid, email, and profile. Cocal uses them to identify your account and receive your email address and, when available, profile name.

When you connect a Google Calendar account, Cocal requests these baseline Google Calendar scopes:

• calendar.events to read and write events.
• calendar.readonly to read calendars, events, calendar-list metadata, colors, and free/busy information.

Cocal does not request the full calendar scope or the calendar.aclsscope for managing calendar sharing. If a booker optionally connects their own calendar for a free/busy check, Cocal requests only calendar.freebusy, as described in section 7.

Your Cocal identity remains until you delete your Cocal account. A connected Google or Outlook account record remains until you disconnect that account or delete your Cocal account. Signing out deletes the current website session. Disconnecting a client deletes that client’s tokens, pending authorization codes, and connection record. Expired credentials stop working.

Outlook accounts

When you connect an Outlook account, you sign in with Microsoft using a personal Microsoft account or a work or school account, and Cocal requests these Microsoft Graph permissions:

• Calendars.ReadWrite to read your calendars and events and, where writing is available for the account, to create, change, delete, and reply to events.
• MailboxSettings.Read to read your mailbox time zone.
• User.Read to read the account’s basic profile, including its email address.
• openid, profile, email, and offline_access to identify the account and keep access without asking you to sign in each time.

For each Outlook account, Cocal stores its email address, Microsoft’s identifiers for the account and its organization, whether it is a personal or a work or school account, a label you can edit, connection status, granted permissions, access and refresh tokens, and token-expiration information. When Microsoft returns a new refresh token as Cocal renews access, Cocal replaces the stored one with it. Cocal uses these records to reach your Outlook calendars through Microsoft Graph at your direction or the direction of a client you connected, and to run the booking links and syncs you set up. Data from your Outlook calendars is read live from Microsoft when the request is made, as described in section 5. Cached calendar metadata, booking links, calendar syncs and the other records described in this policy work the same way for your Outlook calendars, with Outlook event identifiers in place of Google ones.

Cocal deletes the stored tokens when you disconnect the Outlook account or delete your Cocal account. Cocal also deletes them when Google tells us that a Google account you use with Cocal was disabled, was signed out everywhere, or had all of Cocal’s access to it revoked, as can happen when an account is compromised. The account stays listed and asks you to reconnect. If Microsoft stops accepting them, Cocal marks the account as needing to reconnect. Cocal does not revoke the access you granted at Microsoft, so when Cocal deletes its copy, that permission stays in place at Microsoft until you remove it at account.live.com for a personal Microsoft account, or at myapps.microsoft.com for a work or school account. For a work or school account, an administrator of your organization can also remove it.

3. iCloud Calendar and your app-specific password

iCloud Calendar has no Google-style sign-in for calendars, so you connect it with an app-specific password. You create that password yourself at account.apple.com and enter it, with your Apple Account email address, in Cocal’s own connect form. It is not your Apple Account password, and the form does not accept that password. You never type it into a chat. When you submit the form, our website seals the password to Cocal’s calendar server and does not keep a copy.

What Cocal stores

For each iCloud Calendar account you connect, Cocal stores the Apple Account email address, Apple’s identifier for the account, the other email addresses Apple lists for the account’s calendars, the locations of its calendars on Apple’s servers, a label you can edit, connection status, and the app-specific password. Cocal stores the password encrypted (AES-256-GCM). The encryption keys are held only by the calendar server, and the website never has them. Cocal never shows the password again, to you or to a client you connect. Cached calendar metadata, booking links, calendar syncs and the other records described in this policy work the same way for your iCloud calendars, with iCloud Calendar event identifiers in place of Google ones.

How Cocal uses it

Cocal uses the password only to read and write your iCloud calendars: to list and search events, check availability, and create, change, delete or reply to events at your direction or the direction of a client you connected, and to run the booking links and syncs you set up. Data from your iCloud calendars is read live from Apple when the request is made, as described in section 5.

When Cocal deletes it

Cocal deletes the stored password when you disconnect the iCloud Calendar account, when you choose Forget iCloud password on the accounts page, when you delete your Cocal account, and after a security event: when Google tells us that a Google account you use with Cocal was disabled, was signed out everywhere, or had all of Cocal’s access to it revoked, as can happen when an account is compromised. After a security event the account stays listed and asks you to reconnect with a new password. If Apple stops accepting the password, Cocal marks the account as needing one and keeps that password until you reconnect, forget it or disconnect the account.

Revoking it at Apple

You can revoke it at Apple at any time, at account.apple.com. Once you do, Cocal can no longer reach your iCloud calendars. Cocal cannot revoke it for you: when Cocal deletes its copy, the password stays valid at Apple until you revoke it there.

