Can I trust it?

It is reasonable to be sceptical of a free service that is supposed to look after your calendar. Here are honest answers to the questions people ask most often. If yours is missing, write to thomas@rpix.dk.

Who runs this?

My name is Thomas Jensen, and I run caldav.rpix.dk as a private individual in my spare time. There is no company, no investors and no customers behind it. You can write to me directly at thomas@rpix.dk.

Why is it free? What is the catch?

It is a hobby project with no commercial purpose. There are no ads, no tracking and no analytics, and your information is never sold or shared with anyone.

The catch is that there is no guarantee. The service is provided as is, with no promise of uptime or backup, and it is for private use only. See the terms of use. But you can expect high uptime and good service, just not a guarantee.

Where is the server?

At Din Server Group ApS (Danmark). Data is not sent outside the EU/EEA. Every night a backup is made to a server in Denmark that I am personally responsible for.

Emails from the service are sent directly from the server to your email provider, with no third-party mail service in between.

Can you read my calendars, contacts and notes?

Yes, technically. CalDAV and CardDAV have no end-to-end encryption. Data is encrypted on its way between you and the server (HTTPS), but it is stored unencrypted on the server's disk. The same is true for most other calendar providers.

I do not open your content unless you ask for help, it is necessary to fix a fault, or the law requires it. But that is a promise, not a technical guarantee. Do not put anything on the server that you could not live with the administrator being able to see in principle.

What is logged?

Time, IP address, username, the server address that was requested, and the program used. The content of your events, contacts and notes is not in the logs. Web server logs are kept for at most 31 days, and calendar server logs for at most 90 days.

The portal only sets two necessary cookies: one to keep you logged in and one to remember your language.

How is my password protected?

It is stored as a bcrypt hash, so nobody can read it, including me. It must be at least 10 characters, and the portal temporarily blocks logins after too many failed attempts.

There is no two-factor authentication, because calendar programs log in with a username and password. So use a password you do not use anywhere else.

Can I leave again?

Yes. Your data is stored in open standard formats (iCalendar and vCard), so you can move it to any other CalDAV/CardDAV server. You can export .ics and .vcf files from the Radicale web interface or from your calendar program.

You can delete your account and all content on the My account page. It is then deleted immediately on the server and disappears from the backups within 14 days.

What happens if you shut the service down?

You will get at least 30 days' notice by email, so you have time to move your data.

Also note that accounts that have not been used for 30 days are deleted automatically. You will get an email first, and a calendar program syncing counts as use.

There is room for 1,000 users, so the server does not get overloaded. If it is full, you can join the waiting list. When a place becomes free, the first person on the list gets an email and has 7 days to create the account.

Can I see the code?

The calendar server itself is Radicale, a widely used open source server for CalDAV and CardDAV. I wrote the account portal, which handles sign-up, password reset and deletion, myself, and the code is at github.com/lianergoist/caldav. So is the code for DavNotes and WebNotes.

You cannot check for yourself that exactly this code is running on the server. But it is all open source, so you can read how it works and run it yourself.

I would rather be in control myself

Good. That is the best solution if you can. Radicale is easy to install on your own server or a Raspberry Pi, and DavNotes works with any CalDAV server that supports notes (VJOURNAL), such as Radicale and Nextcloud. caldav.rpix.dk is meant for those who do not want to, or cannot, run their own server.

What happens if the server is hacked?

If a security breach occurs that may affect your information, I will report it to Datatilsynet (the Danish Data Protection Agency), and you will be notified when the rules require it. Read more in the privacy policy.