Privacy Policy

Who operates this service

Drive by OgenSync is operated for OgenSync users at drive.ogensync.com. Contact: ogensync@gmail.com.

Information we collect

• Google sign-in profile data: Google account ID, email address, display name, and profile photo.
• Google OAuth authorization data: access tokens, refresh tokens when issued by Google, token expiry, and granted scopes. Tokens are encrypted before storage.
• Google Drive data selected by you: file IDs, file names, MIME types, file sizes when available, Drive metadata needed for import, and the bytes of files or exported Workspace documents you choose.
• Google Photos data selected by you: picker session information, media item IDs, filenames, MIME types, selected media bytes, thumbnails where available, and API metadata for selected items.
• Phone verification data: phone number, OTP status, OTP attempt metadata, and verification timestamp. OTP values are stored as hashes only and expire quickly.
• Service metadata: import jobs, file status, storage node IDs, object keys, checksums, download metadata, session cookies, audit logs, and security events.

Google API scopes we request

• openid, email, and profile for Google sign-in.
• https://www.googleapis.com/auth/drive.file so you can select specific Google Drive files through Google Picker and import only those selected files.
• https://www.googleapis.com/auth/photospicker.mediaitems.readonly so you can select specific Google Photos media through Google Photos Picker and import only those selected media items.

How we use information

• Authenticate your account and maintain secure sessions.
• Verify your phone number using WhatsApp OTP before imports are enabled.
• Import only the Google Drive files or Google Photos media that you explicitly select.
• Store private copies of selected files in OgenSync storage nodes.
• Show import progress, file lists, download links, errors, and account status.
• Operate, debug, protect, and improve the reliability and security of the service.
• Respond to support, abuse, legal, or security requests.

Google API Limited Use disclosure

Drive by OgenSync's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell Google user data. We do not use Google user data for advertising. We do not use Google user data to train generalized AI or machine learning models. We do not allow humans to read imported file contents except where necessary for security, abuse investigation, legal compliance, or support requested by the user.

Storage and processors

• Cloudflare Workers, D1, R2, Queues, and related Cloudflare services process application code, metadata, queues, private file objects, and logs.
• Google APIs process Google sign-in, OAuth, Picker, Drive, and Photos requests initiated by users.
• The WhatsApp OTP provider processes the phone number and OTP message needed for phone verification.
• Additional OgenSync-controlled Cloudflare storage-node Workers may store private file objects in R2 buckets.

How we share information

We share information only with service providers needed to operate the app, with storage nodes controlled by OgenSync, when directed by the user, when required by law, or to protect users and the service. We do not sell personal information or imported file contents.

Security

• The service uses HTTPS for transport.
• User sessions use HttpOnly, Secure, SameSite cookies.
• Google OAuth tokens are encrypted before storage.
• Phone OTP values are hashed and expire after a short period.
• Storage-node requests are signed with HMAC headers and private R2 buckets are not publicly exposed.
• Downloads are authorized through the main Worker rather than public bucket URLs.

Retention and deletion

Imported file metadata and private file objects are retained while your account or stored files remain active. You can delete imported files in the app where deletion is available. You may also request account, token, metadata, and stored file deletion by emailing support.

You can revoke Google access at any time from your Google Account permissions page. After revocation, future imports may require reconnecting Google.

Children

Drive by OgenSync is not intended for children under 13 or for users who cannot legally consent to use the service.

Changes

We may update this Privacy Policy as the service changes. The latest version will be posted at drive.ogensync.com/privacy with an updated date.