Private where it matters most.

Calendar and notification data

Can’t Miss does not send its license service your event titles, descriptions, times, attendees, RSVP state, locations, meeting links, calendar names, notification contents, exclusions, snoozes, or delivery history. Google and Microsoft refresh tokens stay in macOS Keychain; short-lived access tokens remain in memory and are sent only to the relevant provider over HTTPS. The app does not create, edit, or delete calendar events.

Google user data

This section applies when you choose to connect a Google Calendar account directly to Can’t Miss. The connection is optional. Can’t Miss requests the openid, email, calendar.calendarlist.readonly, and calendar.events.readonly scopes. It does not request a Google Calendar write scope.

Google data the app accesses

Can’t Miss accesses your stable Google Account identifier, email address, email-verification status, and any name or profile fields Google returns. It reads calendar-list metadata such as calendar identifiers and names, descriptions, locations, time zones, colors, access roles, and visibility or status fields. For calendars you select, it reads upcoming event identifiers and recurrence data, status and event type, titles, descriptions, locations, start and end times and time zones, attendee names and email addresses, whether an attendee is you, RSVP status, and video-conference or meeting-link details. The app retrieves a bounded upcoming window—normally about the next seven days—and refreshes it about every five minutes, when you request a refresh, and after relevant app or system lifecycle changes.

How the app uses Google data

The app uses Google Account data to identify the connected account on your Mac. It uses calendar-list data to let you choose calendars. It uses event data only to show your upcoming schedule, decide whether an event is eligible for an alert, avoid alerts for canceled or declined events, detect supported meeting links, and present the full-screen alert, snooze, exclusion, and Join features you request. Can’t Miss does not use Google user data for advertising, analytics, profiling, credit decisions, or training or improving a general-purpose artificial-intelligence or machine-learning model.

Sharing, transfer, and disclosure

Google user data travels directly over HTTPS between the Can’t Miss app on your Mac and Google’s OAuth, identity, and Calendar API endpoints. It is not sent to Can’t Miss’s publisher, license service, Cloudflare, Stripe, Resend, Microsoft, advertisers, analytics providers, data brokers, or information resellers, and it is not sold. Can’t Miss does not permit a human to read Google user data through any publisher-operated system because the publisher does not receive it. If you choose Join, macOS opens the event’s meeting URL in the destination browser or meeting app as an action you initiated. We would otherwise disclose specific Google user data only if you affirmatively send it to us for support, if necessary to address a security issue with the consent required by law and Google policy, or if legally required.

Protection of Google data

Can’t Miss uses Google’s system-browser OAuth flow with PKCE, a random state value, and a temporary loopback callback restricted to your Mac. Google API requests use HTTPS. Short-lived access tokens are kept only in memory. The longer-lived refresh token is stored as a non-synchronizing, device-only item in the macOS Data Protection Keychain and is never stored in ordinary app preferences. Non-credential account metadata, calendar choices, exclusions, snoozes, and delivery records are restricted to the app’s macOS sandbox. The app requests read-only Calendar scopes, includes no advertising or analytics SDK, and does not intentionally write Google user data to application logs.

Retention, revocation, and deletion

Complete fetched event snapshots are processed in memory and are not saved as a general event cache; quitting the app discards them. Calendar-list results may remain in memory for up to about 15 minutes. Access tokens remain only until they expire, are replaced, or the app quits. The Google refresh token and connected-account metadata remain on your Mac until you disconnect the account. Calendar selections remain locally until you change them or disconnect that account. Reminder-delivery records contain scoped calendar and event identifiers and dates rather than event titles or descriptions; records older than about 30 days and expired snoozes are automatically removed. An exclusion you create can retain the event title, calendar name, identifiers, and relevant dates until you restore that exclusion or delete the app’s local data.

