https://www.googleapis.com/auth/calendar.calendarlist.readonly
Calendar list — read only
Used to show the calendars available to the user and identify calendars the user owns.
Security and access
Owner control is the boundary.
Kueola, operated by Home Based Daddy LLC, minimizes access, isolates workspaces, and keeps every scheduling decision with the owner.
QuickBooks stays read-only
Kueola reads the customer, invoice, and service evidence required to identify and explain repeat-service history. Kueola does not create or edit QuickBooks customers, create or change invoices, collect payments, or change bookkeeping records. Its QuickBooks provider exposes retrieval operations only.
Google Calendar access
Kueola requests only the two Google Calendar scopes below for its approved V1 workflow.
https://www.googleapis.com/auth/calendar.events.owned
Events on owned calendars
Used to read event history and event status from calendars the user owns, calculate calendar-open gaps inside owner-set working hours, check for canceled or upcoming matching visits, and create an owner-approved event on a calendar the user owns.
The write boundary
Kueola does not automatically schedule customers. Selecting Schedule may prefill a proposed calendar-open time but does not create an event. Only Add to calendar, after the owner confirms or changes the date, start time, duration, destination calendar, title, and notes, creates the event.
- No attendees by default
- No customer invitations
sendUpdates=none- No recurring events in V1
- Owned calendars only
- Kueola currently does not schedule onto shared calendars the user does not own
Google's owned-events scope technically permits broader event management on calendars the user owns. Kueola's application behavior is deliberately narrower: it reads the history needed for the visible scheduling workflow and creates a single event only after explicit owner approval. The returned Google event ID is stored for verification and support.
Production controls
Provider credentials are protected with AES-256-GCM authenticated encryption using a production-specific key. Sessions use random opaque tokens stored only as hashes, secure HttpOnly cookies, expiry, revocation, CSRF protection, OAuth state validation, origin checks, and rate limiting. Secrets remain server-side and normal logs exclude tokens and provider payloads.
Kueola has separate runtime, database, sessions, OAuth clients, encryption keys, secrets, logs, and backups. It has no runtime dependency on BillFound. Security reports may be sent to security@kueola.com.