Privacy Policy

1. Operator and purpose

VoidBox is a private development and infrastructure ecosystem operated by its owner. This Google Drive integration is used by the owner for private infrastructure; it is not a public SaaS product or a commercial backup service. VoidBox is the project name, not a representation that a registered company operates this integration.

The purpose of the Google Drive connection is to support off-site replication and recovery of a Kopia backup repository. The website is informational only: it does not authorize accounts, run or control backup jobs, or receive Drive files.

2. Google Drive permission

The configured rclone Drive remote uses Google's standard https://www.googleapis.com/auth/drive scope. This is broad, non-read-only access across files in the authorized Drive account, except the Drive application data folder. It permits listing, reading, creating, modifying, moving, and deleting files.

The production Kopia replication job is configured as kopia repository sync-to rclone with the Drive destination gdrive:Citadel-Kopia-Replica. The permission allows more access than that destination alone requires; the job's configured target does not narrow the OAuth grant.

The Drive destination is awaiting owner reauthorization and end-to-end verification. It must not be treated as operational until those checks pass.

The owner authorizes access directly with Google. This website does not ask for or collect Google passwords, OAuth tokens, recovery codes, or other account credentials.

3. Drive data and metadata

The configured repository workflow may read, write, and manage Kopia repository objects in the designated Drive destination. It also uses the Drive file information needed to locate and manage those objects, such as names, IDs, folder relationships, MIME types, sizes, timestamps, and checksums when available.

The OAuth scope is account-wide rather than folder-limited. It therefore technically permits access to other files in the authorized Drive account, although the configured Kopia job targets the repository destination described above. This disclosure does not claim that the job routinely reads unrelated Drive files.

4. How rclone and Kopia handle data

• Google OAuth authorizes the owner's account with Google.
• rclone connects the owner's private infrastructure to the Drive API and performs file operations for the configured repository workflow.
• Kopia manages the backup repository and its replication. Kopia repository encryption is a separate mechanism from rclone's optional crypt remote.

A gcrypt remote exists in the infrastructure, but the Kopia-to-Drive replication job described here does not use it. This policy does not claim that all uploads to Google Drive use rclone crypt.

The website itself does not perform these operations. Recovery and end-to-end verification are run separately by the owner in private infrastructure.

5. Storage and service providers

When the Drive replication workflow is authorized and run, the Kopia repository replica is stored in the owner's Google Drive account at the configured destination. Google's services process OAuth and Drive data under Google's own terms.

The owner's private infrastructure also uses FileJump WebDAV as a separate off-site destination. The Google OAuth grant does not authorize FileJump. Whether the FileJump destination contains the same repository data as the Google Drive destination has not been verified; the destinations are governed by separate configuration.

OAuth client and token material is kept in the owner's rclone configuration on Citadel, not on this website. Backup copies remain with the storage destination until they are separately removed under the applicable backup and provider procedures.

6. Sharing, transfers, and Google Limited Use

Google Drive data is used for the owner's disclosed backup replication and recovery purpose. It is not sold, used for advertising, or used to train generalized AI models. FileJump WebDAV is a separate off-site destination; whether that separate workflow contains the same repository data, or any data read from Google Drive, has not been verified. This policy does not claim that Google Drive data is transferred directly to FileJump.

Google user data is handled under Google's API Services User Data Policy, including Limited Use. Use is limited to the disclosed integration function; Google user data is not transferred for unrelated purposes. Any transfer needed to provide the disclosed function requires the account owner's consent, and other transfers are limited to the security and legal circumstances allowed by Google's policy. Human review beyond the account owner operating or recovering their own data is limited to prior affirmative authorization for specific data or the security and legal circumstances permitted by the policy. This statement is not a Google verification or endorsement.

This static website has no account form, upload form, OAuth flow, analytics tag, or tracking pixel. Its hosting provider may process technical request information under the provider's own terms; the website does not receive the Drive data described above.

7. Retention and deletion

No fixed retention period is stated. The current Kopia retention and pruning settings, and the final-removal behavior for Drive trash or provider-side versions, have not been verified for this integration. The same-data retention behavior at FileJump is also not established here.

Revoking Google OAuth access stops future Drive operations that depend on that authorization, but it does not automatically delete backup copies already uploaded to Google Drive. Deletion must be handled separately in the relevant Kopia, Google Drive, and any other destination procedures. Contact admin@voidbox.tech with privacy or deletion requests.

This website does not store backup data and cannot delete it on the owner's behalf.

8. Revoking Google account access

The account owner can visit the Google Account connections page, select the application shown in the Google consent screen, and choose the option to remove its access.

After revocation, rclone cannot use that grant for further Drive operations unless the owner authorizes it again. Existing backup copies are not automatically removed; see the separate deletion process above.

9. Security

Google authorization and token material are handled by the owner's private infrastructure and rclone configuration, not by this website. Kopia repository encryption and rclone crypt are separate mechanisms; the Drive replication job uses Kopia's repository, not the gcrypt remote. No claim is made that unrelated Drive files, all Drive metadata, or every other upload is encrypted by rclone crypt.

This policy does not claim a security certification, independent audit, or specific protection for encryption keys beyond Kopia's repository encryption. Details of key handling and the precise human-access procedures have not been verified for publication.

10. Contact and policy changes

The operator will update this policy at this URL if the integration's purposes, access, data paths, storage recipients, retention, deletion, or security practices change. For a privacy-related request, contact the address above.