Drive Privacy Policy

1. What this policy covers

This policy explains how Drive ("we", "us") collects, uses, protects and shares information when you use Drive, our secure file backup service. It covers the Drive website, the Drive mobile app's photo and video backup, and the Capsa service that stores and protects your files behind them (together, the "Service").

By using the Service you agree to the practices described here. If you do not agree, please do not use the Service.

2. Information we collect

2.1 Information from your account

You sign in to Drive through our Accounts sign-in service; Drive itself never sees or stores your password. When you first sign in, Accounts shares the following with Drive:

• Your first and last name, which we store encrypted.
• An account identifier that links your Drive data to your Accounts profile.
• A public encryption key and access to your account key, which we use to encrypt and decrypt your files (see section 4).

2.2 Your files and the information about them

• File contents you upload, import or back up.
• File and folder names, which we store encrypted.
• File details such as size, type, and when a file was added, changed, opened, starred or moved to Trash.
• Media details that photos, videos and recordings carry inside them, such as the camera or device model, exposure settings, the date taken and, if the file includes it, the location where it was captured. We read these so we can show them to you in a file's details panel. They are stored encrypted and are never shared.
• Thumbnails and previews we generate so you can browse your files. Thumbnails are stripped of all embedded metadata, including location.

2.3 Locked folders

If you set up a Locked folder, you choose a passphrase. We store only a one-way hash of that passphrase, never the passphrase itself. Files and names inside Locked are encrypted with a separate key that can only be opened with your passphrase. If you forget your passphrase, we cannot recover the contents of Locked; resetting it permanently deletes them.

2.4 Imports and backups

• Google Drive and OneDrive. When you choose to import, you sign in to Google or Microsoft in a window they control and pick the files you want. We receive a temporary access token limited to the files you selected, and the provider's identifier for each file (stored encrypted) so the same file is not imported twice.
• Posts on X. When you paste a link to a public post on X, we read that post's public description to find its photos and videos, and your browser downloads those media and adds them to your Drive. We do not access your X account.
• Mobile backup. When you turn on backup in the mobile app, it uploads the photos and videos in your device library. We keep an identifier for the device and for each backed-up item so items are not uploaded twice.

2.5 Preferences

Settings you choose, such as list or grid view, whether Locked is hidden, and how quickly Locked reseals.

2.6 Technical information

Our servers keep standard request logs, which can include your IP address, browser or app type, the address requested, and the date, time and outcome of the request. We use these to operate, secure and troubleshoot the Service.

2.7 What we do not collect

We do not use advertising, analytics or tracking cookies, and we do not build profiles of you for marketing. Drive keeps your sign-in session in your browser's local storage so you stay signed in. If you import from OneDrive, Microsoft's sign-in library also keeps its own session data in local storage. Drive installs a service worker in your browser that only helps stream your own videos and audio.

3. How we use information

We use the information above only to provide and protect the Service, namely to:

• store, encrypt, organize, preview and return your files to you;
• carry out the imports and backups you ask for;
• scan files for viruses and keep infected files out of your Drive;
• show your storage usage;
• keep you signed in and protect accounts from unauthorized access;
• diagnose problems, prevent abuse, and keep the Service secure; and
• comply with legal obligations.

We do not use the contents of your files for advertising, and we do not use your files to train machine learning or artificial intelligence models.

4. How we protect your information

• Encryption at rest. Shortly after a file reaches our storage, our servers encrypt it with a key tied to your account and delete the unencrypted copy. Files imported from Google Drive or OneDrive are encrypted as they are copied in and are never stored unencrypted. File names, folder names, your name, and media details are also encrypted.
• Locked folders add a second key that is only usable with your passphrase.
• Encryption in transit. All traffic between your device and the Service uses HTTPS.
• Virus scanning. Every file is scanned as it is secured. An infected file is discarded and never kept. Very large files that exceed our scanner's limit are stored without a scan and marked as unscanned.
• Temporary access. When you download or open a file, we prepare a temporary copy behind a link that expires automatically, after which the temporary copy is deleted. Import access tokens are held, encrypted, only for as long as the provider allows them to be used.

No system is perfectly secure, and we cannot guarantee absolute security. If we learn of a security incident that affects your personal information, we will notify you as required by law.

5. How we share information

We do not sell or rent your personal information, and we do not share it for advertising. We share it only as follows:

6. Google user data

Drive's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We access only the Google Drive files you select in the Google picker, and only to copy them into your Drive at your request.
• We do not use Google user data for advertising, and we do not sell it.
• We do not allow humans to read Google user data, except with your permission, for security purposes, to comply with law, or where the data has been aggregated and anonymized for internal operations.
• We do not use Google user data to train artificial intelligence or machine learning models.
• Access tokens are kept encrypted, only for the duration of the import, and are not stored afterwards.

You can revoke Drive's access at any time from your Google Account's security settings. Microsoft access can be revoked from your Microsoft account's app permissions page.

7. How long we keep information

• Your files are kept until you delete them. Items you delete go to Trash and are permanently purged after 30 days, or sooner if you empty Trash.
• Files that fail to upload, or that contain a virus, are deleted and not kept.
• Temporary download copies are deleted when their link expires.
• Import access tokens are discarded when they expire.
• Server logs are kept for a limited period for security and troubleshooting.
• Your account data is kept while your account is active. You can ask us to delete your account by contacting semiu@live.com; we will then delete your files and associated data, except where we must keep something to meet a legal obligation.

8. Your choices and rights

You can view, download, rename, move and delete your files at any time from within Drive. You can turn off mobile backup in the app and revoke import access from Google or Microsoft.

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to withdraw consent. To make a request, contact us at semiu@live.com. We will respond within the time required by applicable law and will not discriminate against you for exercising your rights. You may also have the right to complain to your local data protection authority.

9. International transfers

We and our service providers may process and store information in countries other than the one you live in. Where required, we use appropriate safeguards for these transfers.

10. Children

The Service is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect personal information from them. If you believe a child has given us personal information, please contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we will let you know through the Service or by other means before they take effect. The "Last updated" date above shows when it last changed.

12. Contact

Questions or requests about this policy or your information: semiu@live.com.