4 posts tagged with "Privacy"

Android 17 added a welcome permission optimization. Reaching a device on your local network, like a calendar server on a machine in your house, is now its own permission, separate from internet access. An app that can reach the internet no longer reaches your home network by default; it has to ask for that on its own.

KashCal needs it for one thing: syncing with a CalDAV server on your own network. We implemented the new permission, and while wiring it up we noticed KashCal's permissions had ended up spread out, each one surfaced only where its feature lived: contacts near birthdays, notifications near reminders, and now local network near sync. There was nowhere to see them all at once.

So we put them all on one screen. It is called App permissions, and it is in your account hub.

Google keeps a privacy and security checklist for Android developers. Five lists, covering permissions, location, how you handle data, device identifiers, and the privacy controls your app hands back to the user. It's the rubric Android itself recommends you grade against. So we did. Every item, one at a time.

We came out the other side with nothing to fix. Here's the walk-through, because a claim like that is only worth as much as your ability to check it.

Most apps greet you with a wall: sign in, or create an account. A calendar app doing that is quietly asking you to route your dentist appointments, your interviews, and your "lunch??" through a stranger's servers so it can hand them back to you later. KashCal never asks. There is no account, because there is nothing to sign into.

Your calendar is the nosiest app on your phone. It knows about the dentist, the interview you told nobody about, and the event you just labeled "lunch??". It is a diary that schedules your life.

It is also the app that is wide open when you hand your unlocked phone to a friend to "just look at the photo."

KashCal now has App lock. Turn it on, and opening the app throws up a curtain.