Is there an Android calendar with limited security permissions?

I've just bought an entry-level Samsung Europa, running version 2.2. I'm technically-minded but new to this OS. I'd like to find a calendar that runs in limited security permissions, so that my calender isn't synced to anywhere over the internet. I am happy to take responsibility for my own backups.

I have signed up for a Google account to run the stock Calendar app (it mandates it), to access Google Maps and to access the market. I've set the Google account to "Sync is OFF" in General Sync Settings, and I've turned off Auto Sync. I've kept Background Data turned on, and turned off Google syncing in the Calendar options. I am hoping this combination of settings means that my calendar will not be copied off the device, though I'm not confident this is the case.

I wasn't aware until after purchasing that app-level security permissions could not be modified in Android - some light research just now suggests that one needs to root the device to get that feature. (I may well do that, but I want to get a working set-up first). Since the sandbox permissions for Calendar are do what you want, I've been looking at alternatives. Jorte Calendar requires wide permissions, and Smooth Calendar looks like it just relies on the standard Calendar app as storage, as I think does GO Calendar Widget.

I'm okay with limited data flowing to Google/Microsoft/BigCorp - such as map usage or market searches. But I'd plan to avoid using remote storage for private data: my contacts, texts, calendaring and so forth (there's something about Calendar refusing to start without a Google or FB account that is a touch irksome). I could use a local calendar on my old Sony K660 without wondering if it was being copied without consent - are there calendar apps that will do this? Or is rooting & resetting perms for Calendar my best option?

Addendum: in Privacy Settings, I've turned off Back Up My Data. Turning it on then off again reveals this dialogue box message: Are you sure you want to stop backing up your settings and application data and erase all copies on Google servers?. So that's a reassurance that file system data won't get synched by the stock OS - just Contacts and Calendar to go :-)

Post Addendum: I suggested in the comments that I might use the Corporate feature, in which one can add a Microsoft Exchange account. However this appears sadly to be subject to similar privacy objections that I apply to the Google account requirement. The user is asked for an email and password, and is confronted with this message:

By activating this application you accept that part of your mobile phone data (comprising IMEI and model name) will be stored, processed and used by Samsung for the purpose of reporting activation of the application to the licensors of the application software itself. Such data held by Samsung will be dealt with strictly in accordance with Samsung's privacy policy. A copy of the policy is available upon request. Continue?

Admittedly this is a small privacy risk compared to the wholesale copying of a calendar or contacts, but it still emphasises the point that the corporate storage of ones data is essentially mandatory. (Added here for the benefit of search engines on this topic.)

That said, it may still be worth a go. For those of us without access to a real private Exchange server, one would need to find something to emulate one, so that the Google account can be removed. Once I've settled into using the phone, I will look into these alternatives - and this in particular. Also of interest is package support in some Linux distributions - not much for OS X yet, but I will keep on looking!