Security & Trust

1. The architecture, in one minute

InstaCal is a native app for Mac, iPhone, iPad, and Apple Watch, sold once through the App Store. It reads calendars two ways, both of which keep your data inside infrastructure your organization already controls:

• Apple Calendar (EventKit). InstaCal displays whatever accounts macOS or iOS already syncs — iCloud, Exchange, CalDAV subscriptions — through Apple's on-device framework. InstaCal never talks to those servers itself.
• Directly connected Google and Microsoft 365 accounts. Sign-in uses standard OAuth 2.0 with PKCE in the system browser sheet (ASWebAuthenticationSession), so InstaCal never sees your password. Tokens are stored in the Apple Keychain, and sync requests go from your device straight to googleapis.com or graph.microsoft.com.

There is no InstaCal account to create, no Higher Bar server in the sync path, no token-broker service, and no push-notification relay — event alerts are scheduled locally on the device. The app contains no analytics SDK, no crash-reporting SDK, and no advertising code. Its only third-party dependency is one open-source keyboard-shortcut library that performs no networking.

When an employee leaves or a review changes, your admins keep control: InstaCal appears in the Google Workspace and Microsoft Entra consoles as an ordinary OAuth application that can be audited, allowlisted, or revoked centrally, exactly like any other client of those APIs.

2. Every network connection the app can make

This is the complete list. Each row happens only when the named feature is used, every connection is HTTPS, and App Transport Security is not relaxed anywhere in the app.

What is deliberately absent: no analytics or telemetry endpoints, no crash reporters, no ad tech, no CDN-hosted scripts inside the app, no license-activation server, and no developer push servers. If a work calendar never enables weather or a direct account connection, InstaCal's only recurring connection is Apple's own EventKit sync, which the OS performs.

3. What Apple enforces, not just what we promise

Most of the guarantees above are not self-attestation — they are enforced or verified by Apple's platform and distribution rules:

• App Store privacy label: “Data Not Collected.” Our App Store listing declares that the developer collects no data from this app. That declaration is a public commitment Apple requires to be accurate, backed by the privacy manifest compiled into every InstaCal binary, which declares no tracking, no tracking domains, and no collected data types.
• App Sandbox. The Mac app ships with the App Store's mandatory sandbox; iPhone, iPad, and Watch apps are always sandboxed. InstaCal can touch only what its entitlements grant: network client, calendars, contacts, location, WeatherKit, iCloud key-value storage, and its own app group. The Mac widget extensions have no network entitlement at all — they can only read the snapshot the main app writes.
• OS-level consent. Calendar, reminders, contacts, and location access each require an explicit system permission prompt, and every grant is revocable any time in System Settings → Privacy & Security. The operating system, not the app, is the gatekeeper.
• Signed, reviewed distribution. Every build is code-signed to Higher Bar, LLC, reviewed by Apple, and delivered only through the App Store's update pipeline. There is no self-updater to vet, and Apple can revoke a malicious binary globally.
• Manageable deployment. Because InstaCal is a standard App Store app, IT can purchase, deploy, update, and revoke it through Apple Business Manager and any MDM, like any other managed app.

4. AI that never phones home

InstaCal's natural-language event entry ("Lunch with Sam Friday 1pm") uses Apple Intelligence on the device — Apple's FoundationModels framework on macOS 26 and iOS 26 — not a cloud AI service. There is no OpenAI, Anthropic, Google Gemini, or any other AI vendor SDK, API key, or endpoint anywhere in the app.

• What the on-device model sees: the single line of text you typed, your calendar names, the current date, and your language — nothing else. Your existing events, notes, and attendees are never put into any AI prompt.
• Nothing retained: the model session is discarded after each parse. Because the model runs on the device, "zero data retention" is structural — there is no AI vendor to have a retention policy.
• Fully optional: on systems without Apple Intelligence, or with it turned off, InstaCal falls back to its built-in on-device parser, which works in 12 languages. No functionality routes around your choice.

5. Where data lives on the device

• OAuth tokens for connected Google/Microsoft accounts live in the Apple Keychain and are deleted when you disconnect the account.
• Cached events for connected accounts are stored inside the app's sandbox container so the app stays responsive offline; widget and Watch snapshots live in the app's own app-group container, readable only by InstaCal's extensions.
• Encryption at rest comes from the platform: FileVault on macOS and iOS file-based data protection, the same protections that cover Apple's own Calendar database.
• Apple Watch receives its snapshot device-to-device over Apple's Watch Connectivity — no server involved.
• Deleting the app deletes its local data, subject to normal Apple backup and Keychain behavior. There is nothing to delete on our side, because nothing was ever sent to us.

6. Verify it — don't take our word for it

Every claim on this page is falsifiable with tools your security team already uses:

• Watch the traffic. Point Proxyman, Charles, mitmproxy, or Little Snitch at InstaCal. With no accounts connected and weather off, you should see no recurring connections at all. Turn features on one at a time and you'll see exactly the hosts in section 2 — and nothing else. If you ever observe a host not on that list, that's a bug: report it and we will fix it.
• Read the entitlements. codesign -d --entitlements - "/Applications/InstaCal.app" prints the sandbox and permission grants described in section 3.
• Check the label. The App Store listing's privacy section is Apple-hosted and states "Data Not Collected."
• Audit the OAuth grant. After connecting a test account, InstaCal appears in Google Workspace's or Microsoft Entra's third-party app reports with exactly the scopes listed in section 2.

7. Certifications, honestly

We do not hold SOC 2, ISO 27001, or FedRAMP certifications, and we won't pretend a badge where there isn't one. Those audits primarily examine the controls around a vendor's servers, staff, and hosted customer data. InstaCal has no servers holding customer data, no staff with access to your calendar, and no hosted service to audit — the surface those certifications exist to measure is absent by design.

What we offer instead is a smaller, verifiable claim: your calendar data never reaches us. Section 6 shows how to confirm it in an afternoon, without our cooperation. For organizations that need paperwork, we will complete your security questionnaire (SIG Lite, CAIQ, or your own form) on request — most answers are "not applicable: no customer data is stored, processed, or transmitted by the vendor," and we answer the rest specifically.

9. Reporting a vulnerability

If you believe you've found a security issue in InstaCal or on this website, email support@higherbarapps.com with "Security" in the subject line. We aim to acknowledge reports within three business days, and fixes ship to all users through App Store updates.

We support good-faith security research: if you make a reasonable effort to avoid privacy violations and service disruption while investigating, we will not pursue action against you for it. A machine-readable contact is published at /.well-known/security.txt per RFC 9116.

For the formal statement of the app's data practices, see the InstaCal Privacy Policy.