A shared family calendar looks like logistics. School pickups, a dentist appointment, soccer practice, the plumber on Thursday. Read the whole thing at once and it becomes something else entirely: a description of how a household moves through a week.
The house is empty on Tuesdays between nine and three. The children are alone for an hour after school on Wednesdays. There is a recurring appointment at the same time each week with no location attached, which suggests something the household does not name out loud. Every second weekend the children are somewhere else, which is a custody arrangement by another name.
None of that requires a breach or a clever attack. It requires reading one document.
Protected contents still leak a shape
Most privacy advice stops at the contents. Encrypt the contents and the problem is solved. It is not.
A calendar has a shape as well as a content, and the shape is hard to hide. How many events a calendar holds. When they change, and how often. Who is a member, and what role they hold. When someone was added, and whether they still open it.
Consider what a quiet calendar tells you. Nothing booked for two weeks, then eleven edits in an afternoon. A new member joins the day after a monthly pattern of entries stops. Those changes are meaningful even when not one title is visible, and they are the kind of information a server necessarily handles in the clear, because it has to store, route and sync data it cannot read.
It is worth knowing exactly what your own tool can see. CamyCal's server can read your email address, how many events each calendar holds and when they last changed, who is a member of which calendar and their role, whether one member tagged another, and an IP address in a rate-limit counter on sign-in attempts, which is kept for a fixed window and not swept afterwards. Event titles, notes, calendar names, descriptions, colours and custom field definitions are encrypted on the device before they are sent.
If a reset exists, they hold the keys
Encryption claims are easy to make. The useful question is who can decrypt.
If a vendor can reset your password by email, then a path into your data exists that does not run through your passphrase, and whoever controls that path controls your data. That may be a fair trade for a shopping list. It is a different matter for a record of where your children are.
The honest test is to ask what happens when you forget your passphrase. If the answer is a reset link, the operator holds the keys. If the answer is that your data is gone, the operator does not. Both are legitimate designs, but only one of them means the operator cannot read your calendar.
CamyCal derives keys from your passphrase on your own device using Argon2id and never sends the passphrase anywhere. There is no reset. Lose both the passphrase and the recovery code and the data is unreadable, permanently, by you and by the operator. That is a consequence of the design rather than a defect, and it is the price of the guarantee.
What a household can actually do
Decide who is in the group deliberately. Membership tends to accumulate by convenience, one person at a time, and each person added is a person who can read the household's movements. Review the list occasionally rather than only when it becomes awkward.
Prefer tools where the operator cannot read contents. That removes an entire category of exposure: a demand served on the company, a rogue employee, a misconfigured backup, a change of ownership. None of those need your cooperation to expose a calendar that was readable all along.
Keep genuinely sensitive things off the shared calendar, or on a separate one with a narrow membership. A medical calendar shared with one other adult leaks far less than the same entries buried in the family calendar that everybody sees. Separation is cheaper than any amount of clever naming.
And remember what a shared calendar actually is. It is a document about other people who did not choose to be in it. A child's week, their appointments and their whereabouts, is recorded by adults on their behalf, in a system those adults selected. That is a decision worth making on purpose, once, rather than by default.