Privacy Policy

Last updated: 2026-10-15

This Privacy Policy explains how Software Expert Kft. ("we", "us", "Provider") handles information when you use DriveCommander (the "Service").

1. Data Controller

Software Expert Kft.
Budapest, Hungary
EU VAT: HU14677036
Email: hello@codestarter.me

2. What Data We Process

2.1 Data We Do Not Store on Our Servers:

We do not store on our servers your file contents or file metadata (such as file names, IDs, paths, or folder structures).

2.2 Data Processed Locally in Your Browser:

To display the interface and perform file operations you initiate, the Service processes file metadata locally in your browser. This data remains on your device.

• OAuth Access Tokens: OAuth access tokens are handled in your browser and are not intentionally transmitted to our servers. Google tokens are held in memory only and are gone when you close the tab. Microsoft tokens are held in your browser's local storage by Microsoft's authentication library, encrypted, with the decryption key in a session cookie set by Microsoft - so they become unreadable once you close the browser, unless you chose "Keep me signed in" at Microsoft. We take measures to avoid logging or collecting authorization credentials.
• User Preferences: Any local settings are stored in your browser's local storage and remain on your device.

2.3 Data That May Be Logged (Server-Side):

• Web Server Logs: IP address, user-agent, request timestamps, HTTP status codes
• Purpose: Security, troubleshooting, abuse prevention
• Retention: Up to 30 days
• Legal Basis (GDPR): Legitimate interest (Article 6(1)(f)) - security and service operation

2.4 Data We Store on Our Servers:

• What: When you connect an account, we record the email address of that account and which provider it belongs to (Google Drive or OneDrive). Nothing else - no file names, no file contents, no tokens, no IP address.
• Why: Two reasons. To see how much the Service is used during its Beta and by how many distinct people; and so that we can reach the people using it about the Beta itself - changes, problems, and the end of the Beta period.
• What we will not do with it: We do not send marketing or newsletters, we do not build a profile of you, and we do not share, sell or pass the address to anyone.
• Where: Google Cloud Firestore, in the European Union (multi-region eur3 - Belgium and the Netherlands).
• Legal Basis (GDPR): Legitimate interest (Article 6(1)(f)) - running and supporting a Beta service, and being able to contact the people taking part in it. You have the right to object at any time, and if you do we will delete the record; see Section 7.
• Retention: Until the end of the Beta, after which these records are deleted.

3. How File Operations Work

All file operations (listing, copying, moving, renaming, deleting) are performed directly between your browser and the cloud provider's API:

• Google Drive: Google Drive API (googleapis.com)
• Microsoft OneDrive: Microsoft Graph API (graph.microsoft.com)

Your files never pass through our servers. We do not act as a proxy for file content.

4. Third-Party Services

When you use the Service, your data is processed by:

• Google (for Google Drive authentication and API) - Google Privacy Policy
• Microsoft (for OneDrive authentication and API) - Microsoft Privacy Statement
• Google Firebase: Hosting for the application files, and the database holding the usage record described in Section 2.4

We do not use analytics services, advertising networks, or tracking pixels. The usage record in Section 2.4 is written by the Service to our own database; no third-party analytics provider is involved, and nothing you do inside the Service is tracked beyond that single record per connected account.

5. Cookies

DriveCommander does not set cookies for tracking or advertising, and sets no cookies of its own. Signing in is handled by Google and Microsoft, which set their own cookies on their own domains. Microsoft additionally sets a session cookie holding the key its library uses to encrypt the tokens it keeps in your browser's local storage; that cookie is not readable by us.

6. Data Retention

• OAuth tokens: Google - held in memory, gone when you close the tab. Microsoft - in local storage, encrypted with a key that does not survive closing the browser, unless you chose "Keep me signed in" at Microsoft
• Usage records (Section 2.4): Until the end of the Beta
• Server logs: Up to 30 days
• Your files: Remain in your cloud storage account, subject to your provider's policies

7. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access: Request information about data we process
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data
• Restriction: Limit how we process your data
• Portability: Receive your data in a portable format
• Object: Object to processing based on legitimate interest

The only personal data we keep is the record described in Section 2.4 - one email address per connected account - plus temporary server logs. To object to it being kept, to have it deleted, or to ask what we hold, contact us at hello@codestarter.me and tell us the email address you signed in with. Everything else stays in your browser or in your cloud storage account, so those rights are exercised with your cloud provider directly.

8. Revoking Access

You can revoke DriveCommander's access to your cloud storage at any time:

• Google: myaccount.google.com/permissions
• Microsoft: account.microsoft.com/privacy/app-access

9. Data Security

We use HTTPS encryption for all connections. OAuth tokens remain in your browser and are not transmitted to our servers. We follow industry-standard security practices for our hosting infrastructure.

10. International Transfers

Your file operations connect directly to Google (US) or Microsoft (US/EU) servers. Our web hosting may be located in the EU or US. Standard server logs may be processed in locations where our hosting provider operates.

The usage records described in Section 2.4 are stored in the European Union and are not transferred outside the EEA.

Where other processing involves transfers outside the EEA, we rely on appropriate safeguards made available by our providers (e.g., Standard Contractual Clauses), where applicable.

11. Children's Privacy

The Service is not intended for children under 16. We do not knowingly collect data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date reflects the latest revision.

13. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. In Hungary: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) - naih.hu

14. Contact

Software Expert Kft.
Budapest, Hungary
EU VAT: HU14677036
Email: hello@codestarter.me