Privacy Policy

Last updated: 23 September 2026

This policy explains what CloudDeck ("we", "the service") collects when you connect a Google account, how that information is used, and how you can remove it. It applies to https://clouddeck.tmsoagency.com and the application served from it.

Information we collect

Account information. When an account is created on the service we store your name, email address and a hashed password. Passwords are hashed and cannot be read back by us.

Google profile information. When you connect a Google account we request your basic profile and email address so the connected account can be identified in your dashboard. We store the Google account's email address, display name, profile picture URL and Google user ID.

Google Drive metadata. With your authorisation we read metadata about files in the Google Drive accounts you connect, and store it so that browsing and searching are fast. This includes:

  • file and folder names
  • MIME type and file extension
  • file size
  • folder structure and parent relationships
  • created and modified timestamps
  • starred and trashed flags
  • Google's own links and thumbnail URLs for the file
  • storage quota figures for the account

Usage records. We record activity such as sign-ins, account connections, uploads and sync runs, along with the originating IP address, so that you can review activity on your own account.

What we do not collect

  • We do not store the contents of your files. Only metadata is indexed. Your files remain in Google Drive. When you preview or download a file, it is streamed from Google at that moment and not retained by us.
  • We never ask for or store your Google password. Authorisation happens on Google's own sign-in pages through OAuth 2.0.
  • We do not use your Google data for advertising, and we do not build advertising profiles.

How we use the information

Information obtained through Google APIs is used solely to provide the features you asked for: listing and searching your files, showing which account each file belongs to, reporting storage usage, uploading files you choose to upload, and performing the file actions you initiate such as rename, move, star, trash and restore.

Limited Use disclosure

CloudDeck's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we do not transfer or sell Google user data to third parties, we do not use it for advertising purposes, and we do not allow humans to read it except where you have explicitly given permission, where it is necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymised.

How your credentials are protected

OAuth access and refresh tokens are encrypted at rest using AES-256-GCM authenticated encryption. They are never displayed in the interface, never written to logs, and never sent to your browser. The encryption key is stored outside the public web root. Access to your data is scoped to your own account on every request, so one user cannot reach another user's accounts, files or uploads.

Sharing

We do not sell your information and we do not share it with third parties for their own purposes. Information is transmitted to Google only, and only to carry out the actions you request against your own Drive accounts.

Retention and deletion

You are in control of the data held about your Google accounts:

  • Disconnect an account from the Connected Accounts page. This immediately deletes the stored OAuth tokens, the sync history for that account, and, unless you choose otherwise, all indexed file metadata for it.
  • Revoke access from Google's side at any time at myaccount.google.com/permissions. Our stored tokens stop working immediately and the account is marked as needing reconnection.
  • Request deletion of your whole account using the contact address below, and the associated records will be removed.

Cookies

We use a session cookie to keep you signed in, and a token used to protect forms against cross-site request forgery. If you choose "remember me", a further cookie keeps that session alive. We do not use advertising or third-party tracking cookies.

Children

The service is not directed at children and is not intended for use by anyone under the age required to hold a Google account in their country.

Changes

If this policy changes, the revised version will be posted on this page with an updated date above.

Contact

Questions about this policy, or requests relating to your data, can be sent to [email protected].