A dashboard you can actually change
Every module is a plugin, including the ones we wrote. That is not a slogan: it is the same interface, the same permission checks and the same install button for our calendar as for anybody else's.
The twelve modules that ship with it
Every one is installed from the Store and can be removed the same way. Nothing here is a paid extra.
Calendar
Month, week and day views, with real recurrence and sharing. Planning
Todos
Nested subtasks, due dates, priorities and repeat rules. Productivity
Habits
Daily targets, streaks and a contribution heatmap. Health
Focus
A Pomodoro timer that logs time against a specific task. Productivity
Memos
Notes filed into categories, with tags and pinning. Personal
Memory
Learn a passage by filling in the words that are missing. Personal
Verse of the Day
A verse each morning, from YouVersion. Personal
Bible
Look up any passage from YouVersion. Personal
Contacts
An address book with birthdays, tags and favourites. Personal
Debts
Payoff projections, and avalanche versus snowball compared. Finance
Weather
Current conditions, hourly and a seven-day forecast. Utilities
Clock & Alarms
A live clock, world times, and repeating alarms. Utilities
How a third-party plugin is kept at arm's length
A plugin store is a way of inviting other people's code near your calendar. These are the four things that stop that being reckless.
It cannot see your session
Third-party plugins render in a sandboxed frame with no same-origin access. No cookie, no token, and no way to call the API directly. Everything it does goes through a message channel the dashboard controls.
It must ask, by name
A plugin declares the permissions it needs in its manifest, and they are listed on the button you press to install it. Without contacts:read it cannot read your contacts — not as a matter of policy, but because the request is refused.
It is read before it is published
Submitted code is uploaded to a quarantined area and is never executed there. It is hashed, checked automatically, then read by a person, and only then does the bundle become fetchable at all. Review lowers the risk; it does not remove it.
It can be switched off
Removing a plugin cuts its access immediately. If a published plugin turns out to be a problem it can be disabled for everyone at once, and its bundle, its sandbox and its API calls all stop together.
What a plugin can ask for
Scoped by module and by direction, so read-only is genuinely read-only.
- calendar:read and calendar:write
- todos:read and todos:write
- memos:read and memos:write
- contacts:read and contacts:write
- debts:read and debts:write
- habits:read and habits:write
- focus:read and focus:write
- alarms:read and alarms:write
- weather:read, and profile:read for your name and time zone
- storage — a private store no other plugin can see
- notifications:send
Sensitive by default
Anything touching money or the address book is flagged in the install dialog rather than listed quietly among the rest. You should have to think for a second before granting it.
Browse what is available
The Store lives inside the dashboard, at the bottom of the navigation bar.