4. Calendar metadata and preferences

Cached calendar metadata

Cocal caches the calendar list for each connected account. The cache can include calendar IDs, names and name overrides, access roles, primary-calendar status, colors, timezones, whether a calendar is enabled in Cocal, and whether its busy time blocks booking-link availability. This lets Cocal resolve calendars, apply your settings, and avoid requesting the same calendar list from Google Calendar, Outlook or iCloud Calendar on every action. The cache is refreshed and replaced as the calendar list changes.

Cocal can also store a category, relationship label, description, source, and confidence value for a calendar. These fields help the Service distinguish your own calendars from a partner, family, shared, or subscribed calendar. They may be proposed automatically and can be reviewed or edited by you.

Disconnecting a Google Calendar, Outlook or iCloud Calendar account deletes that account’s cached calendar rows. Saved classification metadata is deleted when the calendar no longer appears through another connected account. Deleting your Cocal account deletes all of your cached and saved calendar metadata.

Calendar preferences and edit history

If you save calendar preferences, Cocal stores the freeform note so a connected client can read it at the start of a conversation. Each real edit also stores the full before-and-after text, the edit source, and the time of the edit so you can review or recover earlier text. Clearing the current note does not clear that edit history. The note and its edit history are deleted when you delete your Cocal account.

5. Live calendar reads

Ordinary event listing, search, event-detail, conflict, and availability requests read current data from Google Calendar, Outlook or iCloud Calendar when the request is made. The results pass through the Service in memory to provide the requested feature and, for client tool calls, are returned to the client you connected. Cocal does not write the contents of those ordinary read results to its application database or keep a copy of your AI conversation history there.

Some optional Cocal features do store event-related data: event-invite links, booking links, calendar syncs, and temporary event-preview drafts. These are Cocal features, not part of ordinary calendar reads. Their records are described below.

Calendar categorization

During onboarding and after you connect a new account, Cocal may use a model provider to suggest what an unresolved calendar represents. The limited sample can include the calendar ID, name, access role, whether it is primary or belongs to one of your connected accounts, truncated recent event titles, attendee email domains, your profile name, and the email addresses of your connected accounts. Cocal uses this input only to produce calendar categories, labels, and descriptions. The resulting metadata may be stored as described in section 4.

6. Event-invite links

When you use Cocal to create an event-invite link, Cocal stores identifiers for the link, organizer, account, calendar, and calendar event; an optional encrypted access code; an optional guest cap and expiry; and a snapshot of the event’s title, start, end, location, and timezone. The snapshot lets the public invite page show the event without reading the organizer’s calendar. This is an exception to ordinary live-only event reads.

When someone successfully joins, Cocal stores their email address and join time with the invite and organizer. These records prevent duplicate joins and show the organizer a joined count.

Disabling a link, reaching its cap or expiry, or reaching the end of the snapshotted event makes the link inactive but does not delete the invite snapshot or join records. Those records are deleted when the organizer deletes their Cocal account. Deleting them from Cocal does not delete the underlying event from Google Calendar or Outlook.

7. Booking links and booker data

When you create a Cocal booking link, its record includes the public slug, title, target account and calendar, duration, timezone, weekly availability, notice and booking windows, buffers, status, and an optional encrypted access code. Cocal uses these settings to calculate available times and create an event on the target calendar (Google Calendar, Outlook, or iCloud Calendar) when someone books.

For each completed booking, Cocal stores the booker’s email address and optional name, the booked start and end, the related calendar event ID, booking status, and a private token used by the booker to reschedule or cancel. Canceling a booking changes its status but does not delete this record. Disabling a booking link, or disconnecting the calendar account it targets, also leaves the link and existing booking records in place. They are deleted when the link owner deletes their Cocal account. Existing events in Google Calendar, Outlook, or iCloud Calendar are not deleted by Cocal account deletion.

A booker can optionally connect their own Google Calendar to mark which host slots overlap their busy time. Cocal requests free/busy data only, not event details. The booker’s access token is encrypted in a browser cookie for 30 minutes and is not stored in Cocal’s application database. The read busy intervals are used to annotate the available slots and are not added to a booking record.

8. Calendar sync records and preview drafts

Calendar sync records

If you configure a calendar-to-calendar sync, Cocal stores the source and target account and calendar IDs, direction, privacy and filter settings, sync window, status, timestamps, and the most recent error. It also stores a mapping between source and mirrored event IDs and a hash used to detect changes. The application database does not store the mirrored event body in that mapping. Event details are read from one of your calendars and written to another, in Google Calendar, Outlook, or iCloud Calendar, according to the sync settings you choose.

