Privacy Policy

Last updated: July 29, 2026

This Privacy Policy explains how Harang App — the shared identity behind the open-source Obsidian plugins Harang Calendar and Harang Contacts (together, the "Plugins") — accesses, uses, and stores data, including data obtained through Google APIs.

The short version: the Plugins run entirely on your own device inside Obsidian. There is no Harang App server. Your calendar and contact data travels directly between your device and your CalDAV/CardDAV server or Google's servers, and any account tokens are stored only in Obsidian's built-in secure storage on your device.

Who we are

The Plugins are developed and published by an individual developer ("search5") as open-source software. Source code for both Plugins is public on GitHub: harang-calendar and harang-contacts.

What data the Plugins access

Depending on which accounts you connect in the Plugins' settings, they access:

Calendar and event data from a CalDAV server you configure, or from your Google Calendar.
Contact data from a CardDAV server you configure, or from your Google Contacts.
Your Google account email address, to display which account is connected in the settings screen.

Currently, the Plugins only read this data — they do not create, modify, or delete anything on your calendar, address book, or Google account. A future version is planned to add two-way sync, letting you create and edit events or contacts from within Obsidian and push those changes back to your calendar or address book. If and when that ships, this policy will be updated to reflect it before the new functionality is enabled.

Google user data and OAuth scopes

When you connect a Google account, each Plugin requests only the scopes it needs to display your data, using Google's OAuth device authorization flow (so it also works on Obsidian mobile, where no browser redirect is possible):

Plugin	Scope	Why it's needed
Harang Calendar	`https://www.googleapis.com/auth/calendar`	Currently used read-only: list your Google calendars and read events from them to display inline in your notes. A read-only scope is not requested instead because a planned two-way sync feature will let you create and edit events from Obsidian and push those changes back to Google Calendar.
Harang Contacts	`https://www.googleapis.com/auth/contacts`	Currently used read-only: read your Google Contacts so they can be displayed inline in your notes. A read-only scope is not requested instead because a planned two-way sync feature will let you create and edit contacts from Obsidian and push those changes back to Google Contacts.
Both	`https://www.googleapis.com/auth/userinfo.email`	Show which Google account is currently connected in the Plugin's settings screen.

How data is stored

Account credentials and Google tokens (CalDAV/CardDAV passwords, OAuth access and refresh tokens) are stored only on your device, in Obsidian's built-in secret storage — the same OS-level secure storage Obsidian itself uses. They are never sent anywhere except directly to your CalDAV/CardDAV server, or to Google's own token endpoint to refresh access.
Calendar and contact data fetched for display is cached locally inside your Obsidian vault, purely so your notes render without a network request every time. This cache stays on your device.
Neither Plugin sends any data to a server operated by us — there isn't one. All requests go directly from your device to the server you configured (your CalDAV/CardDAV server, or Google).

Data sharing

We do not sell, rent, or share your data with any third party. We do not operate any analytics, advertising, or tracking in the Plugins.

Data retention and deletion

Disconnecting an account in the Plugin's settings removes its stored credentials/tokens and locally cached data from your device. You can also revoke the Plugins' access to your Google account at any time from your Google Account permissions page. Uninstalling a Plugin removes all of its locally stored data along with it.

Limited Use disclosure

Harang App's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Children's privacy

The Plugins are not directed at children and are not knowingly used to collect data from children.

Changes to this policy

If this policy changes, we'll update the "Last updated" date above. Continued use of the Plugins after a change constitutes acceptance of the revised policy.

Contact

Questions about this policy or how the Plugins handle data can be sent to search5@gmail.com.