Changelog

Forgot your password? There's a page for that now, linked from the sign-in screen. If you originally signed up with Google, entering your email tells you to use the Google button instead of sending a reset link you can't use. Also: the sign-in page now remembers which method you used last time and highlights it.

Same-day approval. The "Google hasn't verified this app" warning is gone. The consent screen shows CalConnect cleanly instead of the Supabase project subdomain. The 100-user cap is lifted.

For each source calendar, pick your own color and label ("Personal commitment", "CXL workshop", "focus time", whatever you want). Default is still a gray "Busy" block. Show up on your other calendars in the way that actually makes sense to you, without ever leaking event details.

Stripe Billing Portal integration. During trial you can cancel and not get charged; the account and any settings stay. Previously you had to nuke your whole account to stop billing.

Fixed a 405 error some folks hit when signing out. Landed on a home-page redirect instead.

Lifetime deal listing is live. Two calendars synchronized forever, $9. Real payments processing.

Login is login. Signup is signup. Both now support Google OAuth and email + password. Small thing, big UX improvement.

Enter code first, then create your account, and it auto-claims. No more entering a code and getting an ambiguous error.

Card required at signup, no charge until day 7. Cancel any time before then without paying.

If Google invalidates your grant, we now detect it and show a banner asking you to reconnect that account. Previously mirroring would silently stop.

Full teardown from the dashboard danger zone. Stops watches, revokes Google tokens, deletes all your data.

Explains why Google shows "app not verified" while our verification is pending, so people don't bounce out of confusion.

Real legal pages, linked in the footer. Written in plain English, not law-firm boilerplate.

Google OAuth refresh tokens live in our database unencrypted today. Rolling out symmetric AES-256-GCM encryption over the next 2-3 days: Day 1 dual-write ships now (new tokens land encrypted alongside the existing plaintext column, no user-visible change), Day 2 backfills existing rows and flips reads to the encrypted column, Day 3 drops plaintext entirely. After the rollout, a stolen database backup would show only ciphertext. This closes the Supabase-breach and backup-theft risks. It does NOT close the "both Vercel and Supabase compromised at once" risk — phase 2 (moving the key to a cloud KMS) will. Being explicit so nobody thinks "encrypted" means "unbreakable."

Move the encryption key out of Vercel env vars and into AWS or GCP KMS. Two independent providers would have to be breached before any token is readable. Ships after phase 1 has baked in production.

Right now signing up with Google, then connecting your first calendar, is two separate Google prompts. Google splits the scopes for security, but we can fold them into one at signup so it feels like one click.

Reframing around the outcome ("stop double-booking yourself") instead of the mechanism ("mirror your calendars"). Adding a founder story so people understand why we built this.

support@calconnect.io routing to a real inbox with response SLAs. Currently email goes into the void.

Trigger from the login page. Backend is wired via Supabase; UI just needs a "forgot password" link.

Documented process to rotate the refresh-token encryption key without downtime if it ever leaks.

Plausible or GA4 so we can see which changes actually move signup and trial-to-paid.

Support for Microsoft Outlook, then Apple/iCloud. Bigger lift than it sounds: each provider needs its own OAuth flow, its own push-notification protocol, and its own event-schema quirks. Requires refactoring the mirror engine into a provider-agnostic layer. Estimating 3-5 weeks of focused work for Outlook alone. Holding until Google verification is through and we have real user demand signal.