Integrations · Help
Google Calendar — two-way sync.
ConKarma can two-way-sync your cell calendar with a Google Calendar of your choice. This article covers exactly which OAuth scopes we ask for, what we read, what we write, what we never touch, how to revoke access in one tap from either side, and what the underlying privacy posture looks like.
Google Calendar two-way sync lets ConKarma mirror your cell calendar with a Google Calendar of your choice, reading and writing events on only the one calendar you pick. On first sync, the Google consent screen shows exactly two scopes: a read-only calendar list (so you can choose which calendar to sync) and calendar events (to read and write on the chosen calendar). We never request full read across all calendars, sharing controls, Gmail, Drive, or Contacts.
Synced event data is field-encrypted at rest in your cell's isolated partition and is never aggregated across cells for analytics. You can revoke access instantly from either side — inside ConKarma under Integrations, or from your Google account's third-party access page. Children under 13 cannot connect Google Calendar.
Which OAuth scopes ConKarma requests
On first sync, the Google consent screen will show two scopes: (1) https://www.googleapis.com/auth/calendar.calendarlist.readonly — to list the calendars on your account so you can pick which one to sync; (2) https://www.googleapis.com/auth/calendar.events — to read and write events on the calendar you pick. We do NOT request calendar.readonly (full read across all your calendars), calendar.acls (sharing controls), calendar.settings.readonly, contacts, gmail, drive, or any other Workspace scope. The OAuth consent dialog will spell out exactly what we asked for; if you see anything beyond those two scopes, it is not from ConKarma — cancel and report it to security@conkarma.app.
What we read
From the calendar you picked: event title, start / end / timezone, location (only if you opt in to location sync per Settings → Integrations → Google Calendar → Sync location field), description, recurrence rule, the list of attendees (only to render avatars in the cell view — we never email or notify them), and reminder offsets. We do NOT read the visibility / privacy class of events flagged "private" on Google's side; those are skipped entirely. We do NOT read attached files, conference data (Google Meet URLs are stripped from event descriptions before they enter the cell view), or comments.
What we write
When a cell member creates or edits an event on the ConKarma side, we write it back to the synced Google Calendar with: title, start / end / timezone, description (with a "Created in ConKarma" footer line so external collaborators know the origin), and reminders. We do NOT write attendees from outside the cell, do NOT create new attendee invitations on the Google side, and do NOT modify events created outside ConKarma (events we did not author are read-only on the ConKarma side; edits surface a clear "this event is read-only from Google's side" notice).
What we never touch
We never touch: other calendars on your account; calendar sharing permissions; account-level settings; Gmail; Google Drive; Google Contacts; Google Meet conference details; the Google Workspace admin console (when present); any third-party calendar integrations Google may have installed (Zapier, etc.). The scope set above is the structural enforcement — Google will refuse any API call outside the scopes we asked for.
One-tap revocation
Two revocation paths, both work instantly: (1) Inside ConKarma — Settings → Integrations → Google Calendar → Disconnect. We delete the stored OAuth tokens immediately and notify Google's OAuth endpoint to revoke our grant. The cell-side mirror of the synced events stays until you delete the cell calendar separately. (2) From Google's side — myaccount.google.com → Security → Third-party apps with account access → ConKarma → Remove access. This invalidates our tokens server-side; the next sync attempt will fail cleanly and surface a re-auth prompt in the cell. Neither path leaves residual data on Google's side that we control.
Privacy posture
Synced event data is field-encrypted at rest on our side and stored in the cell's isolated row-level-security partition. We do not aggregate calendar data across cells for any analytics purpose. The Google Calendar API is listed as a sub-processor at /legal/subprocessors. The privacy policy describes the integration at /privacy §6 (Integrations). Children under 13 cannot connect Google Calendar at all — the integration is gated on COPPA-verified adult consent per cell.
Quiet-hours + ADR-108 sleep-window respect
Reminders from synced Google Calendar events still respect the cell's declared quiet-hours and the ADR-108 sleep-window protection — a Google-side reminder set for 2 am will not push-notify a kid cell member during their sleep window; it surfaces silently on the next morning's open instead. The same gate applies to safety-critical reminders only when the originator opts them in as such.
Troubleshooting
Sync stuck: Settings → Integrations → Google Calendar → Sync now (manual trigger; bypasses the background backoff). Permission denied after a Google password change: re-auth from the same screen; the new token replaces the old one cleanly. Duplicate events: Settings → Integrations → Google Calendar → Deduplicate cell view (one-shot pass that hides duplicates without deleting them on Google's side). Anything else: /support; we read the bug-report channel within one working day.
Frequently asked questions
Which permissions does ConKarma ask Google for?
Just two scopes: a read-only calendar list so you can pick a calendar, and calendar events to read and write on the one you choose. We never request full cross-calendar read, sharing controls, Gmail, Drive, or Contacts; if the consent dialog shows anything beyond those two, cancel and report it to security@conkarma.app.
Can ConKarma change events I created directly in Google Calendar?
No. Events we didn't author are read-only on the ConKarma side, and editing one surfaces a clear notice. We also never add outside attendees or create new invitations on the Google side.
How do I disconnect the sync?
Two instant paths. Inside ConKarma, go to Settings, Integrations, Google Calendar, Disconnect, which deletes the stored tokens and revokes our grant. Or from Google's side, use myaccount.google.com, Security, Third-party apps, ConKarma, Remove access.
Will calendar reminders wake up a kid during sleep hours?
No. Reminders from synced events respect your cell's quiet-hours and the sleep-window protection, so a 2 am Google reminder won't push-notify a kid cell member; it surfaces silently on the next morning's open instead.