A calendar booking page privacy checklist should answer two questions before the link goes public: what can a visitor learn, and what times can a visitor actually reserve? Test both the published page and the resulting appointment instead of relying only on settings screens.
Review what the public page reveals
Open the booking link in a private browser window where you are not signed in. Record the name, photo, service description, location, meeting method, staff details, and policy text that a stranger can see. Remove internal notes, personal phone numbers, private addresses, or service names that reveal more than a visitor needs.
Google states that an appointment booking page is always public to anyone with the link and may display the account name and profile photo (Google Calendar Help). Treat the URL as shareable public information, even when it is distributed to only a small group.
Microsoft Bookings provides separate controls for organization-only access and disabling direct search-engine indexing. Microsoft also notes that the page link can be shared or embedded on a website (Microsoft Learn). Review these controls based on the intended audience rather than assuming an unadvertised link is private.
Check real availability
Verify working hours, time zone, appointment duration, lead time, booking horizon, buffer time, daily caps, and calendars checked for conflicts. Google says appointment schedules can block times when connected calendars show you are unavailable (Google Calendar Help). Confirm that the correct calendars are included and that tentative, all-day, or travel events behave as expected.
Use a test visitor account to book several scenarios:
- the earliest permitted time;
- a slot next to an existing event;
- a time in another time zone;
- a day with an all-day event;
- the last date in the booking window.
Inspect the information collected
Ask only for details needed to deliver the appointment. Review required fields, consent language, reminder messages, cancellation links, and where submitted data is stored. Avoid putting sensitive questions into a general scheduling form when a protected intake process is more appropriate.
Check who receives confirmations and calendar invitations. Make sure the customer-facing message does not expose an internal distribution list or a meeting host who should remain behind the scenes. If video conferencing is added automatically, verify that a fresh meeting link is created for each booking.
Test the full visitor journey
Book, reschedule, and cancel an appointment. Inspect the confirmation email on mobile and desktop, confirm the time zone, and verify that the event appears on the intended team calendar. Try the page after all slots are filled so the empty-state message gives a useful next step rather than exposing internal contact information.
Publish with a review owner
Assign one person to own the page, its services, and its quarterly review. Keep a short record of the public URL, audience, connected calendars, form fields, access controls, and last test date. Recheck the page after staff changes, office moves, service changes, or calendar migrations.
Quick completion test
The page is ready when an unsigned visitor sees only intended information, available slots match the connected calendars, form fields are proportionate, confirmation and cancellation work, and the team knows who maintains the page.