Effective September 7, 2026
Privacy Policy
Calendar for Gmail is a CORSAIR XENEON EDGE widget published by Respawn Icons. It connects only to Google data in accounts that you explicitly authorize.
Information accessed
- Google account identity: account ID, email address, and name if Google returns one. The widget can fetch your profile-photo URL directly from Google.
- Calendar-list metadata: IDs, names, colors, time zones, access roles, and selection status for primary or selected calendars.
- Calendar events: displayed event details, organizers, attendees, responses, meeting links, details you submit for a new event, and identifiers for event actions.
- Contacts: names, email addresses, and profile-photo URLs from read-only saved Google Contacts and interaction-created Other Contacts, solely for guest suggestions.
- Google Tasks: task-list IDs and titles plus task IDs, titles, notes, due dates, completion status, and the identifier of a task you choose to complete, reopen, or delete. A Tasks due value contains a date only, not a time.
- OAuth credentials: Google access and refresh tokens. Calendar for Gmail never receives your Google password.
Calendar for Gmail does not request or access Gmail messages, Google Drive files, or unrelated Google data.
How information is used
Information is used only to connect the account; display calendars, events, and Tasks; suggest guest addresses; renew authorization; perform an event, invitation, Meet, or Task action you explicitly request; and manage the local connection. It is not used for advertising, profiling, data brokerage, or sale.
Google permissions and user-controlled changes
Contacts and Other Contacts use read-only permissions; Calendar for Gmail cannot change them. Google does not expose a message-frequency count, so interaction-created Other Contacts are suggestions rather than a claim about exact communication frequency.
The Google Tasks permission technically permits task management. Calendar for Gmail limits its use to reading Tasks and completing, reopening, or deleting only a task that you explicitly select; deletion also requires confirmation. It does not create, edit, or reorganize Tasks. Google's calendar-events permission covers event management on calendars you own. Calendar for Gmail uses it only for the event details, guest invitations, unique Meet request, RSVP, creation, or confirmed deletion you request.
Processing and storage
Calendar event, Task, contact, and profile-photo content travels directly between the hosted widget running in iCUE and Google; it is held in widget memory only as needed for display or the requested action. The Respawn Icons sign-in service does not receive, proxy, or retain that content. Contact suggestions are cached only in widget memory for up to five minutes and are not written to widget storage.
During sign-in, the service exchanges Google's authorization response, reads basic account identity and limited calendar-list metadata, and creates an encrypted handoff package for the requesting widget. Retrieval triggers deletion; the record also expires within 15 minutes.
The service stores short-lived session records containing random-token hashes plus keyed one-way fingerprints that bind the browser callback and refresh-token renewal to the requesting installation. Raw network addresses and Google refresh tokens are not stored in those binding records. An unused refresh-token binding expires after 90 days; successful renewal restarts that period.
After connection, OAuth credentials, account identity, the profile-photo URL fetched directly by the widget, permissions, and calendar-list metadata are stored locally as an AES-GCM-encrypted record in the widget's IndexedDB on your Windows device. If secure storage is unavailable, the widget keeps the connection only in memory and never falls back to plaintext.
To open OAuth, meeting, and event links in the default browser without exposing them to the iframe bridge, the widget encrypts each target locally with a fresh AES-GCM key. The service stores only opaque ciphertext and a keyed network binding for up to 60 seconds; the decryption key stays in the browser URL fragment and is never sent to the service. Retrieval is one-use.
Sharing and service providers
Calendar for Gmail communicates with Google and with the Respawn Icons sign-in service hosted on Cloudflare. Cloudflare processes limited network, session, and encrypted handoff data as an infrastructure provider. Google sends guest notifications when you create an event with attendees. Respawn Icons does not sell, rent, or disclose Google user data to advertisers or data brokers.
Security
Safeguards include Google-hosted OAuth, narrowly selected scopes, PKCE, random one-time values, same-browser and same-network callback checks, HTTPS, rate limits, short-lived encrypted handoff records, strict browser-origin controls, restricted Google API and image hosts, and installation-bound token renewal. No system can be guaranteed perfectly secure.
Your choices and deletion
Removing an account deletes its locally stored credentials and metadata. You can also revoke Calendar for Gmail from your Google Account connections. Event and Task deletion requests remove the selected item from Google; use Google's applications to determine whether recovery is available. Unclaimed sign-in packages expire within 15 minutes, and inactive session and refresh-binding records expire automatically. For a privacy or deletion request, email respawnicons@gmail.com.
Google API Services User Data Policy
Calendar for Gmail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Children
Calendar for Gmail is not directed to children under 13, and Respawn Icons does not knowingly collect their personal information.
Changes
Material changes will be posted here with a revised effective date before they take effect.