Privacy Policy

Effective September 25, 2026. This policy covers the Mysticals desktop app, the Mysticals terminal app (the mysticals npm package) and the website mysticals.sashkoratushnyi.com. Mysticals is an open-source project run by Oleksandr Ratushnyi (“we”). The source code is on GitHub, so every claim here can be checked.

What the apps handle

To show your calendars, the apps connect directly from your device to the providers you add:

• Google accounts. Sign-in happens in your browser through Google’s OAuth. The app receives an access token, a refresh token and your email address.
• CalDAV accounts (iCloud, Fastmail, Private Email or your own server). You enter a server address, a username and an app password.

Where this data lives:

• Credentials (tokens, passwords) are encrypted on your device. The desktop app uses the operating system’s secure storage (macOS Keychain, Windows DPAPI, or the GNOME Keyring or KWallet on Linux). The terminal app encrypts them with AES-256-GCM, with a key held in the OS keychain.
• Calendar data (calendars, events, attendees) is cached in the app’s data folder on your device so the app works offline.
• Accounts stay isolated from each other. The desktop and terminal apps don’t share data.

None of this is sent to us or to anyone other than the provider it belongs to. We don’t operate a backend, and we can’t see your accounts or events.

Google user data

For Google accounts the apps request these scopes:

• openid and email: to show which Google account is connected.
• https://www.googleapis.com/auth/calendar: to read your calendars and events and to create, edit, delete and respond to events when you ask.

Google data is used only to provide these calendar features inside the app on your device. It is never transferred to us or to third parties, never sold, never used for advertising, and never used to train AI or machine-learning models. No person reads it.

Mysticals’ use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

To disconnect, remove the account in the app. That deletes its tokens and cached events from your device. You can also revoke access at any time at myaccount.google.com/permissions.

Anonymous usage stats in the apps

To know how many people use Mysticals, the apps send two events to PostHog, hosted in the EU:

• app_installed, once, on first launch.
• account_added, when you add an account. This includes the provider type (Google or CalDAV) and which preset you picked (iCloud, Fastmail, Private Email or custom).

Each event carries the app (desktop or terminal), its version, your OS and CPU architecture, and a random ID generated on your device. That’s all. No emails, names, server addresses, calendars or events. GeoIP lookup is disabled and PostHog is set to discard IP addresses.

To turn the stats off:

• Desktop: Settings → Privacy → uncheck “Share anonymous usage stats”.
• Both apps: set MYSTICALS_TELEMETRY=0 or DO_NOT_TRACK=1 in your environment.

This website

The website counts page views and download-button clicks with PostHog (EU). It sets no cookies and stores nothing in your browser: analytics state lives in memory and is gone when you close the tab. There’s no session recording, and a Do Not Track signal turns analytics off. Fonts are loaded from Google Fonts, which receives your IP address as part of the request.

Other services the apps contact

• Google (accounts.google.com, googleapis.com) and your CalDAV server: your calendar data, under their own privacy policies.
• GitHub: the desktop app checks for new releases on api.github.com and downloads updates from GitHub Releases.
• npm: the terminal app checks registry.npmjs.org for a newer version.
• PostHog (EU): the anonymous stats above.

These update checks send no personal data beyond what any HTTP request contains, like your IP address.

Deleting your data

Everything is on your device, so you’re in control. Remove an account in the app to delete its credentials and cache. To remove everything, delete the data folder:

• Desktop: ~/Library/Application Support/mysticals on macOS, %APPDATA%\mysticals on Windows, ~/.config/mysticals on Linux.
• Terminal: ~/Library/Application Support/mysticals-terminal on macOS, %APPDATA%\mysticals-terminal on Windows, ~/.local/share/mysticals-terminal on Linux (or $MYSTICALS_HOME).

We hold no copy of your data, so there is nothing for us to delete. The anonymous stats can’t be tied to you, but if you send us the random ID from the telemetry-id file in the data folder, we’ll delete its events.

Children

Mysticals isn’t directed at children under 13 and we don’t knowingly collect their data.

Changes

If this policy changes, we’ll update this page and its effective date. The history of every change is in the public repository.

Contact

Questions or requests: forcewizu@gmail.com.