Deleting a sync through Cocal first attempts to remove its mirror events from the target calendar, then deletes the local policy and mappings after teardown succeeds. Disconnecting an account used by a sync pauses the sync and retains its policy and mappings. Deleting your Cocal account deletes the local sync records, but it does not remove events already written to Google Calendar, Outlook, or iCloud Calendar.

Event-preview drafts

Event previews are on by default for event creates and updates that involve people outside your own calendars. You can also choose to see one when an event’s time conflicts with another event, or for every create and update. When a preview applies, Cocal temporarily stores the fully resolved request, including the event details needed to perform the proposed change. A draft can be confirmed for 15 minutes. Cleanup removes still-pending drafts after they have been expired for more than one day and removes all draft rows after they have been expired for more than 90 days. Cleanup runs opportunistically when another draft is staged, so deletion is not guaranteed at the exact threshold. Deleting your Cocal account deletes its drafts immediately from the application database. If you turn previews off, Cocal does not create new preview drafts.

9. Tool activity, analytics, and diagnostics

The 90-day tool activity log

Cocal keeps a metadata-only log of tool calls so you can review recent activity and Cocal can understand how the Service is operating. Each entry contains your Cocal account identifier, tool name, success, error, or blocked status, duration, number of connected accounts involved, source, connected-client identifier when available, and call time. It does not store tool arguments or results, so it does not contain event titles, descriptions, attendees, search terms, or other event content from the call.

The activity view uses a 90-day window. Entries outside that window are excluded from the view and removed when the settings data is loaded or opportunistically as new calls are logged. Deleting your Cocal account deletes its activity rows from the application database.

Product analytics and diagnostics

Cocal uses analytics and exception-monitoring services for page views, selected product actions, feature outcomes, errors, and operational performance. Browser analytics can use an anonymous identifier. When Cocal attributes analytics to a signed-in user, it uses a keyed, one-way identifier derived from the email address instead of the raw email. Analytics code removes known sensitive fields and email- or URL-shaped values before sending. Analytics records, including session recordings, are stored with the IP address your browser connects from, which helps us detect fraud and abuse.

Cocal does not promise one retention period for records held by analytics, exception-monitoring, hosting, or infrastructure providers.

Session recordings on sign-in and setup pages

On the sign-in pages, your Cocal account pages, calendar connection links, and the page where you approve a chat client, Cocal records how the page behaves while you use it: the page layout, mouse movement, clicks, scrolling, and moves between pages. We use these recordings to find and fix problems that stop people from finishing setup.

Recordings hide the page’s content before anything leaves your browser. Every piece of text and everything you type is replaced with placeholder characters, so a recording does not show your email address, calendar names, account names, or server URL. Images and embedded content are left out. Links and other page details that could identify you are hidden, and page addresses are recorded without codes or query details. Recordings do not include browser console messages, network requests, or anything drawn on a canvas.

Cocal does not record its other public pages, booking pages, or invite pages. Recordings go to our analytics provider with the same anonymous or one-way identifier described above.

10. Communications

If you use Cocal’s contact form, Cocal stores the request type, name if provided, email address, subject, message, source page, status, and timestamps. If you are signed in, the request can also be associated with your Cocal account identifier. These records are used to review and answer the request. Cocal also attempts to forward requests by email to the Cocal team so they can be answered from there. Forwarding depends on email configuration, delivery, and rate limits; requests remain stored if forwarding fails. Contact requests are intentionally not deleted by the automated Cocal account-deletion path because they can be support, privacy, or legal records. Cocal does not state a fixed retention period for them here.

11. How information is shared

Cocal shares information only as needed for these purposes:

• Google. Cocal sends authorized requests to Google Calendar using the credentials you grant. Invite joins, bookings, event changes, and syncs can write data to Google Calendar at your direction.
• Microsoft. Cocal sends authorized requests to Outlook through Microsoft Graph using the tokens Microsoft issues for your account. Event changes, bookings, and syncs can write data to Outlook at your direction. For an event you organize, Outlook sends its own invitation, update, and cancellation emails to the guests, and Cocal cannot turn them off.
• Apple. Cocal sends requests to iCloud Calendar on Apple’s servers using the app-specific password you give it. Event changes, bookings, and syncs can write data to iCloud Calendar at your direction. Cocal does not email your guests itself. Any invitation, update, or cancellation email for an iCloud Calendar event comes from Apple’s servers, under Apple’s rules.
• Clients you connect. Calendar data requested through Cocal is returned to the AI assistant or other client that made the request and is then handled under that provider’s terms and privacy policy.
• Calendar-categorization model provider. Cocal sends the limited sample described in section 5 when the categorization feature uses a model.
• Operational providers. Hosting, database, email, analytics, exception-monitoring, and related providers process information needed to run their part of the Service.
• Legal and safety disclosures. Cocal may disclose information when required by law or when needed to protect users or the Service.
• Business transfers. In a merger, acquisition, financing, or asset sale, Google user data may be transferred only to a successor bound by obligations equivalent to the Google API Services User Data Policy, including the Limited Use requirements.

