How calendars work on Android

When you install a new calendar app, your events show up right away – or the screen stays empty and the app asks for a permission. Both feel puzzling at first. This page explains, in plain words, what actually happens on your phone, why the calendar permission is needed and where your events really live.

No prior knowledge required. And if you then want to decide how to store your events going forward, the comparison at the end will help.

The most important point first, because everything else follows from it: your events do not belong to the app you view them in.

In the picture above, that is the large orange box in the middle: Android has a built-in event storage – a kind of shared address book, only for events. It belongs to the operating system, not to any particular app. Every calendar app is merely a window onto this storage: it shows you what is in there, and writes into it what you enter. That is why no arrow runs from the apps to it, only a dotted sightline – nothing moves, it is being looked at.

That is exactly why Google Calendar, your manufacturer's pre-installed calendar app and TopCal are not competitors for your data. They all look into the same cabinet.

• Several apps, the same events. You can use several calendar apps side by side. An event you create in one shows up in the other seconds later – no export, no moving anything.
• Uninstalling an app deletes no events. If you don't like TopCal, uninstall it and your events are still there, unchanged. So you take no risk in trying out a new calendar app.
• There is nothing to import. A new calendar app does not need to “fetch” your events. They are already there – as soon as it is allowed to look in.
• Where events are stored is decided elsewhere. Namely in your device's accounts, not in the calendar app. More on that below.

Because the event storage belongs to the system and not to the app, no app may simply look inside. Android requires that you allow it. That is why TopCal asks on first launch.

The permission is a door between app and event storage – nothing more. Concretely:

• What it allows: to show, change and create the events on your device.
• What it does not mean: no access to messages, photos, location or any provider's internet account. It opens exactly this one door.
• What TopCal does with it: show and edit. TopCal keeps no copy of your events and sends them nowhere.
• You can withdraw it any time – in the Android settings under Apps → TopCal → Permissions.

What TopCal does and does not do with the data is set out in detail in the privacy policy.

Your device's event storage does not hold a single big calendar but several – and each belongs to an account. The account decides whether an event exists only on this device or additionally on a server on the internet, and thereby shows up on your other devices. Three cases occur in practice:

• On this device only (local calendar). Events stay on exactly this phone. Maximally private, but also: gone if the device is lost and you have no backup, and not visible on your tablet.
• Via a Google account. If you set up your phone with a Google account, a Google calendar usually comes with it automatically. The events live on Google's servers and are available anywhere you sign in.
• Via a CalDAV calendar. CalDAV is an open standard that lets events sync with almost any server you like – your email provider's, your company's, or one you run yourself.

You set up these accounts in the Android settings, not in TopCal. TopCal then shows everything set up there – and when you create an event, you choose which of these calendars it goes into.

This is the real decision – in the picture above, it is about the two boxes outside the phone frame and about which account even has a line leading there. It does not concern the app but the storage location; with TopCal, both work equally well. First, briefly, what CalDAV even is:

CalDAV is an open, publicly documented set of rules for how a device syncs events with a server. (The name comes from WebDAV, an older technique for storing files on a server; CalDAV extends it to events.) The key point: the standard belongs to no company. Anyone may run a server for it – and because they all speak the same language, you can switch provider without losing your events.

What DAVsky actually does

DAVsky is easily mistaken for a calendar app – but it isn't one. It shows you no events. It is the translator between your CalDAV server and Android's event storage: it sets up an account on your device, fetches the events from the server and writes them into the storage – and sends your changes back.

That makes DAVsky the best example of the point at the very top of this page: once it is set up, every calendar app on your device sees the CalDAV events – TopCal included, without us having to do anything for it. You set DAVsky up once and barely touch it afterwards. DAVsky also brings subscribed calendars (ICS/Webcal feeds, such as public holidays or a fixture list) into the same place – something that used to require a second app.

Prefer open source? Then DAVx⁵ is the established alternative, in use for years and free via F-Droid. For the subscribed calendars there is a sibling app, ICSx⁵ – with DAVsky that is already built in. Both routes lead to the same result: the events land in the calendar storage, and TopCal shows them.

As an aside: Google itself can be connected via CalDAV too, but only in a limited way – Google does not officially support it, and tasks are not transferred that way. If you use a Google account, you are better off with the normal Google connection.

The honest short version

For Google speaks convenience. It's already there, works reliably, survives any lost device and makes invitations with other people effortless. For most people that is the right choice, and it is not a bad one.

Against it is what you should keep in mind behind the word “free”. Three points, briefly and without scaremongering:

• Google mostly says what it does not do. It does not use calendar content for advertising, Google states – and that is a clear commitment. But it does not say what else happens with the data. “Not for advertising” does not mean “merely kept”. What you get is a company's promise, not a technical guarantee.
• The events are not end-to-end encrypted. They are protected in transit and on disk, but on the server they sit in plain text. That makes them readable in principle by the provider itself, by authorities through legal channels, and by anyone who gets into your account or breaks into the provider. Unlike a messenger with real end-to-end encryption, no technology protects you here, only a promise.
• Other people are in your calendar too. Names, phone numbers, your child's therapy appointment, a meeting with a job candidate. These people never agreed to their details landing on a corporation's servers – and they are not asked. Anyone who deals with sensitive appointments professionally should take this seriously.

For CalDAV speaks that you even have this choice – and concretely: a provider whose business model is the paid plan and not mining data; a provider under European law; the server of your club or company; or your own machine at home, where no one but you reads along. The standard stays the same in every case, so moving remains possible at any time.

Against it is the effort. You need a provider, an extra app and fifteen minutes of patience during setup. And you are responsible for your provider being any good – backups included.