Privacy & permissions
The calendar has no server of its own. What it keeps lives in its own private storage on your phone. Anything it sends goes to a service you chose or to your own account. The suite's shared privacy picture is on privacy across the suite; this page is the calendar's own.
Permissions, and why
Nothing is asked on first launch. Each permission is asked the moment something needs it. You grant or withdraw them in the phone's own app settings.
| Permission | What it's for | When it's asked |
|---|---|---|
| Internet | ask the sky (the calendar's AI assistant), Google Drive and travel, the weather, and searching places on the map | — |
| Read and write calendars | the phone's own calendars, only when you link an almanac — one of your calendars, a coloured layer of commitments — to one | when you link, from an almanac's "what comes in" or "make zenith your calendar" |
| Approximate location | real daylight on the day globe, my sky (the real stars over where you are, Gold) and the weather | the first time the day view opens with no saved place, or when you turn on my sky |
| Notifications | reminders and bells | once, when you place your first commitment — anything on your calendar (Android 13 and later) |
| Vibrate | haptics | — |
| Start at boot | setting the bells again after a restart | — |
| Exact alarms | reminders to the minute | granted on install to calendar apps |
| The suite's permission | only apps signed as the Zenith Suite can hold it; it guards what they share | — |
Without a saved place, the day globe draws daylight as if you were 40° north.
What the calendar does not ask for:
- No microphone. Speaking goes through the phone's own speech screen.
- No contacts. You pick people one at a time with the phone's contact picker, "☌ someone from your contacts". It hands back only the person you chose, and the calendar reads only their name and link.
What stays on the phone
- Your almanacs and commitments. For an almanac linked to a phone calendar, the commitments live in that calendar, and Zenith keeps a side record of what it adds.
- Material — files attached to your almanacs — and pictures worn as marks.
- The journal.
- Remembered talks, when chat memory (Gold) is on — the last 200 lines.
- The safety log: blocks, reports, and phrases learned from reports.
- Your settings, including the place saved for daylight, my sky and the weather.
- Your consent record: which AI companies you said yes to, and when.
- Your notification switches.
- Your AI keys and the Shuttle — the suite's shared tray for passing text and files between Zenith apps. These are held by one Zenith app for the whole family, or by the calendar when it is the only one. Keys are stored only encrypted.
The calendar never sends safety reports, the safety log, remembered talks or the journal anywhere. They travel only inside the phone's own backup or a file you send yourself.
What can leave the phone
- Ask the sky → the AI service you chose, with your key. Ask the sky is the calendar's AI assistant. Your words go, with the recent talk, today's date, a screen line when "⌗ screen" is on, and what the sky looks up to answer: commitment titles, days, times, places, almanac names and settings. The first send to each company asks first, and a no sends nothing. The on-device model sends nothing.
- Words you speak, select, share or drop → the AI service, to read a commitment out of them. Only while AI is on and you have said yes; otherwise the phone reads them itself.
- An almanac you "carry in your drive" → your own Google Drive. The whole almanac and its material, sent up as the app leaves the screen and brought down at most every 15 minutes. Only files the calendar made are touched. Nothing goes while "nothing leaves this phone" is on or that almanac's copy is paused.
- A travelling almanac → a Google calendar in your own account. Travel moves an almanac's commitments there, so your other devices have them. Google is asked to make that calendar only when you tap to make it.
- A linked almanac → its phone calendar, as its "what goes out" says. After that, it's up to that calendar's own account.
- Weather → Open-Meteo. Your saved place, rounded, at most every 30 minutes while the app is open. No key and no name.
- Place searches → OpenStreetMap. The words you type and the area the map shows.
- A "remote .zen" card or almanac → your Drive, where anyone who receives the file can open its materials.
- Google sign-in → Google. "connect google" asks only for the Drive files Zenith makes and your email.
- The phone's own backup. Android may include the calendar's data, except the Gold unlock, anything held back, and this install's own id.
- What you send yourself — a share, a card, an exported file, a backup, the safety log, a support email — goes only where you send it.
People who join a commitment are never written into a phone or Google calendar. They stay in Zenith's own files. The sky's replies can name them, so the names can reach your AI service.
Your AI, your control
- Your key goes only to the one service the calendar uses, never another company.
- With "zenith ai in this app" off, the sky is hidden, nothing goes to an AI, and no other Zenith app can act on this calendar.
- "allow destructive actions" starts off. Even on, the sky asks "allow it?" each time. It never types or saves a key and never says yes for you.
The two overrides, "nothing comes in" and "nothing leaves this phone", are in the panel of the binder — the page where all your almanacs live — and in quick settings. "privacy ↗" on Settings › safety and "privacy policy ↗" on Settings › about open the suite's privacy policy.
See also. Privacy across the suite · Safety, consent & destructive actions · What comes in, what goes out · Shared keys & connected accounts