Skip to content
Zcentric

OnCal · Legal

OnCal Privacy Policy

Last updated: 30 September 2026

This policy explains how OnCal, the calendar app for Mac, iPhone and Android from Zcentric ("we", "us"), handles your information. It covers the app. Our website is covered by the Zcentric Privacy Policy.

The short version

  • OnCal has no servers and no account with us. Your calendar data goes directly between your device and the services you connect (Google, Microsoft, Apple and Zoom). We never receive it.
  • OnCal has no ads, no analytics and no tracking.
  • We don't sell, rent or share your data, and we don't use it to train AI models. OnCal itself sends your data only where a feature you use needs it (see who your data is shared with).
  • Your sign-ins are kept in your device's secure storage, and everything OnCal sends is encrypted (see how your data is protected).

1. What OnCal uses, and why

Calendar accounts you connect

  • Google. When you sign in with Google, OnCal asks for permission to see, create, change and delete events on your calendars (calendar.events), to see the list of calendars you have (calendar.calendarlist.readonly), and for your name and email address (openid, email, profile) so it can label the account in the app.
  • Microsoft 365 and Outlook.com. OnCal asks to read and write your calendars (Calendars.ReadWrite), for your basic profile (User.Read) to label the account, and to stay signed in (offline_access).
  • iCloud. On the Mac and iPhone you can connect iCloud Calendar with your Apple ID email and an app-specific password that you create at Apple. OnCal uses them only to talk to iCloud's calendar server.
  • Calendars already on your device. With your permission, OnCal reads and writes the calendars (and, on the Mac and iPhone, the reminders) that your device already syncs.
  • Zoom (optional). If you connect Zoom, OnCal can create Zoom meetings for new events. It asks for your basic Zoom profile and permission to create meetings.

OnCal uses this access only for the features you see in the app: showing your events, creating and editing the events you ask it to, answering invitations, adding video links, sending meeting alerts, showing widgets, and, if you turn it on, mirroring (below).

Features you can turn on

  • Weather. OnCal sends your location, rounded to about a kilometer, to Open-Meteo to get a forecast. If you pick a city instead, it sends the name you type to Open-Meteo's place search.
  • Time to leave. On the Mac and iPhone, for events with an address, OnCal asks Apple Maps for the travel time from where you are. Apple handles that request under Apple's privacy policy.
  • Stop alerting once I've joined. On the Mac, OnCal checks whether any app is using a microphone or camera around a meeting's start. It only checks whether they're in use; it never records, listens to or sees anything. On iPhone it checks whether a call is in progress, and on Android whether the phone is in a call. On the Mac you can also let it look at the addresses of your open browser tabs to find the meeting's link; macOS asks your permission first for each browser, and the addresses never leave your Mac.
  • Mirroring. If you set it up, OnCal copies events from calendars you choose into another of your calendars, labeled "Busy" or with the event's title, as you choose, so people who see that calendar know you're booked.
  • Zoom links. When you add a Zoom meeting to an event, OnCal sends Zoom the event's title, start time and length to create the meeting, then adds its link to the event.

2. Where your data goes

Everything OnCal sends goes directly from your device, encrypted (HTTPS), to the service it's for:

  • Google, Microsoft and Apple (iCloud), for the calendars you connect.
  • Zoom, if you connect it and add a Zoom meeting.
  • Open-Meteo, for weather, if you turn it on.
  • Apple Maps, for travel times, if you turn on Time to leave.

Nothing passes through servers of ours, because there aren't any. Each of these services handles the data under its own privacy policy.

3. What stays on your device

  • Your settings and the list of accounts you've connected.
  • Your sign-ins (access tokens, and the iCloud app-specific password), in the Keychain on the Mac and iPhone and encrypted with the Android Keystore on Android.
  • Upcoming events, so widgets, alerts and notifications work, and on Android a copy of your Microsoft calendars so they show without a connection.
  • If Keep a history of changes is on (it is unless you turn it off), a record of what changed in your events over the last 90 days: titles, times, places and meeting links. Turning it off deletes it.

OnCal doesn't back any of this up anywhere. Your device's own backups (such as iCloud Backup) may include it.

