Docs
The platform runs as a main Cloudflare Worker with D1 metadata, queues, and many signed storage-node Workers with private R2 buckets.
Architecture
A main Cloudflare Worker handles authentication, metadata, import jobs, private downloads, and administration. Storage-node Workers hold private R2 buckets and accept signed requests from the main Worker only.
D1 stores metadata only. File bytes are stored in private R2 buckets. OAuth tokens are encrypted before storage.
Google API use
Google data access is user initiated. Login starts with profile scopes. Drive and Photos scopes are requested only when the user starts the corresponding import flow.