Privacy Policy

DriveVault is operated by Flyonz.

DriveVault stores your DriveVault account email and a one-way password hash used to authenticate your workspace.

When you connect Google, DriveVault receives your Google account email and OAuth access credentials. OAuth access and refresh tokens are encrypted at rest and are not exposed to the browser.

To provide file-management features, DriveVault stores Google Drive metadata such as file and folder IDs, names, MIME types, sizes, folder paths, timestamps, ownership/sharing metadata, capabilities, account storage usage, routing rules, and activity records.

DriveVault does not intentionally copy your Google Drive file contents into its application database. Large uploads use a Google Drive resumable upload session so file bytes travel from your browser directly to Google Drive.

When you request previews, downloads, text previews, revisions, or other content-dependent features, file content may pass through DriveVault servers temporarily so the requested feature can be delivered. That transient content is not intended to be retained as a separate DriveVault copy.

DriveVault uses the information above only to authenticate you, connect the Google accounts you choose, display and synchronize your Drive metadata, perform file actions you request, apply routing rules, maintain activity history, prevent abuse, diagnose failures, and operate the service.

DriveVault does not use Google user data for advertising or sell Google user data.

DriveVault requests https://www.googleapis.com/auth/drive, which allows DriveVault to view and manage files across the Google Drive account you connect. This access is necessary because DriveVault's core workspace indexes files that already exist in your Drive and lets you perform user-requested actions including browse, upload, organize, share, move, rename, trash, restore, revision, preview/download, and transfer operations.

DriveVault also requests your Google account email so the service can identify which Google Drive account you connected. It does not request Google profile access for this purpose.

DriveVault's use and transfer of information received from Google APIs is limited to providing and improving the user-facing functionality described on this site and must comply with the Google API Services User Data Policy, including applicable Limited Use requirements.

DriveVault does not sell Google user data or use it for advertising. Routine service operation does not require staff to read your Google Drive file contents. Any exceptional human access to specific Google user data must be limited to a user-authorized support request, security/abuse investigation, applicable legal requirements, or another use permitted by Google's policies.

OAuth tokens are encrypted at rest. DriveVault sessions use signed, HTTP-only cookies, and data access is scoped to the authenticated DriveVault user. Production secrets are expected to be provided through deployment environment variables rather than committed to the source repository.

Production deployments may use an error-monitoring provider to receive sanitized diagnostic events such as error type, trace reference, release/environment, and non-identifying operational metadata. DriveVault is designed not to send OAuth tokens, file content, raw browser exception messages, account emails, or file/account identifiers in those monitoring events.

No online service can guarantee absolute security. You are responsible for protecting your DriveVault password and the security of devices and Google accounts you use with the service.

Drive metadata and activity are kept while needed to provide your workspace. Removing a connected Google account attempts to revoke DriveVault's Google OAuth authorization for that Google account and removes the corresponding local tokens, indexes, rules, and account activity. This does not delete the original files stored in Google Drive.

You can permanently delete your DriveVault account from Settings. Account deletion first attempts to revoke connected Google authorizations and then deletes your DriveVault user record, connected-account credentials, indexed Drive metadata, routing rules, and activity records.

DriveVault may rely on hosting, database, logging, and infrastructure providers to operate the service. Those providers process information only as necessary to provide their infrastructure services. DriveVault may also disclose information when required by applicable law or a valid legal process.

This policy may be updated when DriveVault's features, providers, or legal obligations change. Material changes should be reflected by updating the effective date on this page.

Privacy questions or deletion support: support@flyonz.web.id.