Privacy policy

What Perch does

Perch is a native macOS menu bar app that shows your next Google Calendar meeting and a countdown. It talks to the Google Calendar API directly from your Mac with two read-only scopes. Perch cannot create, edit, or delete events, and there is no Perch server in the middle.

What Perch reads, exactly

Two granular read-only scopes. Google shows each as its own checkbox when you sign in, and Perch needs both:

• calendar.calendarlist.readonly, the list of calendars you are subscribed to. Perch reads each calendar's name, color, and ID, so Settings can offer you the list and the dropdown can color-code events. The primary calendar's ID is your account's address, which is how Perch labels your accounts without asking for an email or profile scope.
• calendar.events.readonly, the events on those calendars, in a window around today. Perch reads each event's title, start and end time, location, description, attachments, conferencing links, and your own response status.

That is the entire list of Google account data. Perch asks for no access to your Google profile, Gmail, Drive, contacts, or anything else, and the narrower scopes mean it cannot export a calendar or see who a calendar is shared with, even if it wanted to.

When you open Settings → Account, Perch uses the domain after the @ in each address to request that domain's public website icon. The part before the @ is never sent, and no profile-photo permission is requested. A fetched icon is reused without a network request for 30 days.

All of it goes to one purpose: showing your meetings in the menu bar and the dropdown, and finding the join link for the next one. None of it is profiled, scored, aggregated, or used to build anything.

Your Google account

You connect with Google's own sign-in (OAuth 2.0 with PKCE) in your browser. Perch never sees your password. It keeps the OAuth tokens Google issues, in the macOS Keychain, encrypted by the system and unlocked with your login.

How the rest is protected: every call to Google goes over HTTPS, always. Your events are held in memory only, so they are never written to disk and are gone the moment Perch quits. The small amount that does persist lives in Perch's own preferences, readable only by your macOS user account.

Disconnecting in Settings deletes the tokens, and you can revoke Perch's access anytime at myaccount.google.com/permissions.

Data stored on your device

Written to your Mac, and nowhere else:

• OAuth tokens, in the Keychain, encrypted by macOS,
• the address of each connected account, so Settings can name them before the first fetch lands,
• your settings: display mode, countdown threshold, hidden keywords, which calendars to show, notification lead time.

Your events are not in that list, because they are never stored. Notifications are posted by macOS locally. Nothing is synced anywhere.

How long Perch keeps it

Events: only as long as Perch is running. They live in memory, are replaced wholesale on every refresh, and are discarded when you quit. No history accumulates, because there is nowhere for it to accumulate.

Tokens, account addresses, and settings: until you remove them. Disconnecting an account in Settings erases its tokens from the Keychain immediately.

Public website icons: stored in Perch's macOS cache directory. Perch treats them as fresh for 30 days, then shows the cached copy while refreshing it. macOS may purge cache files sooner.

Settings → Account → Remove Perch Completely deletes all of it: the tokens in your Keychain, your settings and connected accounts, and the launch-at-login entry. Perch then moves itself to the Trash and quits.

Use that rather than dragging Perch to the Trash, which leaves the tokens and settings behind. macOS keeps both outside the app bundle, so a deleted-and-reinstalled Perch comes back still signed in, and third-party cleaners do not help because they delete files while the Keychain is a database. If you have already deleted the app, what remains is the Keychain entry named com.tatoalo.perch, which you can search for and delete in Keychain Access, and the file ~/Library/Preferences/com.tatoalo.perch.plist.

There is no server-side retention, because there is no server. Nothing is ever uploaded anywhere, so there is nothing for anyone to retain, and nothing you need to ask anyone to delete.

Network traffic, in full

Perch's complete list of network connections:

• Google's calendar API, to fetch your events, every 5 minutes and on wake,
• your connected accounts' domains, when Settings → Account loads and a cached icon needs its 30-day refresh, to retrieve their public website icons,
• the update feed: Sparkle, the standard macOS update framework, checks for new versions. The check carries no account data and nothing about your calendar.

Third parties

No analytics SDKs, no ad networks, no crash reporters phoning home. Google processes your calendar data as your calendar provider, under Google's privacy policy. A connected account's domain receives only the public website-icon request described above; Perch uses no logo broker.

Perch's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: calendar data is used only to show your meetings in the app, is never transferred to anyone else, never used for advertising, and never read by humans.

No calendar data is sold or transferred to anyone, and Perch has nobody to transfer it to: no data brokers, no advertisers, no analytics vendors, no subprocessors.

AI and machine learning

Perch has no AI features. Your calendar data is never sent to any AI or ML service, and it is never used to develop, improve, or train a model of any kind, ours or anyone else's. There is no model in Perch, and no model anywhere that has seen your calendar through it.

Changes

If this policy ever changes, the date at the top will be updated. Given how little there is to change, don't expect much excitement here.

Contact

Questions? Email [email protected].