Privacy Policy

Prepared October 24, 2026 for Andrew OS Drive Reader, operated by Andrew Hunger. Contact: andrew.hunger@gmail.com.

This policy describes the prepared hosted reader and its separately authorized setup process when activated. Publishing these informational pages does not activate the reader or authorize Google access. Existing Front Door staging and historical archives are separate from current Drive retrieval.

Data accessed and purpose

With explicit authorization, the reader uses the Google account email and permission identifier to verify the intended account. It retrieves file and folder identifiers, names, parent relationships, types, owner identifiers, versions or revision identifiers when supplied, modification times, download capability, sizes and checksums. It retrieves the exact contents of requested plain Markdown files to provide the owner's requested context and verify file integrity.

The reader applies configured vault, file and path restrictions, ownership checks and recovery holds. It rejects missing, ambiguous, changed, unsupported or unauthorized sources; it does not substitute historical staging data for a failed current Drive read. Separate observations are not a guarantee of an atomic Google Drive snapshot.

The hosted reader requests drive.readonly. Google grants that scope across the account, including viewing and downloading files; the application's narrower vault restrictions do not reduce that provider permission. The reader does not create, edit or delete Drive files. A separate disposable test client in the same project requests drive.file for individually authorized test files, which can permit reading and editing those files. It does not share an authorization with the hosted reader.

Who receives data

Google provides account authorization and Drive services. Cloudflare is the intended host of Front Door, its credential bindings and supporting D1, R2 and KV storage. Authenticated clients selected by the owner, such as ChatGPT, receive requested records and associated evidence. Data sent to a requesting client is also subject to that client's own policies and account settings.

The application uses Google data for the requested retrieval, ownership and integrity checks, security, and disclosed recovery evidence. It does not implement sale of Google data, advertising, unrelated analytics or a model-training pipeline. The operator does not use Google Workspace API data to develop or improve generalized AI or machine-learning models. These statements describe this integration; they do not promise separate providers' handling or settings. Changes to access, use or sharing require updated disclosure and the necessary authorization before the new use begins.

Andrew OS Drive Reader's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Storage, caches and retention

The reader processes requested file bodies to answer reads. Its new routine-read manifests omit each file's body field, but this is not a guarantee that no note text is stored. Cloudflare R2 manifests retain file/path metadata, owner email addresses and permission identifiers, hashes, byte counts, version observations, timestamps and readiness information. They can also retain routing/dossier-derived labels and conflict text. That text, paths and filenames may reveal personal or substantial record information. These manifests are owner-scoped and hash-addressed. Pinned reads fetch fresh bodies and recheck provider access and metadata; the manifest is not used as a cached note-body source or an alternative canonical source.

No automatic expiration or deletion schedule is implemented for those routine-read manifests. They can remain until an explicitly authorized retention or deletion action. This is not a promise that metadata expires when a session ends.

Previously retained staging records, captures, attachment originals, historical full-note evidence and backups are not erased by the reader update. Those existing stores may contain complete content and may persist without a uniform automatic-deletion schedule. Historical downloads require authenticated references and integrity checks. Backup creation and canonical saving are not enabled by this reader. Unresolved recovery evidence and holds are not automatically deleted or rolled back.

When separately authorized, the hosted Google client secret and refresh token are stored in Cloudflare Worker secret bindings. Access tokens are cached only in request or batch memory; expiry is checked before reuse. There is no persistent access-token cache or expiry-triggered memory-erasure guarantee in the prepared reader. The refresh authorization can remain after local setup ends, until revoked, expired or otherwise invalidated.

Approved setup may temporarily pass credentials through a protected file on the owner's Mac outside the repository for the reviewed secret-upload step. Normal cleanup is verified where possible; a crash or interrupted cleanup can leave that file. Credentials are not placed in these public pages, source, chat, command arguments or retained application receipts. Local deletion is not a guarantee of secure physical erasure. No credential provisioning has been authorized merely by visiting this site.

Logging and this public site

The reader retains the technical read evidence described above. The prepared application does not deliberately place complete note bodies or Google credentials in application diagnostic logs. Hosting and authentication services may process request, network or security metadata according to their configuration and policies; their actual deployment retention settings have not been verified by this page.

These static pages contain no application JavaScript, analytics beacon, form, third-party asset or application cookie. The chosen hosting provider still receives ordinary HTTP request information, such as IP address, requested path and browser headers. Hosting configuration and provider policies govern any associated access logs.

Revocation, deletion requests and security

The owner can review and remove the application's access in Google Account third-party connections. Provider-controlled revocation and token expiry determine when access ceases. The reader stops on denied access or invalid credentials without silently falling back to a replica or launching another consent flow.

Revocation does not delete information already returned to clients or retained in Front Door and backups. Contact the operator to request a review of retained data and an authorized deletion plan. Recovery holds or legal obligations may require retaining particular evidence. There is no automatic immediate-deletion promise for historical or unresolved material.

The application uses authenticated owner access, explicit source bindings and integrity checks. These controls do not guarantee protection against every compromise, and this policy does not extend Google's, Cloudflare's or a requesting client's security or retention guarantees.

For material changes to this policy, the operator will update the published page and obtain any required authorization before introducing the new data use.