Scheduling tools often request OAuth scopes like 'read events' when conflict checks only need 'read free/busy.' Over-privileged OAuth is one of the biggest privacy leaks most users consent to without noticing.
What each scope is for
`calendar.freebusy` returns blocked-time intervals only — no event titles, attendees, or descriptions — and is all a conflict check needs. Adding the booking to your calendar needs `calendar.events`. Cal Clear also requests `calendar.readonly`, which it uses to list your calendars so you can choose which ones to check, not to read events. Ask any tool that requests more what it uses each scope for.
Why it matters for your booking page
OAuth Scope Audit is a micro-decision that compounds. A single tool choice or configuration setting can mean the difference between a booking page that respects clients and one that surveils them. Cal Clear is built so these decisions default to the privacy-respecting option.
Cal Clear's take
Cal Clear ships with the privacy-first defaults: no analytics or ad trackers on booking pages (Google reCAPTCHA spam protection is on by default and can be turned off), free/busy conflict checks that never read event titles, configurable auto-delete, and reCAPTCHA plus per-IP rate-limit anti-spam. You don't need to fiddle with settings to get good privacy — it's the baseline.
This is part of our privacy-first scheduling pillar guide — 18 articles covering every privacy angle.
Frequently Asked Questions
Is this a Cal Clear-specific issue or an industry-wide one?
Industry-wide. Most scheduling tools default to broad third-party integration and permissive data practices because that's what enterprise buyers traditionally demanded. Privacy-first is a newer product posture.
How can I verify my current scheduling tool follows these practices?
Open the booking page in DevTools, audit the network requests, read the privacy policy end-to-end, and ask for a DPA. If any step surfaces red flags, evaluate alternatives.
Try privacy-first scheduling, free
Cal Clear runs no analytics or ad trackers on booking pages and auto-deletes booking data on your schedule. Start at calclear.app.