Privacy Policy

Last updated: August 26, 2026

Bloocky is a free, open-source calendar plugin for Neovim, developed and maintained by Átila de Freitas (“we”, “the developer”). This policy describes what data Bloocky handles and — more importantly — what it does not.

The short version: Bloocky runs entirely on your machine. The developer operates no servers, collects no data, and never sees your calendar.

What Bloocky is

Bloocky is local software you install and run yourself. It stores your time blocks as plain JSON files on your own computer. There is no Bloocky account, no cloud service, no analytics, and no telemetry of any kind.

Data Bloocky handles locally

All of the following stays on your device, in files readable only by your user account (mode 0600 where applicable):

• Time blocksyou create (titles, times, notes), stored in Bloocky’s local data file.
• Calendar credentials you configure (CalDAV passwords, OAuth client secrets), which you are encouraged to keep in your system keyring rather than in configuration files.
• OAuth tokens for calendar providers, stored at stdpath("state")/bloocky/tokens.json.
• Sync sidecar files used to track synchronization state.

The developer has no access to any of this.

Google user data

If you connect a Google Calendar account, Bloocky uses the Google Calendar API with the narrowest scopes that work:

• https://www.googleapis.com/auth/calendar.events — to read and edit calendar events;
• https://www.googleapis.com/auth/calendar.calendarlist.readonly — to list your calendars so you can choose which ones to sync.

Bloocky deliberately does not request the broad calendar scope, which would allow deleting entire calendars.

How that data is used:

• Calendar events are transferred directly between your device and Google’s servers. No third party — including the developer — is in the path.
• Event data is used solely to display your calendar inside Neovim and to write back changes you make. It is not used for any other purpose.
• Google data is never sold, never transferred to third parties, never used for advertising, and never used to train machine-learning models.
• OAuth tokens are stored only on your device and are scrubbed from any diagnostic output Bloocky prints.

Bloocky’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Other calendar providers

CalDAV accounts (Fastmail, iCloud, Nextcloud, Mailbox.org, self-hosted servers, and others) work the same way: your device talks directly to the server you configured, over TLS. Bloocky refuses plain HTTP except to localhost and never disables certificate verification.

Companion app sync (local network)

If you enable the optional companion-app bus, Bloocky serves your time blocks over your local network only, protected by a pairing token you create via QR code. Tokens are stored hashed. This traffic never leaves your LAN and never touches the developer’s infrastructure — the developer has none.

Data retention and deletion

You are in full control:

• Delete Bloocky’s local data files to remove all blocks and sync state.
• Delete tokens.json (or run the relevant revoke steps) to remove stored OAuth tokens.
• Revoke Bloocky’s access to your Google account at any time at myaccount.google.com/permissions.

Because the developer stores nothing, there is nothing for the developer to delete on your behalf.

Children

Bloocky is a developer tool and is not directed at children under 13.

Changes to this policy

Changes will be published in the Bloocky repository, with the “Last updated” date revised. Material changes will be noted in release notes.

Contact

Questions about this policy: open an issue at github.com/atiladefreitas/bloocky.