Google Calendar integration

2. Connection and scope

Seedling verifies the provider account before storing the connection. A personal connection remains actor-owned; a workspace connection is administered for the selected Seedling workspace. Credentials are never inferred from an email address or silently promoted between scopes.

Google OAuth grant

An access token and refresh token for the intended Google user. The dedicated connector requests identity scopes plus calendar.calendarlist.readonly, calendar.events.readonly, and calendar.acls.readonly; the Google Workspace parent uses calendar.readonly.

Connection ownership

Seedling supports actor-owned personal access and administrator-managed workspace access for this connector. The selected scope and exact connection remain fixed through synchronization, rotation, disconnect, and purge.

3. Google Calendar data Seedling accesses

Seedling uses synchronized information for source-backed search, operating context, verification, and customer-approved workflows. Availability depends on the connected account, selected resources, provider plan, and native permissions.

Calendars

Calendar identity, names, descriptions, time zones, native access roles, and synchronization state visible to the authorized user.

Events

Event identity, titles, descriptions, timing, recurrence, organizer, attendees, response state, locations, conference links, and lifecycle status.

Scheduling relationships

Calendar-to-event, organizer, attendee, recurrence, and cancellation relationships returned by Google.

4. Read-only permission contract

The dedicated connector requests only identity and Calendar read scopes. The organization-wide parent uses Google's combined calendar.readonly scope. Neither path can create, edit, accept, decline, or delete an event.

• openid, email, and profile — verify the Google identity for a dedicated connection.
• calendar.calendarlist.readonly — enumerate calendars visible to the authorized user.
• calendar.events.readonly — read events without modifying them.
• calendar.acls.readonly — read available calendar access-control entries for diagnostics and future projection.
• calendar.readonly — the organization-wide Google Workspace parent's read-only Calendar contract.

5. Security and access

• Provider credentials and other connection secrets are encrypted in the workspace tenant data plane, never returned to the browser, and excluded from logs and queue payloads.
• Every source, synchronization, secret lookup, audience contribution, disconnect, and purge remains bound to the exact connection that created it.
• The provider does not expose enough complete object-level audience evidence for Seedling to reproduce native permissions safely. Workspace content therefore uses the connection's restricted-by-default workspace-or-no-human-access policy; administrator and steward status grant no raw-content bypass.
• For a personal connection, raw content remains visible only to the connecting member in human-facing Seedling surfaces. Personal content may contribute to trusted system exploration under workspace policy, but that authority never transfers to another member.
• Generated output cannot bypass Seedling's human review, verification, and approval gates.

6. Retention and deletion

Connected data

Synchronized Google Calendar records remain while the connection is active and are removed through a durable integration purge after disconnect.

Credentials

Stored Google Calendar credentials or connection secrets and connection-owned synchronization state are deleted from active Seedling systems as part of the purge.

Backups

Deleted information may remain in encrypted, access-restricted backups until expiry, ordinarily within 35 days after active-system deletion.

7. Installation, help, and removal