UnlockOS — Google Calendar Integration

Overview

UnlockOS provides keyless check-in infrastructure for hourly-rental and overnight-stay facilities. Operators commonly publish their inventory across multiple channels (Spacemarket, Instabase, Spacee, Airbnb, etc.), each of which polls the facility’s Google Calendar to detect availability. By writing UnlockOS direct reservations to Google Calendar in real time, UnlockOS blocks the same slot from being booked through other channels, preventing double-bookings. It also reads bookings that those other channels write into the same Google Calendar and imports them, so UnlockOS can issue keys and complete check-in for those guests too.

Requested scopes

https://www.googleapis.com/auth/calendar.events

Why: read and write reservation events. Write — create, update, and delete blocking events for UnlockOS direct reservations. Read — import bookings that other reservation channels write into the connected calendar (events authored by UnlockOS itself are identified and skipped).

https://www.googleapis.com/auth/calendar.calendarlist.readonly

Why: used solely to display the list of calendars in the connected account on the calendar-selection screen (calendar metadata only).

Actions performed

• Events.insert / update / delete — create, update, and delete blocking events for UnlockOS direct reservations
• Events.list — read other-platform bookings from the connected calendar and import them as reservations
• CalendarList.list — list calendars so the operator can select which calendar to connect

Actions NOT performed

• Modifying or deleting events not created by UnlockOS
• ACL / calendar management or full-access (calendar) scope
• Push notifications / Webhooks for event subscription

Data handling

• Stored: OAuth refresh token (encrypted in Supabase vault), connected calendar IDs, facility identifier
• Imported bookings: start/end time, the event title (booking name), notes/location — stored as reservation data only to the extent needed for reservation management and key issuance
• Not stored: data outside the sync window, and personal-calendar content unrelated to bookings
• Data protection: TLS in transit; encrypted managed DB (Supabase/AWS) at rest; OAuth tokens additionally encrypted in Supabase Vault; access restricted to the authorised facility and necessary server-side processing (Edge Functions) via RLS and least privilege.
• Use and transfer of Google user data adheres to the Google API Services User Data Policy, including Limited Use. We do not use it for advertising or sell/transfer it to third parties for human reading.
• Recipients: only the facility’s authorised Google Calendar. UnlockOS does not share or sell this data to third parties.
• Retention: refresh token is deleted within 30 days after the integration is disconnected.

How to disconnect

1. In UnlockOS admin → Settings → Google Calendar Integration → "Disconnect"
2. Alternatively, revoke UnlockOS access via Google Account → Security → Third-party apps
3. After disconnection, UnlockOS will stop creating events and the stored refresh token will be deleted within 30 days

Onboarding

In the UnlockOS admin panel, navigate to Settings > Google Calendar Integration and click Connect. You will be redirected to Google’s OAuth consent screen and asked to choose the destination calendar (defaults to primary). Typical setup time is under one minute.

Failure handling

On API failure, the admin panel displays a re-authorisation banner and notifies the facility operator. Reservations remain in their confirmed state regardless (key issuance is unaffected).

Contact

Questions about scopes or data handling: info@blockchainlock.io.