Privacy Policy

# Privacy Policy - CPC Drive Manager

**Last Updated:** November 9, 2025

## What This GPT Does

CPC Drive Manager helps you manage files in your Google Drive through conversational commands.

## Data Collection & Storage

### What We Access

- **Google Drive Files:** Only files created by this application (via OAuth scope `drive.file`)

- **User ID:** A simple identifier you choose (e.g., "joseph", "alice")

### What We Store

- **Refresh Tokens:** Stored securely in Google Secret Manager (encrypted at rest)

- **Authorization Metadata:** User ID and token expiry timestamp in Google Firestore

- **No File Contents:** We do not store the contents of your Drive files on our servers

### What We Don't Collect

- ❌ Email addresses

- ❌ Personal information beyond user ID

- ❌ Browsing history

- ❌ Location data

- ❌ Analytics or tracking data

## Data Usage

### How Your Data is Used

- **Drive Operations:** Your refresh token is used solely to perform Drive operations you request (read, write, list files)

- **Authentication:** Your user ID maps you to your stored credentials

### Who Has Access

- **You:** Full control over your Drive files through this GPT

- **Server:** Automated access only when you make requests

- **No Third Parties:** We do not share, sell, or provide your data to third parties

## Data Security

### Security Measures

- ✅ **Encrypted Storage:** Tokens stored in Google Secret Manager with encryption at rest

- ✅ **Least Privilege:** Server uses granular permissions (only accesses specific secrets)

- ✅ **Secure Transmission:** All API calls use HTTPS/TLS

- ✅ **No Logs:** File contents are not logged

- ✅ **OAuth 2.0:** Industry-standard authorization protocol

### Infrastructure

- Hosted on Google Cloud Run (serverless, auto-scaling)

- Uses Google Cloud security best practices

- Regular security updates applied automatically

## Your Rights

### You Can:

- **Revoke Access:** Remove authorization at any time via Google Account settings

- **Delete Data:** Request deletion of your stored tokens

- **Export Data:** Not applicable (we don't store your file contents)

- **Audit:** Review what permissions the app has in your Google Account

### How to Revoke Access

1. Go to: https://myaccount.google.com/permissions

2. Find "CPC Server"

3. Click "Remove Access"

4. Your tokens will be invalidated immediately

## Data Retention

- **Active Users:** Tokens retained while you use the service

- **Inactive Users:** Tokens expire after 6 months of inactivity (Google's refresh token policy)

- **Upon Revocation:** Your data is deleted within 30 days

## Children's Privacy

This service is not intended for users under 13 years of age. We do not knowingly collect data from children.

## Changes to Privacy Policy

We may update this policy. Changes will be noted by the "Last Updated" date at the top.

## Contact

**Questions or Concerns:**

- Email: josephwander@gmail.com

- GitHub: [if you publish the code]

## Compliance

- ✅ Follows Google OAuth 2.0 policies

- ✅ Uses restricted scopes (`drive.file` - no verification required)

- ✅ Complies with Google API Services User Data Policy

## Technical Details (Optional Transparency)

**What Happens When You Authorize:**

1. You're redirected to Google's authorization page

2. You grant permission for "See, edit, create, and delete only the specific Google Drive files you use with this app"

3. Google issues a refresh token

4. Token is stored encrypted in Secret Manager

5. Server uses token only for operations you request

**No AI Training:** Your Drive file contents are not used to train AI models.

---

**By using CPC Drive Manager, you agree to this privacy policy.**