TVcalendar privacy policy

TVcalendar is an app for Android TV and Google TV published by CLAPPS (contact: ralf@clapps.be). Last updated: October 2026.

What TVcalendar accesses

When you sign in, you allow TVcalendar to see the list of your Google calendars and their events (Google scopes calendar.calendarlist.readonly and calendar.events.readonly). TVcalendar only reads: it never creates, changes or deletes events.

Where your data goes

• Your calendars and events are downloaded by the app directly from Google to your TV and kept in the app's storage on that TV, so it can show them.
• Sign-in works through our server: it receives the one-time code Google gives after you agree, exchanges it for access tokens and hands them to your TV through a temporary record. From version 0.3.0 of the app, the tokens in that record are encrypted with a key that only the TV that showed the code holds. The record is deleted as soon as the TV has read it; if it is never read, it becomes unreadable after its expiry and is deleted within the next hour. When the access token expires, the TV asks our server for a new one. Our server never reads your calendars and keeps no copy of your tokens or events.
• The access tokens are stored encrypted on your TV.
• If you add a calendar by its address (an .ics or webcal link), the address you paste on your phone goes through our server to your TV the same way: in a temporary record, encrypted from version 0.3.0 with a key that only that TV holds, deleted as soon as the TV has read it; if it is never read, it becomes unreadable after its expiry and is deleted within the next hour. The TV then downloads that calendar directly from its own website and keeps the address on the TV only.
• If you choose a city for the weather of the ambient screen, the TV asks Open-Meteo (open-meteo.com) for the places matching the name you type and for the forecast of the city you choose. When the city picker opens, the city of the TV's time zone is suggested and looked up at Open-Meteo before anything is typed. These requests contain the city name or its coordinates, never your calendars or your account. The chosen city is kept on the TV only.
• TVcalendar Premium is bought through Google Play, which handles the payment: we never see your payment details. To know whether Premium is active, the app uses RevenueCat (revenuecat.com), which receives the Google Play purchase receipts of the TV's Play account and an anonymous identifier made up by the app, never your calendars or your Google account. The Premium status is also kept on the TV, so the app works offline.
• Crash reports (Firebase Crashlytics) contain technical information about the TV and the error, never your events.
• Usage counts: the TV app sends our server how many times a few moments happened (first launch, demo shown, sign-in screen shown, screensaver started, Premium screen shown and what opened it, purchase started or completed). These counts carry no identifier, no account and no device detail. We use them to improve the app and keep them only as daily totals. When you sign in, our server also counts how often signing in works on a second try after one of Google's two boxes was left unticked; for that, it keeps a note of the attempt, with nothing about you, for one hour, and then only the daily total.
• The request logs of our server, kept by our hosting provider (Google Cloud), include IP addresses and are kept for 30 days.

How your data is protected

• Encryption in transit: every connection the app and our server make (Google, our server, Open-Meteo, RevenueCat, Firebase) uses HTTPS (TLS). The app does not allow unencrypted connections.
• Encryption at rest: the Google access and refresh tokens are encrypted on the TV with AES-256-GCM, using a key kept in the Android Keystore of that TV, which cannot be copied off the device.
• Isolation on the TV: your calendars and events are kept in TVcalendar's private storage, which Android keeps out of reach of other apps. TVcalendar turns off Android backups, so this data is not copied to backups or other devices.
• Least privilege: TVcalendar only asks Google for read access to your calendar list and events, and only requests the event fields it shows (title, time, place, colour and your own reply, so declined events can be hidden). It cannot change your calendars or read your email, contacts or anything else in your Google account.
• Sign-in hand-off: from version 0.3.0 of the app, the TV that shows the code creates a temporary key pair and keeps its private key. Our server encrypts the tokens and calendar addresses for that key (ECDH P-256 and AES-256-GCM), so seeing or photographing the QR code or the code on the TV is not enough to receive them. The temporary record cannot be listed or changed by anyone, becomes unreadable after its expiry, and is deleted as soon as the TV has read it, or within the hour after its expiry if it is never read. Our database rules refuse every other read or write.
• Our server: the OAuth client secret is kept in Google Cloud Secret Manager. When the TV asks for a new access token, its refresh token is used for that request only and is never stored or written to logs. Access to the server and its Google Cloud project is limited to CLAPPS.
• Revocation: "Sign out" on a TV forgets that TV's tokens, without cutting your other TVs. "Remove access on all TVs", in the Settings of any TV, revokes TVcalendar's access at Google for every TV. You can also do this at any time from your Google Account, for example for a lost or sold TV.

Limited use

TVcalendar's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Your calendar data is used only to show your calendars on your TV. It is not sold, not used for advertising, and not shared with anyone.

Deleting your data

• On a TV, Settings, "Sign out" erases everything TVcalendar stored on that TV (calendars and events, calendar addresses, the weather city) and forgets its tokens, without cutting the other TVs.
• To remove TVcalendar's access for every TV, use Settings, "Remove access on all TVs" on any TV, or your Google Account, under Security, Third-party apps with account access.
• Crash reports are deleted by Firebase Crashlytics after 90 days.
• The Premium status belongs to the TV's Google Play account, not to your Google calendars, so it stays after signing out. RevenueCat keeps the Google Play purchase receipts, with the anonymous identifier, as long as they are needed to check the purchase.
• To have us delete those receipts or anything else, write to ralf@clapps.be with "TVcalendar data deletion" as the subject. We reply within one month.