Read-only. A feed URL carries its own token — never a login — so sharing a calendar never shares an account.