Feed URLs
A feed URL is a credential. Anyone who has it can read the published calendar events for that feed until the token is revoked.
What a feed exposes
Subscribed calendar apps receive the event titles, times, and status changes the account chooses to publish, and, on each event, the clause and reason behind it with a link to its explanation. A feed carries published schedule content and nothing else: no account credentials, no payment identifiers, no server file paths or error output.
Revocation
Revoking a feed token stops future reads of that URL. Calendar apps keep the events they have already downloaded, so revoking a URL does not remove what someone has already seen. Plan on replacing a token when the audience changes rather than relying on revocation to take something back.
Refresh timing
A calendar feed is pulled, not pushed. exceptwhen republishes as soon as the schedule is republished and asks subscribers to refresh hourly, but the calendar app decides when it actually fetches. Google Calendar refreshes external calendars on its own schedule, often measured in hours, and Apple Calendar uses an interval the subscriber configures.
So the feed is a shared record of the plan, not a notification channel. When something changes today, tell the other person directly as well.
Sharing
Share feed URLs only with people and calendar systems that should see the schedule. Use a fresh token when a URL has been sent to the wrong place or the audience changes.