← Deni Calendar

Privacy Policy — Deni Calendar

Last updated: 19 September 2026

This policy describes how the Deni Calendar integration (DENIS OS / OpenClaw on an owner-controlled VPS) handles Google Calendar data for the personal assistant identity Deni. The integration is not a public consumer product.

Data we access

Through Google OAuth, with only these Calendar API scopes:

• calendar.calendarlist.readonly — calendar list;
• calendar.events.readonly — event details on calendars Deni can read;
• calendar.events.freebusy — free/busy for conflict and availability checks;
• calendar.events.owned — create/update events Deni owns (Deni-managed calendar).

Event fields may include titles, descriptions, locations, start/end times, attendees visible to Deni, and recurrence metadata. We do not request broader Calendar scopes (full calendar write, ACL management, etc.).

How data is used

• Answer owner questions about schedule (e.g. via Telegram) in timezone Europe/Minsk;
• Build daily/weekly summaries and free-time suggestions;
• Detect scheduling conflicts before creating or moving Deni-managed events;
• Create or update events only on the designated Deni write calendar, tagged as DENIS OS–managed.

Data is not sold and not used for advertising or audience profiling.

Where data is processed and stored

• Google stores calendar data per Google’s policies; API calls go to Google Calendar API.
• Owner VPS holds OAuth client credentials and refresh token in private files (~/.config/deni-calendar/, restrictive file permissions). Calendar content is fetched on demand; there is no separate long-term calendar database in this integration.
• LLM providers (e.g. OpenAI via OpenClaw/Codex) may temporarily process calendar excerpts contained in prompts and tool results when the owner uses the assistant. That processing is limited to delivering the requested assistant function, not for ads or resale.
• Operational logs on the VPS may record metadata (operation type, calendar id hashes, errors). Secret redaction is applied; refresh tokens and client secrets are not written to logs intentionally.

Sharing with service providers

Data is shared with subprocessors only as needed to operate the integration: Google (Calendar API), the VPS host, and the configured AI provider for inference. No other third-party marketing or analytics services receive Google Calendar content from this app.

Retention

Calendar events remain in Google Calendar under Google’s retention rules. OAuth tokens remain on the VPS until rotated or revoked. Ephemeral copies in model context or logs are not kept as a permanent archive of calendar content.

Your choices

• Revoke access anytime in your Google Account → Security → Third-party access, for app Deni Calendar.
• Request cessation of processing or deletion assistance by emailing amurmen23@gmail.com.
• Removing shared calendars or changing ACLs in Google Calendar immediately limits what Deni can read.

Contact

Data controller / developer contact: amurmen23@gmail.com