Plain version, no lawyer words.
The job site has no other way to let a program read your schedule. This app signs in as you, reads the calendar, keeps the jobs with your name on them, and throws away the rest. It never writes anything to the job site and never changes anything there.
Encrypted before it is written to disk. For people using the iPhone calendar feed, the key exists only inside your own private calendar link and is never stored on the server — so the database on its own cannot be unscrambled.
For people who signed in with Google, there is a second encrypted copy under a key the server holds, because the Google sync runs on a timer when you are not there and has nothing else to unlock it with. That copy is weaker on purpose and you should know about it.
One thing: the calendar this app creates for you. That is the whole permission it asks for. It cannot read your existing calendars, your email, your contacts, your files, or anything else.
Nobody. It is not sold, shared, advertised against, or sent anywhere. It runs on a single server paid for by the person who set it up.
Anyone who has your link can see your schedule. Don't post it. If it gets out, ask to be removed and sign in again to get a new one.
Ask and your row is deleted — login, token and all. You can also cut off the Google side yourself at any time at myaccount.google.com → Data & privacy → Third-party apps, without asking anyone. The calendar this app made stays on your phone until you delete it.
The job site is served over plain HTTP with no encryption available. That means this app's sign-in to the job site travels unencrypted — exactly as it does when you sign in from your own phone's browser. Nothing here can fix that; it is the company's to fix. The page you type your password into is encrypted.