Cocal does not sell your personal information.

12. Google user data, Limited Use, and other providers

Cocal’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Cocal uses Google user data only to provide and maintain user-facing features of the Service. Cocal does not use Google user data for:

• Serving, targeting, or personalizing advertisements
• Retargeted, interest-based, or personalized advertising
• Selling data to third parties, data brokers, or information resellers
• Determining creditworthiness or for lending purposes
• Training artificial intelligence or machine learning models
• Building databases or datasets for any of the above purposes

Cocal does not transfer Google user data to third parties except as necessary to provide the user-facing features you request, to comply with law, or, in connection with a business transfer, to a successor bound by obligations equivalent to the Limited Use requirements. Cocal does not transfer Google Calendar event content, including event titles, descriptions, locations, attendee email addresses, or other free-text event fields, to analytics or exception-monitoring providers.

When you connect Cocal to an AI assistant or other client, calendar data is returned to that client at your direction and only to provide the user-facing calendar feature you requested. Cocal does not control how that client’s provider processes data after delivery. Review the privacy policy and terms of any client you connect.

Cocal applies the same commitments to calendar data it receives from Microsoft for Outlook accounts and from Apple for iCloud Calendar accounts. It uses that data only to provide and maintain the user-facing features of the Service, never for the purposes listed above, and does not transfer its event content to analytics or exception-monitoring providers.

13. Your deletion choices

You can disconnect a Google Calendar, Outlook, or iCloud Calendar account from the Cocal accounts page. This deletes the local connected-account credentials, including the app-specific password stored for an iCloud Calendar account, and that account’s cached calendar rows. It does not delete your Cocal account or events in Google Calendar, Outlook, or iCloud Calendar. It also does not delete the retained invite, booking, preference, activity, or other records described above.

You can revoke Cocal’s Google authorization through your Google account settings. For an Outlook account, remove Cocal’s access at account.live.com for a personal Microsoft account, or at myapps.microsoft.com for a work or school account. For an iCloud Calendar account, revoke the app-specific password at account.apple.com. To keep an iCloud Calendar account listed but have Cocal forget its password, choose Forget iCloud password on the accounts page. Deleting your Cocal account removes its user-scoped product records, including connected credentials, website sessions, client grants, cached calendar metadata, preferences and edit history, invite snapshots and joins, booking links and bookings, sync records, preview drafts, and the tool activity log. After local deletion completes, Cocal makes a best-effort request to Google to revoke the available token for each connected Google account. Cocal makes no such request to Microsoft, so for an Outlook account Cocal deletes its copy of the tokens and you can remove Cocal’s access at Microsoft (for a work or school account, so can your organization’s administrator). Apple offers Cocal no way to revoke an app-specific password, so for an iCloud Calendar account Cocal deletes its copy and you can revoke the password at Apple.

Cocal account deletion does not delete events already stored in Google Calendar, Outlook, or iCloud Calendar, contact-form records described in section 10, or data already delivered to Google, Microsoft, Apple, a client you connected, the calendar-categorization model provider, or operational providers. Depending on where you live, you may also have rights to request access to, correction of, or deletion of certain personal information Cocal holds. Use the contact form for such a request.

14. Security

Cocal uses measures that include encryption in transit, encrypted storage for invite and booking access codes and for iCloud Calendar app-specific passwords, authenticated sessions, scoped credentials, and access controls for administrative systems. No method of transmission or storage is perfectly secure, and Cocal cannot guarantee absolute security.

To report a suspected vulnerability, see security reporting. No sign-in is required.

15. Changes to this policy

Cocal may update this policy from time to time. If Cocal makes material changes, it will update the date above and may provide additional notice. If Cocal materially expands the categories of Google user data or personal data it collects or the purposes for which it uses that data, Cocal will update this policy before doing so and obtain any consent required by law or platform policy.

16. Contact

For privacy-related questions or requests, use Cocal’s contact form.