Privacy policy

Last updated: July 26, 2026

1. Who is responsible

This policy applies to the ZefirCalendar application for Windows and to the website zefircalendar.com.br. ZefirCalendar is developed and maintained by Diógenes P. Magnus (Brazil). For any privacy-related question or request, contact suporte@zefircalendar.com.br.

2. What data the app accesses

ZefirCalendar exists to show and manage your calendars. To do that, with your explicit authorization, it accesses:

• Google Calendar data, through the official Google Calendar API. The app requests two permissions (OAuth scopes): calendar.readonly, used to list your calendars and read your events so they can be displayed in the tray flyout; and calendar.events, used only to create, edit, or delete events when you explicitly do so in the app. Sign-in happens in your own browser, on Google's page — the app never sees your Google password.
• iCloud calendar data, through the CalDAV protocol, using an app-specific password that you generate in your Apple account. This includes calendars shared with you.
• Outlook and Microsoft 365 calendar data, through the official Microsoft Graph API, for personal accounts (Outlook.com, Hotmail, Live) and for work or school accounts. The app requests three permissions (OAuth scopes): Calendars.ReadWrite, used to read your calendars and events and to create, edit, or delete events when you explicitly do so in the app; User.Read, used only to show which account is connected; and offline_access, which keeps the session alive without asking you to sign in again. Sign-in happens in your own browser, on Microsoft's page, and the app never sees your Microsoft password.
• Calendars via iCal/ICS link, the older method, which still works: you register a calendar's address (URL) and the app fetches its content directly from that address. The URL is stored encrypted (DPAPI) in calendarios.json, on your computer.

Everything the app stores lives on your computer only, in the folder %APPDATA%\ZefirCalendar. Your credentials are kept there, one file per connected service: google.json, with your encrypted Google refresh token, the email of the connected account and the list of your calendars (name, color, and visibility); icloud.json, with your encrypted iCloud app-specific password and your calendars; and microsoft.json, with your encrypted Microsoft refresh token, the email of the connected account and your calendars. Access tokens are never written to disk, they live only in memory while the app is open. Next to those, the app keeps calendarios.json, with the iCal/ICS addresses you added, encrypted; configuracoes.json, with your preferences (language, view, and transparency); and small internal control files, such as your trial status and which reminders have already been shown. The folder also holds technical cache directories created by the runtime the app is built on. All credentials are encrypted with Windows' native protection (DPAPI). Your events are not in any of these files, they exist only in memory while the app is running. A technical error log (zefircalendar.log) may also be kept locally and never leaves your machine.

3. How Google user data is used

Data obtained from your Google account is used exclusively to provide the app's visible functionality: displaying your calendars and events in the Windows tray, and creating, editing, or deleting events at your request. Nothing else.

• We do not use Google user data for advertising.
• We do not sell Google user data, nor transfer it to third parties (except to Google itself, when syncing your changes).
• We do not use Google user data to train artificial intelligence or machine-learning models.
• No human being reads your data — it stays on your computer.

ZefirCalendar's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

4. Where your data is stored and how it is protected

There is no intermediary cloud: ZefirCalendar connects your computer directly to the servers of Apple, Google, and Microsoft, and to the calendar addresses you register yourself, always over encrypted connections (HTTPS/TLS). Your credentials are stored encrypted with DPAPI, Windows' native protection, tied to your Windows user account. Since we do not operate any server that receives your data, your calendar data cannot leak from us, it is never in our possession.

5. What the app does not do

• It does not collect usage statistics, telemetry, or navigation data.
• It does not display ads and does not share data with advertisers.
• It does not send your events, contacts, or credentials to anyone.
• It does not read your location.

6. Revoking access and deleting your data

You are in control, and leaving is as easy as entering:

• Google: you can disconnect your account in the app's Settings, or revoke ZefirCalendar's access at any time at myaccount.google.com/permissions.
• iCloud: remove the account in the app's Settings and, if you wish, revoke the app-specific password at account.apple.com.
• Outlook and Microsoft 365: remove the account in the app's Settings, or revoke ZefirCalendar's access at any time at account.live.com/consent/Manage for personal accounts. On work or school accounts, revocation is done by your organization's administrator.
• Deleting everything: uninstalling the app removes it from your PC. To erase every remaining local trace, delete the folder %APPDATA%\ZefirCalendar and also the folder .zefir inside your user folder, which holds only the marker recording when your free trial started. Since nothing is stored on our side, there is nothing to request deletion of from us.

7. The website

This website is a set of static pages hosted on Netlify. It does not use analytics trackers or advertising cookies. It stores a single preference in your browser: your chosen language. Netlify, as the hosting provider, may register standard technical logs (such as IP addresses) for security purposes, under Netlify's privacy policy.

8. Subscriptions and payments

ZefirCalendar can be tried free of charge. If you subscribe, the payment is processed entirely by the payment platform (such as the Microsoft Store or the checkout provider indicated at purchase time). Card details and billing data are handled by that platform under its own privacy policy — they never pass through ZefirCalendar. We only receive confirmation that a subscription is active.

9. Your rights

Under Brazil's General Data Protection Law (LGPD, Law 13.709/2018) and equivalent laws in your jurisdiction, you have the right to know which data is processed, to correct it, to withdraw consent, and to request deletion. Because ZefirCalendar's design keeps your data on your own device, most of these rights are exercised directly on your computer (section 6). For anything else, write to suporte@zefircalendar.com.br and we will respond within 15 days.

10. Children

ZefirCalendar is a productivity tool with no content directed at children, and it does not knowingly collect data from minors.

11. Changes to this policy

If this policy changes, the date at the top of the page will be updated. Relevant changes will be highlighted here on the website.