Privacy Policy for DriveForge

Effective Date: August 2026

DriveForge ("we", "our", or "the application") is a static, client-side web utility that interacts directly with Google Drive APIs. This Privacy Policy details how data is handled during active sessions.

1. File Handling and Storage

• No DriveForge file database: DriveForge is a static client application and does not provide a developer-operated database for storing your files.
• Browser processing: Local file contents are processed in your browser. Direct Google API operations send requests to Google.
• Proxy processing: Proxy-based downloads and archive reads pass the Google OAuth bearer token and requested file data through the configured Cloudflare Worker. The Worker source streams responses and sets Cache-Control: no-store; Cloudflare may process request metadata under its platform policies.
• Temporary browser state: The app keeps the active access token in JavaScript memory and clears it from the Google API client on sign-out. File metadata and selected local files remain in the page until cleared or the tab is closed.

2. Cloudflare Worker

The Worker proxies authorized Google Drive requests to support range and binary streaming. It receives the OAuth bearer token and can access the requested file contents while handling a request. The checked-in Worker code does not intentionally log or persist tokens or file bodies and returns Cache-Control: no-store. This does not prevent Cloudflare infrastructure from processing request metadata, and deployed Worker settings must be reviewed separately.

3. Google User Data & OAuth Scopes

• Access Authorization: DriveForge requests Google OAuth 2.0 access to browse, read, upload, and move files to trash when you use those features.
• Token Handling: OAuth access tokens are held in browser memory, not intentionally saved by this app to browser storage, and are sent to Google. Proxy-based requests also send the bearer token to the Cloudflare Worker so it can request the selected Drive file.
• Google data policy: DriveForge is intended to use Google user data in accordance with the Google API Services User Data Policy, including Limited Use requirements. This statement is not a Google certification; users should review the access and proxy flow described above.

4. User Responsibility for Private / Sensitive Data

Because DriveForge operates locally without centralized moderation or server-side safeguards, you are solely responsible for ensuring that handling sensitive or private files on shared or untrusted computers is conducted safely.

5. Policy Revisions

This policy may be updated periodically to reflect changes in web standards or API requirements. Updates will be reflected on this page with an updated effective date.

← Return to DriveForge