Drive metadata, never file content

Google data accessed

After authorization, Google supplies the connected account's subject identifier, email address, hosted domain when applicable, an OAuth refresh token, file metadata, and sharing-permission metadata for files visible to that account. Drive Share Drift Receipt does not request or download file content and does not write or remove Drive permissions.

Data retained

Cazimedia retains encrypted account email and OAuth credentials; an opaque Google subject; hosted domain; encrypted file names and grantee labels; HMAC-protected file, grantee, and permission fingerprints; permission type, role, external domain, expiry, and inheritance state; scan status and counts; billing identifiers; sessions; and generated receipts.

Use and disclosure

Google user data is used only to provide and improve the user-facing permission-inventory, change-diff, receipt, security, deletion, and support functions described here. It is not sold, used for advertising, or transferred except to service providers acting for those functions, to comply with law, or with the user's affirmative direction.

Processors

Google supplies authorized account and Drive metadata. Cloudflare processes hosting, D1 storage, Queue work, Durable Object rate limiting, R2 receipts, and Turnstile verification. Stripe processes subscription billing. Cazimedia does not send Google Drive metadata to an AI model.

Retention and deletion

Scan evidence is retained for up to 365 days while the installation remains active. Signed receipt links expire after 10 minutes. After canceling an active subscription, the customer can delete Cazimedia-held credentials, snapshots, receipts, and sessions from the app. The app also asks Google to revoke its refresh token.

Security and scope

The app scans only files visible to the connected account. It does not use domain-wide delegation or claim a complete organization-wide audit. File names and grantee labels are encrypted at rest; raw file identifiers are replaced with keyed fingerprints for comparison.

Contact

[email protected]. The shared Cazimedia privacy policy and terms also apply.