Privacy Policy for DriveForge

Last Updated: October 17, 2026 | Effective Date: August 2026

DriveForge ("we", "our", or "the application", operating at driveforge.in under Google Cloud Project ID drive-zipper-506421) is a client-side web utility that allows users to browse, compress, extract, preview, and manage files in their Google Drive. This Privacy Policy explains what Google user data we access, how it is protected, with whom it is shared or disclosed, and how it is retained and deleted.

1. Google User Data We Access

When you click "Authorize Google Drive" and grant permission via Google OAuth 2.0, DriveForge requests access to the Google Drive API scope (https://www.googleapis.com/auth/drive.file) solely to perform actions you explicitly initiate in the interface:

• Account Profile Information: Your display name, email address, and profile avatar (via drive.about.get) to display your active session in the top-right account switcher inside the application UI.
• Google Drive File & Folder Metadata: File names, IDs, MIME types, sizes, and parent folder relationships so you can browse, search, sort, move, copy, or trash files in your Google Drive.
• Google Drive File Contents (Binary Streams): File streams and HTTP byte ranges of files and archives you select to compress into ZIP packages, extract back to Google Drive or your local device, download, or stream in the built-in media preview player.

2. Data Sharing, Transfer, and Disclosure of Google User Data

We strictly limit how Google user data is handled and disclosed:

• No Sale, Advertising, or AI/ML Model Training: DriveForge does not sell, rent, license, trade, or transfer your Google user data (including Google Drive files, archive contents, metadata, or email addresses) to any third parties, advertisers, data brokers, or artificial intelligence / machine learning (AI/ML) models.
• Stateless Network Streaming Proxy (Cloudflare Workers): To bypass browser Cross-Origin Resource Sharing (CORS) limitations and enable HTTP Range reading on Google Drive archives and media streams, your browser routes file stream requests through our stateless Cloudflare Worker endpoint (driveforge.mnikki1035.workers.dev). This Worker passes your short-lived OAuth 2.0 Bearer token directly to Google's official Drive API servers (www.googleapis.com) and pipes the binary response straight back to your browser. The Worker does not log, store, inspect, or share your OAuth tokens or file contents.
• Support & Investor Inquiry Forms: If you voluntarily submit a support ticket on our Help page (routed via driveforge-support.mnikki1035.workers.dev) or an inquiry on our landing page (via Google Forms), only the contact details and message text you explicitly type into those forms are transmitted so the developer can respond to your inquiry.
• Website Analytics: We use Microsoft Clarity for aggregate user-interface telemetry (such as page layout interactions). Google Drive file contents and OAuth access tokens are never transmitted to or shared with third-party analytics providers.
• Legal Compliance: We do not disclose Google user data to any external party unless strictly required to comply with applicable law, regulation, or valid binding legal process, and note that we do not possess stored copies of your Google Drive files or tokens on our servers.

3. Data Protection Mechanisms for Sensitive Data

We implement strict technical, cryptographic, and architectural safeguards to protect sensitive Google user data against unauthorized access, alteration, disclosure, or destruction:

• Encryption in Transit (HTTPS / TLS 1.2+ & HSTS): All data transmitted between your web browser, our Cloudflare Worker streaming proxy, and Google Drive APIs is encrypted in transit using industry-standard HTTPS/TLS 1.2+ protocols enforced with HTTP Strict Transport Security (Strict-Transport-Security: max-age=31536000).
• Client-Side Volatile Memory Processing: Archive compression, ZIP central directory inspection, and file extraction are executed locally inside your browser's isolated Web Workers and volatile RAM using @zip.js/zip.js. Your Google Drive files are never written to any persistent server disk or database operated by DriveForge.
• Ephemeral OAuth 2.0 Token Handling: OAuth 2.0 access tokens are generated via Google Identity Services (GIS) and stored exclusively in volatile JavaScript runtime memory for the duration of your active browser tab session. DriveForge explicitly clears any session storage tokens and never writes OAuth tokens to localStorage, cookies, or external databases.
• Defense-in-Depth Browser Security Controls: The application enforces a strict Content Security Policy (CSP), X-Frame-Options: SAMEORIGIN, X-Content-Type-Options: nosniff, DOM sanitization via DOMPurify to prevent Cross-Site Scripting (XSS), and strict archive path validation (sanitizePath) and zip-bomb ratio limits to protect client memory.

4. Data Retention and Deletion of Google User Data

DriveForge follows a strict zero-persistence data retention model for Google user data:

• Google Drive Files & Metadata Retention: DriveForge retains your Google Drive file contents and metadata for zero days on our servers. All file buffers (`Blob` and `ArrayBuffer` objects) exist solely in your device's volatile browser memory during an active operation and are immediately garbage-collected and purged when the operation finishes, when you click "Sign Out", or when you close the browser tab.
• OAuth Token Retention & Immediate Deletion: OAuth 2.0 access tokens expire automatically (~60 minutes) or are immediately revoked and destroyed the moment you click the Sign Out button inside DriveForge (which calls google.accounts.oauth2.revoke()).
• Support & Inquiry Records Retention: If you voluntarily submit your name and email via our support form or investor inquiry form, that correspondence is retained only for as long as necessary to resolve your support request or inquiry, after which it is deleted.
• How to Revoke Access or Request Data Deletion:
  • In-App Sign Out & Token Revocation: Click your profile badge in the top-right corner of DriveForge and select Sign Out to immediately revoke your OAuth token and clear all in-memory data.
  • Google Account Security Settings: You can revoke DriveForge's access to your Google Account at any time directly from your Google Account Permissions page at https://myaccount.google.com/permissions.
  • Data Deletion Requests: To request the permanent deletion of any support tickets, inquiry form submissions, or associated contact records, email the developer directly at mnikki1035@gmail.com. All deletion requests are processed and confirmed within 7 business days.

5. Contact Information

If you have any questions about this Privacy Policy, our security practices, or your Google user data, please contact the developer at mnikki1035@gmail.com or submit a request via our Support & Help Portal.