Privacy Policy

gcal-axi and gcal-tui · Last updated September 3, 2026

Scope of this policy

This policy covers gcal-axi and gcal-tui, two command-line tools for Google Calendar published by Arora Labs. They share a single Google OAuth client, registered under the application name gcal-axi. This policy describes how that OAuth client handles your data.

Both tools run entirely on your own computer. There is no hosted service, no account to create, and no backend operated by Arora Labs.

What we access

With your explicit consent, the tools request a single Google OAuth scope:

• https://www.googleapis.com/auth/calendar - read and write access to the calendars in your Google Account.

This scope is used to list your calendars, read events, and create or modify events when you ask the tools to do so. No other Google data is requested.

What we store, and where

Everything is stored locally, in files on the machine you run the tools on:

• OAuth tokens (access token, refresh token, expiry, granted scope) are written to tokens.json in the application config directory. On Linux this is ~/.config/gcal-axi/; on macOS it is ~/Library/Application Support/gcal-axi/. On Unix systems the file is created with 0600 permissions, readable only by your user account.
• Your OAuth client ID and secret are stored alongside it in config.toml.
• Calendar data is fetched on demand. gcal-tui keeps a local response cache to stay responsive; it is stored on your machine only.

Arora Labs never receives, stores, or has any means of accessing these files or their contents.

Where your data goes

Network traffic goes only to Google. The tools communicate with accounts.google.com and oauth2.googleapis.com to authorize and refresh tokens, and with the Google Calendar API at www.googleapis.com to read and write events.

Authorization uses the OAuth 2.0 installed-application flow with PKCE and a loopback redirect to 127.0.0.1 on your own machine. Your Google password is never seen or handled by these tools.

There are no analytics, no telemetry, no crash reporting, and no advertising. Your data is never sold, rented, or shared with any third party.

Limited Use disclosure

The use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used solely to provide the calendar features you invoke, and is not used to train generalized artificial intelligence or machine learning models.

Retention and deletion

You are in full control, because all of the data sits on your own machine.

• Delete tokens.json from the config directory to remove the stored credentials. The tools will simply ask you to authorize again.
• Revoke access entirely at myaccount.google.com/permissions. This invalidates the tokens on Google's side.
• Delete the config directory to remove every trace, including cached data.

Children

These are developer tools and are not directed at children under 13.

Changes

If this policy changes, the revision date at the top of this page will be updated.

Contact

Questions about this policy or about how the tools handle your data can go to contact@aroralabs.co.