Security at Rowan
Rowan asks for as little as it can. It reads your calendar and the email you send it, and that is all. Here is what it can see, how that is protected, and how to take it back.
What Rowan can see
- Your calendar, and nothing else from your Google or Microsoft account. On Google that is free/busy, events, and the ability to create and change events, plus your calendar settings read once at sign-up. On Microsoft it is the equivalent calendar permission.
- Only the email that is sent to Rowan, or that you copy Rowan on. Rowan never connects to your Gmail or Outlook mailbox, so it cannot read anything you did not put in front of it.
- Google reviewed and verified Rowan's calendar access in August 2026, and Rowan's use of Google data follows Google's Limited Use requirements.
How it is protected
- Your data is stored encrypted, in transit and at rest.
- The credentials that let Rowan reach your calendar are encrypted a second time, by us, with AES-256-GCM before they are written, so they are unreadable even to someone holding a copy of the database.
- You sign in with Google or Microsoft. Rowan has no password of yours to lose.
- Card details go straight to Stripe. Rowan never sees or stores them.
- Every page is served with a strict content security policy, so a page cannot be made to run scripts it was not built with.
Your assistant works for you alone
- Every conversation belongs to one account and stays there. Rowan only ever acts for the account a conversation belongs to, and automated checks run on every change to hold that boundary.
- Rowan replies only to people already on a conversation. It writes to someone new on your behalf only when it can prove, from the email's own authentication, that the request really came from you.
- In Slack, Rowan shows you every change before making it, and nothing is booked, moved or cancelled until you confirm.
- Connecting Rowan to Claude, Cursor or VS Code uses a key we store only as a one-way hash. You can make keys that read your calendar but cannot change it, and revoke any key at any time.
Leaving is easy
- Disconnect a calendar in Settings and Rowan's access is revoked and its stored credentials deleted.
- You can also remove Rowan from your Google or Microsoft account's own app permissions at any time.
Found a problem?
If you think you have found a security issue, tell us through support and a person will reply. Please give us a chance to fix it before sharing it publicly.
Who processes data on Rowan’s behalf, and the full legal detail, is in the privacy policy.