Trust Center

How hora Calendar handles your calendar data, where it is stored, and what leaves your Mac.
Last updated: September 17, 2026

hora Calendar talks to Google Calendar directly from your Mac. Your events, your contacts and your OAuth tokens stay on the device. This page explains in concrete terms what the app does locally, the three narrow jobs our servers do, and what those servers cannot see even if we wanted them to.

The short version

  • Your calendar data is stored on your Mac with SwiftData. It never passes through a hora sync server.
  • OAuth tokens live in the macOS Keychain, protected by your system login, and never leave the device.
  • hora requests the minimum practical scopes for the features you actually enable.
  • We do not operate a general-purpose backend that stores your calendar or meeting content.
  • All communication with the Google, Zoom and Microsoft APIs is encrypted in transit with HTTPS.

Direct sync, not a middleman

Many third-party calendar clients sync through the vendor's own servers: your account is connected on their infrastructure, your events are mirrored there, and the app talks to that copy. hora does not work that way. The app holds its own credentials and calls the Google Calendar API itself. The optional Zoom and Microsoft Teams integrations work the same way — those calls are made by the app on your Mac, with tokens that never reach us.

Locally cached data stays inside the macOS app sandbox. Signing out in hora Settings removes the stored tokens and the cached data, and uninstalling the app removes its data from your Mac.

What our servers actually do

The website has exactly three responsibilities for the Direct build of hora. Each one is deliberately narrow, and none of them involves your calendar.

Resolving your billing identity

When a Direct purchase needs to know who you are, the app sends one fresh Google ID token. Our server verifies its signature against Google's public keys, checks the issuer, audience, expiry and subject, and then derives a stable, opaque identifier from it using HMAC-SHA256. What comes out looks like this:

usr_direct_v1_ followed by an opaque digest.

That identifier is all our payment provider ever sees. Your Google subject, your email address and the raw token are never returned to the app, never sent onward, and never written to a log.

Registering your device for entitlement push

When your subscription state changes, your Mac needs to hear about it. The app sends its Apple Push Notification service device token together with the same short-lived Google ID token. The server derives the opaque identifier itself — the request rejects any user identifier supplied by the client — and forwards a register or unregister command to a private endpoint over HTTPS using a dedicated secret. The device token is handled as opaque bytes.

Resolving the download

A Direct download link does not point straight at a file. The resolver fetches the signed release manifest and validates the exact host, the immutable release path, the version, the build, the file name and the SHA-256 checksum. Only then does it issue a redirect. The Direct build is notarized by Apple and updates through the Direct release channel.

What the entitlement push path cannot do

  • It cannot read your calendar. No event, guest or meeting data is ever sent to it.
  • It cannot read your Google account. The only Google credential our servers ever handle is a short-lived ID token, used once to confirm who you are and then discarded.
  • It cannot work backwards to your identity. The identifier it stores is a keyed hash, so there is no lookup from it to your email address or Google account.
  • It cannot be pointed at someone else's device. A registration can only ever attach to the verified account that made the request.

Payments

Direct checkout and licence management are handled by RevenueCat and Paddle. Paddle is the merchant of record for Direct purchases, and we never see or store your card details. Mac App Store and Setapp purchases are handled entirely by Apple and Setapp under their own terms. What you are entitled to get back, and when, is set out in Refunds & Cancellations.

The website is not the app

The hora Calendar app sets no cookies and does no advertising tracking. This marketing website is a different matter and is measured: Google Ads conversion tracking if you arrive from an ad, and PostHog both for product analytics and as the intake for the support form. The full breakdown, including exactly what a support request contains and how long it is kept, is in the Privacy Policy.

Questions

If something here is unclear, or you want evidence for a specific claim, write to support@horacal.app.