4. Who your data is shared with

Zcentric doesn't receive your data, so we don't share, transfer or disclose it to anyone. We have no copy to hand over, including in response to a legal request.

OnCal itself, running on your device, sends your calendar data (including Google user data) only to the following, and only when you use the feature that needs it:

  • The calendar service it came from (Google, Microsoft or Apple), to show your events and make the changes you ask for, such as creating an event, answering an invitation or adding guests. When you add guests, that service sends them the invitation.
  • Zoom, when you add a Zoom meeting to an event: the event's title, start time and length, so Zoom can create the meeting.
  • Apple Maps, when Time to leave is on: the address in an event's location, to get the travel time.
  • Another calendar of yours, when you set up mirroring: a copy of the event's times, labeled "Busy" or with its title, in the calendar you choose, which may be at a different service (for example, a Google event mirrored into your Microsoft calendar).
  • A file you choose, when you use Export Events.
  • The app you join with, when you click Join: the meeting link opens in your browser or meeting app.

OnCal doesn't send your data to anyone else: no advertisers, data brokers, analytics services or AI providers. The weather feature sends only your rounded location or the city you type, never calendar data.

5. Google user data

OnCal's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • OnCal uses Google Calendar data only to provide and improve the calendar features you use in the app.
  • It transfers Google data only when you ask it to, to provide a feature, and only to the parties listed in section 4.
  • It doesn't use Google data for advertising, doesn't sell it, and doesn't use it to train AI or machine-learning models.
  • No person at Zcentric reads your Google data. We don't receive it at all.

6. How your data is protected

  • Encrypted in transit. Everything OnCal sends and receives goes over HTTPS (TLS), directly between your device and the service.
  • Secure sign-in. You sign in to Google and Microsoft on their own sign-in pages, using OAuth 2.0 with PKCE. OnCal never sees your Google or Microsoft password, and the app contains no client secret.
  • Sign-ins kept in secure storage. On the Mac and iPhone, access tokens and the iCloud app-specific password are stored in the Apple Keychain, readable only by OnCal and only after the device has been unlocked since it started. On Android they're encrypted with AES-256-GCM using a key held in the Android Keystore, which never leaves the phone; a restored backup can't decrypt them, so it asks you to sign in again.
  • Data on your device. Cached events, widget data and the change history are stored only in OnCal's own storage on your device: encrypted by iOS Data Protection on iPhone; in OnCal's private app storage, which other apps can't read, on Android; and in your user account's Library folder on the Mac, which other accounts on the Mac can't open. Your device's own encryption (such as FileVault on the Mac) protects it too.
  • Least access. OnCal asks only for the permissions listed in section 1, and uses them only for the features you use.
  • No servers to breach. Because OnCal has no servers, there's no central store of users' calendar data that could be exposed.
  • Deleted when you remove it. Removing an account deletes its sign-in and events from your device (see below).

To report a security problem, email privacy@zcentric.com.

7. Removing your data

  • Remove an account in OnCal's Settings › Accounts. This signs out, deletes its sign-in from your device, and removes its events from OnCal. Nothing in your Google, Microsoft or iCloud calendar is deleted.
  • Revoke OnCal's access at any time: Google at myaccount.google.com/permissions, Microsoft at account.live.com/consent/Manage (personal accounts) or myapps.microsoft.com (work and school accounts), Zoom in the Zoom App Marketplace under Manage › Added Apps, and iCloud by deleting the app-specific password at account.apple.com.
  • Turn off weather, Time to leave or join detection in OnCal's Settings, or take away location, calendar or automation permissions in your device's settings.
  • Uninstall OnCal to remove what it keeps on your device.

8. Children

OnCal isn't directed to children under 13, and we don't knowingly collect data from anyone, children included.

9. Your rights

Because OnCal doesn't send your data to us, we don't hold personal data about you from the app. If you email us, we use your address and message only to reply. You can ask us about this at any time, and EU and UK residents can also contact their data protection authority.

10. Changes to this policy

If we change how OnCal handles data, we'll update this page and the date at the top before the change reaches the app, and tell you in the app for any significant change.

11. Contact

Zcentric: privacy@zcentric.com. See also the OnCal Terms of Use.