Restricting data access with privacy mode

Privacy mode is available as an add-on for Enterprise plans only.

Privacy mode limits your application to the calendar events it creates through Nylas. If a user adds an event directly in Google Calendar, Outlook, or any other app, the event stays on their calendar, but your application can’t see it: lists leave it out, requests for it by ID return a 403, and it doesn’t trigger event webhooks. Your application can still see all of the user’s calendars.

Use privacy mode when your application should only ever handle the events it books, for example when compliance rules say an integration must not read a user’s personal or unrelated meetings.

How privacy mode works

To turn on privacy mode, open your application in the Nylas Dashboard, go to Customizations > Notifications, and turn on Calendar event data privacy.

What your app can see with privacy mode on

You

Turn on privacy mode

You switch on one setting for your application, so it only sees the calendar events it creates itself. In the Dashboard, open your application and go to Customizations > Notifications > Calendar event data privacy.

User's calendar

Nylas checks who made each event

For every event, Nylas checks whether your app created it. Each date of a repeating event follows its parent event.

Your app created it through Nylas

Visible to your app

Your app created it after privacy mode was turned on. Your app can read, list, import, change, and delete it, and receives its event webhooks (automatic notifications) as usual. Request that creates it: POST /v3/grants/{grant_id}/events.

Created any other way

Hidden from your app

The user added it in Google Calendar, Outlook, or another app, or it existed before privacy mode was on. Lists and imports leave it out, and it doesn't trigger event webhooks. Asking for it by ID returns a 403 (not accessible) error.

Privacy mode limits your application to the events it creates through Nylas. Events a user adds any other way stay on their calendar, but your application can't see them. Calendars themselves stay visible.

Diagram as text

• You: Turn on privacy mode: You switch on one setting for your application, so it only sees the calendar events it creates itself. In the Dashboard, open your application and go to Customizations > Notifications > Calendar event data privacy.
• User's calendar: Nylas checks who made each event: For every event, Nylas checks whether your app created it. Each date of a repeating event follows its parent event.
• Ends in one of:
  • Your app created it through Nylas → Visible to your app: Your app created it after privacy mode was turned on. Your app can read, list, import, change, and delete it, and receives its event webhooks (automatic notifications) as usual. Request that creates it: POST /v3/grants/{grant_id}/events.
  • Created any other way → Hidden from your app: The user added it in Google Calendar, Outlook, or another app, or it existed before privacy mode was on. Lists and imports leave it out, and it doesn't trigger event webhooks. Asking for it by ID returns a 403 (not accessible) error.

Privacy mode only recognizes events created after you turn it on. Nylas doesn’t track how earlier events were created, so as soon as you enable privacy mode, your application loses access to every existing event, including events it created through Nylas before.

When you enable privacy mode, Nylas applies the following restrictions to API requests:

• The Get Event, Get all Events, and Import Events endpoints return events created using Nylas only.
• The Update Event endpoint accesses and updates events created using Nylas only.
• The Delete Event endpoint accesses and deletes events created using Nylas only.

If your project requests an event created outside of Nylas by its ID (Get, Update, or Delete Event), you receive a 403 error. The Get all Events and Import Events endpoints leave those events out of their results.

{
  "error": {
    "message": "Event is not accessible under privacy filter",
    "type": "forbidden"
  },
  "request_id": "5967ca40-a2d8-4ee0-a0e0-6f18ace39a90"
}

You also receive Events webhook notifications for events created through Nylas only. Events created using other methods won’t trigger notifications, even if they exist in the user’s calendar.

Privacy mode and recurring events

Nylas determines how to treat recurring events based on the series’ parent event. If the parent event was created using Nylas, users have full access to the entire series. Updating an occurrence doesn’t revoke users’ access to the series, and all instances of the recurring event remain accessible.