Privacy Policy

Overview

DriveMesh is a private, personal-use application that lets its operator manage files across their own Google Drive accounts from a single interface. It is not offered as a commercial service and is not available to the general public.

This policy explains exactly what Google user data DriveMesh accesses, how that data is used, where it is stored, and how it can be removed.

Data we access

When a Google account is connected, DriveMesh requests the following permissions:

• Google Drive access (auth/drive) — to list, search, move, rename, trash and delete files and folders in that account.
• Email address (openid, userinfo.email) — used only to label which connected account is which in the interface.

In practice, DriveMesh reads file metadata: names, IDs, MIME types, sizes, creation and modification dates, folder relationships and trash status. It does not open, download, read or analyse the contents of documents, images or other files.

How we use it

File metadata is used solely to display files in the interface and to carry out explicitly requested actions — running a search, moving an item to a folder, sending something to Trash, or deleting it permanently.

DriveMesh performs no background scanning, no indexing for other purposes, no advertising, no profiling, and no automated processing. Nothing happens that the user did not initiate.

What we store

• OAuth refresh tokens — encrypted at rest using AES-GCM and stored in a private Cloudflare D1 database, so accounts don't need re-authorising on every visit.
• Account email addresses — to identify connected accounts in the interface.
• An action log — a record of moves, trashes and deletions performed through DriveMesh, so actions can be reviewed and mistakes traced.

Access tokens are cached temporarily and expire within an hour. File contents are never stored. File metadata is fetched live from Google's API on use and is not retained on the server afterwards.

Sharing and disclosure

Google user data obtained through DriveMesh is not sold, rented, shared, transferred or disclosed to any third party. There are no analytics providers, advertising networks, or external processors involved. Data moves between the browser, the DriveMesh backend, and Google's APIs — nowhere else.

Limited Use

Retention and deletion

Any account can be disconnected from within DriveMesh, which immediately deletes its stored refresh token and email address from the database.

Access can also be revoked at any time from the Google Account permissions page. Revoking access invalidates the stored token instantly, and DriveMesh loses all ability to reach that account.

To request deletion of all stored data, use the contact address below.

Security

Refresh tokens are encrypted before being written to the database. The application sits behind password authentication, secrets are held in Cloudflare's encrypted secret storage, and all traffic is served over HTTPS. No credentials or tokens are ever exposed to the browser.

Changes

If this policy changes, the revised version will be published on this page with an updated date.

Contact

Questions about this policy or about data handling: xpravan2@gmail.com