Your password never leaves your browser. It is transformed into an unrecognizable value before any network transmission. The server only ever receives the derived value, which cannot be reversed back to the original.

Access is invite-only

SPŸR LÈZ Calendar has no public signup, no waitlist, and no captcha. Access is granted by the operator and may be revoked at any time, for any reason. There is no path for an unauthorized person to begin a session.

What the server can see

To run the calendar, the server needs:

• Appointment details — dates, times, booking keys, the topic line, and any meeting link you provide.
• Names on file — the invitee name set on a booking link, and the booker’s name when they reserve a slot.
• Activity log — a timestamped record of bookings, cancellations, key revocations, and password changes, kept for support and abuse triage.
• Your settings — timezone, available hours, and the optional notification email address.

What the server cannot see

• Your password — only a one-way derivative is sent. A server compromise cannot recover the original.
• Your Snippets and Tasks — encrypted on your device with a key derived from your password. The server stores ciphertext it cannot read. If you forget the password, this content is unrecoverable, by anyone.
• Your Scratch pad — lives only on your device. Never transmitted.
• Your voice — dictation runs entirely on-device using a local speech recognition model. Audio is never sent to any server, never stored, and never leaves your browser.
• Network metadata — no IP addresses, no analytics, no advertising trackers, no persistent cookies, no fingerprinting. Request bodies are not logged.

How sessions work

Sign-in is by invite code and password over HTTPS. Your password is run through Argon2id — a deliberately slow key-derivation function — on your device before transmission, which makes automated guessing computationally expensive at the source. Each sign-in is paired with a short-lived server challenge. Sessions expire after a period of inactivity; there are no persistent logins. Booker pages load no third-party scripts.

Notification email (optional)

You may list one email address to be notified when an appointment is booked. The calendar works the same without it.

• Used only for: sending the booking confirmation that already appears in your activity log. Never used for marketing; never shared except as below.
• Delivered by: Resend (resend.com), the outbound provider, which processes the address solely to deliver the message.
• Stored as: a single field on your account record. No backup copies, no IPs kept.
• Removal: click the × next to your address in Settings; effect is immediate.
• Retention: kept only while you choose to keep it, or until your invite is revoked. No archival copy.
• Listed by mistake? Reply to any notification message and the operator will remove the address. No account is required.

Feedback, questions, and security reports

For bug reports, feature feedback, security disclosures, removal requests, or anything else, write to calendar@mail.spyrlez.cc. No account is required to send mail. This page exists because honest disclosure builds trust.

Disclaimer

This service is provided as-is, without warranty of any kind. SPŸR LÈZ is not liable for any damages arising from its use. While reasonable care is taken to protect your data, no system can guarantee absolute security. Access is granted via invite code and may be revoked at the sole discretion of SPŸR LÈZ at any time, for any reason.