Herkos Calendar

In development: it cannot be downloaded yet.

A private calendar for Android, Windows, Linux and the web. Every event is encrypted on your device before it leaves, and kept on Nostr relays that you choose. There is no Herkos account and no Herkos server: you sign in with your Nostr identity, and your calendar belongs to your key, not to a company.

What it does

Day, three-day, week, month and agenda views, on a phone or a desktop, in 25 languages.
Repeating events that keep their time. A meeting at 9:00 in Madrid stays at 9:00 before and after the clocks change, wherever it is read.
Up to three reminders per event, synced between your devices, encrypted. The system rings them even with the app closed.
Invitations to anyone on Nostr. Each guest gets a sealed envelope of their own: a relay cannot tell who sent it, nor which guests belong to the same event.
Share links for people without Nostr. The key goes after #, the part of an address that browsers never send to a server. You can revoke a link.
A busy list, off by default. If you turn it on, others see when you are busy, rounded to 15 or 30 minutes — never what or with whom.
Public events, only the ones you mark as public.
Import and export .ics, to bring your calendar from Google, Outlook, Apple or any other, and calendars to follow: an .ics address, a public Nostr calendar or the public holidays.
A PIN of its own, and on a desktop it stays in the tray, with today's date on its icon, so that reminders keep ringing. On Android, a home-screen widget.

Your account

Calendar does not create keys: you sign in with a Nostr identity you already have (Herkos Mail or any Nostr app can make one).

With your private key (nsec, or ncryptsec with its passphrase). It stays on the device, in the system's secure storage, apart from Herkos Mail's: signing out of one app does not sign you out of the other.
With a signer app (a bunker:// link or a Nostr Connect QR code), so that the key never reaches the device.
Your relays are the ones in your Nostr lists. Calendar publishes where you write and reads your invitations where you receive. To find your guests it asks only your relays, never a third-party index.
Your devices stay in step, always encrypted to you: calendars, reminders, the calendars you follow and the invitations you ignore.
A copy of your keys. After your first event, and every three months, the app offers to save a file with the keys of your calendars, encrypted with a password you choose. Signing out tells you what would be lost and offers that copy first.

The privacy policy says what each relay can see.

How it differs from Proton Calendar and Tuta Calendar

Proton and Tuta make good encrypted calendars, and if you already use their mail, theirs fits in. The difference with Herkos is not whether your events are encrypted. It is who keeps your calendar, what their server can read, and who you can invite.

	Herkos Calendar	Proton Calendar	Tuta Calendar
What you need	A Nostr identity (a key). No email address, phone number or sign-up	A Proton account	A Tuta account
Where your events are	On the Nostr relays you choose, your own included	On Proton's servers	On Tuta's servers
Title, place, notes and guests	Encrypted	Encrypted	Encrypted
Date, time and repetition	Encrypted	Readable by Proton: the start and end, time zone, repetition and reminder times are signed, not encrypted, so that the server can index them	Encrypted, according to Tuta, and so is when your reminders ring
What the server knows	Your public key, a random identifier for each event, when it was published and roughly its size	Your account and when you use it, and when your events and reminders are	Your account and when you use it
Encrypted invitations	To anyone on Nostr whose inbox your relays know, in any compatible app	Between Proton users	Between Tuta users; anyone else can get a password-protected email, opened in Tuta's web app and not added to their calendar by itself
Invitations to everyone else	A share link (the link is the key)	Ordinary email with an `.ics`	Ordinary email with an `.ics`
Protocol	Open (NIP-52): other Nostr calendars, such as Formstr's, can read it	Proton's own; `.ics` to import and export	Tuta's own; `.ics` to import and export
If the service closes or your account is blocked	There is no account to block: your events stay on your relays, readable by any compatible app	You keep what you exported	You keep what you exported
Where it runs	Android, Windows, Linux and the web	Web, Android, iPhone, Windows, Mac and Linux (beta)	Web, Android, iPhone, Windows, Mac and Linux
Source code	All of it, MIT. There is no server	The apps, not the servers	The apps, not the servers

What the table says about Proton and Tuta comes from their own pages, read on 21 October 2026: Proton's article on its calendar's security model (2019, updated 2022) and its download page; Tuta's articles on its encrypted calendar and invitations (2019–2021). If something has changed, tell us and we will fix it.

What they do better

They are finished. Both have been in use for years. Herkos Calendar is still in development and has not been audited.
One occurrence of a series can be changed or skipped. In Herkos it cannot yet: the Nostr standard has no exceptions, so you end the series and start another.
Deleting is final on their side. On Nostr a deletion is a request: a relay may keep its copy, still encrypted.
Email reaches everyone. Their invitations work with any address. A Herkos invitation needs Nostr, or a share link.
iPhone and Mac. Both have apps for them; Herkos does not yet.
An account can be recovered. Both have a way back into a lost account. Herkos has no account to recover: if you lose your Nostr key without a copy, your calendar is lost with it. Keep a copy of your key, and the copy of your calendars' keys the app offers.

And one thing that is no better anywhere: the relays you use see your IP address and when you publish, as any server sees its visitors.