A family calendar with no account

Including CalDAV, Fastmail, Nextcloud and self-hosted servers

There's no Jotcal account. No email, no password, no "create your family" step, nothing to invite anyone to. You install it and it shows you the calendars you already have.

This isn't a privacy flourish. Every family-calendar product that runs on its own account has to solve the same problem, which is getting everyone in your household to sign up for a thing they didn't ask for. Cozi, Skylight and Hearth all do it, and all of them fail in the same place: the one family member who won't install anything. Reading the calendars people already keep skips that entirely, because their phone is already syncing and they don't have to do anything or even know.

How the two platforms connect, and why they differ

These work differently enough that flattening them into one claim would be dishonest, so here they are separately.

On iOS and iPadOS there is nothing to connect. Jotcal reads whatever your device already syncs through the system calendar. You add accounts the normal way, in Settings → Calendar → Accounts, and they appear. Jotcal never sees a password, holds no credentials, and has no sign-in screen of any kind. If you want to cut its access it's Settings → Privacy & Security → Calendars, the same as any other app.

On Android you have four options. Device Calendars does the iOS thing: reads whatever the OS already syncs, one tap, covers Google and Exchange and Samsung accounts. Jotcal can also connect on its own to iCloud, to Outlook, and to any CalDAV server.

Two caveats on that list, both before you install.

Outlook means personal Outlook and Hotmail accounts only. Work and school Microsoft 365 accounts are declined at Microsoft's own sign-in page. That's deliberate: the alternative accepted them and then let a tenant admin policy wall them off afterwards, which reads to a user as a broken app. Widening this later is easy; narrowing it after people rely on it isn't.

There's no Google sign-in inside Jotcal. The Google path is Device Calendars, through the account your Android device already has. The direct integration is built and switched off pending verification of the OAuth client. If you're on a device without working Play services, which is most Boox tablets, this matters and CalDAV is your route instead.

CalDAV, for people who left the big providers

CalDAV is the open standard for calendar sync, and if you've moved off Google deliberately it's probably what you're running. Jotcal takes a server address, a username and a password on Android, and then treats it like any other calendar.

Fastmail, Nextcloud, Posteo, mailbox.org, Radicale, Baïkal and ordinary self-hosted setups all work. A shared household calendar on your own Nextcloud shows up on the kitchen wall and syncs back when someone writes on it, and no part of that touches a server belonging to us.

Credentials are stored on the device. Disconnecting an account in Settings removes them along with the synced data.

On iOS there's no CalDAV setup inside Jotcal because iOS already has one. Add the CalDAV account in iOS Settings and Jotcal reads it. The result is the same, the setup is somewhere else, and that's the pattern for every provider on iOS.

What actually leaves your device

Your calendar events go to your calendar provider, which is where they were always going. They don't come to us. The complete list of what we hold on a server is four kinds of licensing record, all keyed to your device rather than to you:

• a trial record: device identifier, when the trial started, when the record was created, platform
• a purchase record: order ID, device identifier, product ID, purchase token, state, verification details
• a subscription record, only if you hold one, which nobody does yet
• a trial reset note, only if we manually granted you a fresh trial. Most devices have none

No events. No tasks. No notes. No handwriting. No email address. That's not a policy, it's the schema.

Server logs record a device identifier and an order ID on a couple of licensing paths. They're kept no longer than seven days and then deleted automatically, and they're never copied into the database.

Weather, which is the one that involves location

If you turn weather on, something has to know roughly where you are.

On iOS the device fetches its own forecast from Apple WeatherKit directly. Your location never reaches us at all.

On Android it passes through our backend, which rounds it to about a one-kilometre area, uses that to fetch a forecast, and never stores it against your device. Rounded, used, discarded. It's a worse arrangement than the iOS one, and it exists because Android has no free system weather service. Rounding it off to "we don't collect location" would be false.

Weather is off unless you turn it on.

The privacy claims, split by platform

Most apps make one privacy claim and apply it everywhere. Ours differ, so here's each one with its scope attached.

True on both: no Jotcal account, no usage tracking, no ads, and your handwriting never leaves your device. The usage-tracking one is literal rather than aspirational: the analytics code exists as a seam and writes to the local system log only, and Firebase Analytics is deliberately not installed even though Google's own setup guide recommends it.

iOS only: no third-party SDKs at all. Handwriting uses Apple's Vision framework, weather uses WeatherKit, calendars use EventKit. All Apple, all on-device or direct from your device.

Android carries three. Firebase Crashlytics for crash and ANR reports, which is on by default with a switch in Settings → Crash reports and sends crashes rather than behaviour. Google ML Kit for on-device handwriting recognition. Microsoft's MSAL, only if you connect an Outlook account. Firebase Analytics is specifically not among them.

If you see "no third-party SDKs" applied to Android anywhere in our own copy, that's a mistake on our end and I'd like to know about it.

The iOS trial marker

One thing that surprises people, so it's better read here than discovered.

On iOS, the fact that your device has used its free trial is recorded as two bits held by Apple against the device, through Apple's DeviceCheck service. It's separate from our database and it survives deleting the app, which is what stops a reinstall handing out a second trial.

It contains two bits and nothing else. No calendar data, no personal information, nothing that identifies you. If you bought the device second-hand and inherited a used trial, email support@jotcal.app and we'll reset it.

Deleting everything

Delete the app and all on-device data goes with it: events held locally, tasks, notes, handwriting, settings, stored credentials. On Android, Settings > Apps > Jotcal > Storage > Clear Data does the same without uninstalling.

For the server-side licensing records, email support with your Device ID from Settings → About. Full detail on the data deletion page.

What you give up

Having no account costs something, and pretending otherwise would be silly.

There's no Jotcal-side sharing, so the sharing is whatever your calendar provider does. If your household has no shared calendar yet, you'll set one up in iCloud or Google or your CalDAV server first, and Jotcal can't help with that step.

Settings don't follow you between devices, because there's nowhere to keep them. Set up each device once.

And meeting invitations aren't supported yet, so an invite shows as an event you can see and not respond to. That's the largest gap in the product and it's the reason the launch price is what it is.

Related

• Running it on a Boox, where CalDAV matters most because Play services often don't work
• Mounting a tablet as a family calendar
• Why this exists