Privacy Policy

Multiapp Server Backup

This policy describes how Multiapp Server Backup handles data when it connects to a Google account. It covers this tool only.

What the tool uses Google Drive for

Google Drive is used for exactly one purpose: as an off-site destination for encrypted server backups. Nothing else.

Scope of access

• The requested OAuth scope is drive.file.
• This scope allows the application to access only files created or opened by this application. It does not grant access to arbitrary or unrelated contents of the Google Drive account.
• No other Google Drive files are read, listed, indexed, analysed or modified.
• The tool requests no other Google API scopes, and reads no Google profile, contact, calendar or mail data.

Encryption

Backup payloads are encrypted before upload, on the server, using restic. The encryption key never leaves the operator's control and is not stored in Google Drive. What is uploaded to Google Drive is an encrypted repository.

What is not done with Google account data

• Google account data is not sold, and never has been.
• Google account data is not used for advertising, ad targeting, or profiling.
• Google account data is not transferred to third parties, except that the encrypted backup files are stored by Google itself as the storage provider.
• No unrelated Google Drive files are indexed or analysed.

Credentials and tokens

OAuth credentials and refresh tokens are stored only in protected server configuration readable by the backup process alone. They are not stored in any database, source repository, application environment, log, or backup, and are never displayed in these pages.

Revoking access

The account owner can revoke this application's access at any time from Google Account security settings, under Security → Your connections to third-party apps & services. Doing so immediately stops the tool from reading or writing anything in Drive.

Retention

Encrypted backup files are retained in Drive according to the operator's backup retention schedule, and older ones are deleted automatically as newer ones replace them. No fixed legal retention period is claimed here.

Scope of this statement

This describes the controls actually implemented. It makes no claim to any security certification, audit, or compliance accreditation, because none is in place for this tool.

Contact

Questions about this policy: ilkin.tacan@gmail.com