Changelog

For Pro subscribers: pick which days and hours a source calendar should mirror. Set your work calendar to only mirror 9-5 weekdays, or your personal calendar to only mirror evenings and weekends. Events outside the window are ignored. Requested by our first AppSumo reviewer.

For Pro subscribers: toggle "Mirror existing events" on a source calendar and CalConnect pulls the next 5 years of events from that calendar and mirrors them all as Busy blocks on your other calendars. Progress bar shows real-time. Toggle off cleanly removes the backfilled mirrors (never touches your real events). Also requested by our first AppSumo reviewer.

The site now has a proper OG image so pasting calconnect.io into LinkedIn, Twitter, or Slack shows the CalConnect wordmark and a calendar visual instead of a generic gray placeholder.

Fixed a unique-constraint quirk that prevented the same Google account from being connected to more than one CalConnect user across the whole system. Now each user can independently connect any of their Google accounts.

The plan picker now has a monthly/yearly toggle (yearly by default, 17% savings). Hitting back from Stripe checkout now lands on the plan picker instead of a free-plan dashboard. Also fixed swapped Stripe price IDs that were sending monthly buyers to the yearly price.

Every dashboard now has a hide-able "How CalConnect works" strip at the bottom that walks through the setup in 3 visual steps. The Source label's explanation is back to a hover tooltip so it doesn't take up permanent space on each row.

Every existing Google OAuth refresh token in the database is now encrypted at rest with AES-256-GCM. Read path prefers encrypted with plaintext fallback until Day 3 (plaintext column drop) which is queued for tomorrow.

Forgot your password? There's a page for that now, linked from the sign-in screen. If you originally signed up with Google, entering your email tells you to use the Google button instead of sending a reset link you can't use. Also: the sign-in page now remembers which method you used last time and highlights it.

Same-day approval. The "Google hasn't verified this app" warning is gone. The consent screen shows CalConnect cleanly instead of the Supabase project subdomain. The 100-user cap is lifted.

For each source calendar, pick your own color and label ("Personal commitment", "CXL workshop", "focus time", whatever you want). Default is still a gray "Busy" block. Show up on your other calendars in the way that actually makes sense to you, without ever leaking event details.

Stripe Billing Portal integration. During trial you can cancel and not get charged; the account and any settings stay. Previously you had to nuke your whole account to stop billing.

Fixed a 405 error some folks hit when signing out. Landed on a home-page redirect instead.

Lifetime deal listing is live. Two calendars synchronized forever, $9. Real payments processing.

Login is login. Signup is signup. Both now support Google OAuth and email + password. Small thing, big UX improvement.

Enter code first, then create your account, and it auto-claims. No more entering a code and getting an ambiguous error.

Card required at signup, no charge until day 7. Cancel any time before then without paying.

If Google invalidates your grant, we now detect it and show a banner asking you to reconnect that account. Previously mirroring would silently stop.

Full teardown from the dashboard danger zone. Stops watches, revokes Google tokens, deletes all your data.

Explains why Google shows "app not verified" while our verification is pending, so people don't bounce out of confusion.

Real legal pages, linked in the footer. Written in plain English, not law-firm boilerplate.

Google OAuth refresh tokens live in our database unencrypted today. Rolling out symmetric AES-256-GCM encryption over the next 2-3 days: Day 1 dual-write ships now (new tokens land encrypted alongside the existing plaintext column, no user-visible change), Day 2 backfills existing rows and flips reads to the encrypted column, Day 3 drops plaintext entirely. After the rollout, a stolen database backup would show only ciphertext. This closes the Supabase-breach and backup-theft risks. It does NOT close the "both Vercel and Supabase compromised at once" risk — phase 2 (moving the key to a cloud KMS) will. Being explicit so nobody thinks "encrypted" means "unbreakable."

Move the encryption key out of Vercel env vars and into AWS or GCP KMS. Two independent providers would have to be breached before any token is readable. Ships after phase 1 has baked in production.

Right now signing up with Google, then connecting your first calendar, is two separate Google prompts. Google splits the scopes for security, but we can fold them into one at signup so it feels like one click.

Reframing around the outcome ("stop double-booking yourself") instead of the mechanism ("mirror your calendars"). Adding a founder story so people understand why we built this.

support@calconnect.io routing to a real inbox with response SLAs. Currently email goes into the void.

Trigger from the login page. Backend is wired via Supabase; UI just needs a "forgot password" link.

Documented process to rotate the refresh-token encryption key without downtime if it ever leaks.

Plausible or GA4 so we can see which changes actually move signup and trial-to-paid.

Support for Microsoft Outlook, then Apple/iCloud. Bigger lift than it sounds: each provider needs its own OAuth flow, its own push-notification protocol, and its own event-schema quirks. Requires refactoring the mirror engine into a provider-agnostic layer. Estimating 3-5 weeks of focused work for Outlook alone. Holding until Google verification is through and we have real user demand signal.