manyCalendars:
information for IT and security teams
1. What the extension is
manyCalendars is a Manifest V3 browser extension (Chrome, Edge, Firefox) that merges multiple calendars into one read-only view rendered locally in the user's browser. It reads event data from two sources: calendar pages the user is already signed into in their own browser tabs, and .ics feed URLs the user adds. It does not use OAuth, does not request API access to any calendar tenant, does not write to any calendar, and does not store calendar data on any server. There is no admin consent flow because there is no connection to the organization's calendar system.
2. Manifest permissions
| Permission | Purpose |
|---|---|
activeTab | Temporary access to the tab the user is viewing when they invoke the extension. Expires when the tab navigates or closes. |
tabs | Enumerate tab URLs and titles so the extension can locate calendar tabs the user has added. It acts only on those tabs. |
scripting | Inject the content script that reads rendered event data from a calendar page. Injection is possible only on origins the user has granted (see section 3). |
storage | Persist calendar data, events, and settings in chrome.storage.local on the device. |
alarms | Schedule periodic .ics feed refreshes and the license check. |
notifications | Display event reminders as native browser notifications. |
Not requested: history, bookmarks, cookies, webRequest, downloads, management.
3. Host permission model
The manifest contains no host_permissions. It declares optional_host_permissions: ["<all_urls>"] only. Practical effect:
- At install time, the extension can read no website content. The browser does not display the "read and change all your data on all websites" install warning, because no host access is granted at install.
- When the user adds a calendar, the browser prompts for permission for that specific origin, in context. Access is granted per site, by the user.
- Granted origins are listed and individually revocable at
chrome://extensions(Details, Site access) at any time.
4. Network activity (complete list)
| Endpoint | When | Payload |
|---|---|---|
| None | Free tier, no account | The extension makes zero requests to manyCalendars infrastructure. Calendar data is read and stored locally only. |
| manyCalendars license API (Supabase Edge Functions; hostname is in the extension's bundled plain-text config and visible in DevTools) | Periodically while signed in on a trial or paid plan | Account email and license status. No calendar contents, event titles, attendees, tab URLs, or usage data. |
| Stripe (checkout); Resend (license email delivery) | At purchase only, from the website, not the extension | Payment details go to Stripe directly; the vendor does not receive card numbers. |
| User-added .ics feed URLs | At the refresh interval the user configures | Standard HTTPS GET from the user's own browser to the calendar provider. Not proxied through vendor infrastructure. |
| Calendar page loads (Tab Sync) | When reading a calendar tab the user added | Normal page load of a URL the user added, from the user's own authenticated browser session. No credentials are stored or transmitted by the extension. |
This list is verifiable: inspect the extension's service worker in DevTools and monitor its Network tab during use.
5. Data storage
All calendar data (event titles, times, attendees as rendered on pages the user added, .ics contents, manual events, settings) is stored in chrome.storage.local and localStorage within the browser profile on the device. It is not synced to vendor servers. Uninstalling the extension deletes it. Server-side, the vendor stores only the email addresses and license/trial records of customers who sign in or purchase.
6. Not collected
- Calendar events, titles, descriptions, attendees, or locations (never transmitted to the vendor)
- Calendar credentials, session cookies, or tokens
- Browsing history, open-tab inventory, or bookmarks
- Usage analytics, telemetry, or crash reports
- Device fingerprints or advertising identifiers
7. Code integrity
First-party code ships unobfuscated and unminified and can be read as shipped. Two stock third-party libraries, FullCalendar (fullcalendar.min.js) and ical.js (ical.min.js), ship as their published minified builds and can be diffed against the official releases. Package contents can be diffed between versions. Manifest V3 prohibits remotely hosted code, and the extension's content security policy is script-src 'self'; object-src 'self'; base-uri 'none', so only scripts inside the store-reviewed package can execute. Adding host access or any permission that carries a Chrome warning disables the extension until you re-approve it; it cannot activate silently.
8. Security contact
Security questions and questionnaires: [email protected]
Vulnerability reports: [email protected]
Data protection and DPA: [email protected] (DPA available at manycalendars.com/dpa.html)