Privacy Policy

Operator and contact

The operator is the owner of the Google Cloud project identified on the OAuth consent screen. Questions or deletion requests should be sent to the support email displayed on that screen. This installation is intended for the operator's own dedicated account and trusted clients, not for public registration.

Data and permissions

The Google Drive integration uses an OAuth client ID, client secret, refresh token, short-lived access tokens and a folder ID. The full https://www.googleapis.com/auth/drive scope can access, create, change and delete all files in the authorized Drive account. The configured folder is an intended working location, not an access-control boundary.

Normal transport operation creates, lists, reads and deletes encrypted session files and related session metadata in that folder. The operator's VPN server also processes connection and destination information needed to relay traffic, and may retain per-user usage, expiry and operational logs. No zero-logging guarantee is made.

How data is used and shared

Drive data is used to provide and maintain the configured transport. This installation is not configured to sell Google user data, use it for advertising or use it to train AI models.

Session files and API requests are processed by Google. The self-hosted server, its hosting provider and configured network or DNS providers process the information necessary to operate their services. Trusted client recipients receive the shared OAuth credentials through their configuration and can independently access the authorized account. Do not distribute configurations publicly.

Encryption of session contents does not hide all metadata, such as file activity, timing, sizes or account access, from service providers.

Storage and retention

Credentials are stored in private server and client configuration files and may also exist in private exports and backups. Access tokens are refreshed as needed. Temporary session files are subject to XDRIVE cleanup, but interrupted operation, errors or backups can leave data behind; immediate deletion is not guaranteed.

To stop access, revoke the application's authorization in your Google Account, stop the clients and server, and remove the dedicated session folder and private configurations or backups you no longer need. Provider backups and retention are governed by their own policies.

Deleting or expiring a VPN user alone does not revoke the shared Google refresh token or erase copies of an exported configuration.

This information website

This site contains no application login, credential collection, advertising scripts, analytics scripts or application cookies. Its hosting and security provider, Cloudflare, may process request metadata such as IP addresses and user agents to deliver and protect the site; provider security measures may use their own cookies.

Do not submit credentials through URLs or contact messages. Authorization should only be performed using the Google project and official Google authorization flow you control.

Changes

Changes to this installation may require a policy update. Review this page before reauthorizing or distributing a configuration.