To stop access and delete the connected Google account data held by Can’t Miss, open Settings > Calendars > Accounts and disconnect the Google account. Can’t Miss then deletes its local Keychain refresh token, connected-account metadata, and saved calendar selections, clears in-memory data, and makes a best-effort request to Google to revoke the token. If the Mac is offline or revocation does not complete, remove Can’t Miss under your Google Account’s third-party connections. To delete retained exclusions, use Settings > Exclusions and restore them. Because Can’t Miss does not upload Google user data to a publisher-operated server, there is no server-side copy for us to delete. Contact support@cantmiss.app if you need help completing these steps.

Can’t Miss’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Purchase and recovery email

Stripe Checkout collects the purchase email, payment method, billing details, and ordinary transaction information under Stripe’s privacy terms. Can’t Miss does not receive complete card details. We receive the email plus Checkout, payment, charge, refund, and dispute identifiers and status needed to verify the exact product and payment, deliver the entitlement, prevent duplicate fulfillment, provide support, and handle refunds or reversals. The customer email is stored as an encrypted value plus a keyed lookup digest.

To recover after a reinstall or Mac replacement, the account page receives the submitted purchase email, a Cloudflare Turnstile result, and public pairing material generated by the app. A recovery code has a keyed HMAC verifier; its plaintext exists server-side only inside the encrypted email outbox payload until delivery processing. Codes expire after 15 minutes and allow five incorrect attempts.

Service providers

Cloudflare runs the website, Turnstile, license API, database, queues, and per-license authority. Stripe provides hosted checkout and payment processing. Resend delivers purchase, recovery, and security email with open and click tracking disabled. Google or Microsoft processes direct calendar requests only when you connect the corresponding account. These providers can process ordinary connection metadata, including IP addresses, under their own terms.

Aggregate distribution metrics

The website increments an aggregate hourly total when it successfully serves the primary DMG or ZIP download. It does not add IP addresses, user agents, cookies, or other request metadata to that total. Health checks and resumed range requests are excluded. On the first launch of a newly created local installation, the app makes one best-effort request containing its app version and a random event ID. The random ID makes a network retry idempotent; it is not derived from the installation key, device, network, calendar, account, or customer record. The service adds the event to an aggregate hourly installation total and deletes the random retry receipt after seven days. Aggregate hourly totals are retained for up to about 400 days. These counters are used only to understand software distribution and are not used for advertising, profiling, or tracking behavior.

Operational records and retention

The Can’t Miss licensing database does not retain raw IP addresses. Short-lived abuse counters use keyed digests, are retained for at most two enforcement windows, and are purged by the next five-minute maintenance run. An encrypted recovery-code payload is erased as soon as Resend accepts it. Other encrypted notice payloads are erased when a signed delivery receipt arrives; without one they are normally removed within about 48 hours of provider acceptance. If delivery bounces or fails, the encrypted notice remains available for a bounded signed retry and is normally erased within about 72 hours of that failure. A complaint or suppression erases the payload and is never automatically retried. Redacted delivery receipts and opaque delivery-attempt records are removed within about 31 days. Completed or expired recovery sessions and other delivery records are removed on scheduled retention cycles. Security projections are generally retained for up to about 91 days after resolution, and publisher audit records for up to about 366 days. Per-license authority, customer, purchase, refund/reversal, entitlement, and activation state remains as needed to prevent replay, preserve revocation, provide recovery and support, meet accounting or legal duties, and enforce the license.

One seat, transfer, and revocation

A paid license authorizes one active installation. Recovery transfers that seat to the newly paired installation and prevents the previous installation from renewing; an already cached signed lease may continue only until its seven-day maximum expiry. Divergent reuse of a rotating credential can quarantine a license so a copied credential cannot silently renew forever. The verified owner can recover a quarantined license; a license permanently revoked by the publisher cannot renew.

Website

This site contains no advertising pixels, cookies, or client-side analytics JavaScript. It keeps only the aggregate download totals described above. Its Buy button sends an empty request to the Can’t Miss API, which creates a Stripe-hosted Checkout Session; payment and email fields are entered only on Stripe’s page.

Contact and requests

For privacy questions or a request concerning your customer record, email support@cantmiss.app. Some records may need to be retained for security, accounting, tax, refund, or fraud-prevention obligations.