Privacy Policy

1. Who operates this application

Files (“Files”, “we”, “us”) is a privately operated, self-hosted file-management application based on the open-source File Browser project. It is available only to the owner and approved users. Questions or privacy requests can be sent to privacy@adrianvella.com.

2. Information we process

Depending on the features you choose, Files processes:

• Files account information: your Files user identifier, profile, preferences, scope, permissions, and rules used to provide and separate each user’s access.
• Connected-account information: the provider, provider account identifier, display name or email address returned by the provider, granted permissions, token expiry, and encrypted OAuth access and refresh tokens.
• Selected media information: identifiers and metadata for photos and videos you select, such as filename, media type, size, dimensions, capture time, location when available, and provider revision details when supplied.
• Imported content: copies of photos and videos selected for download into your Files storage.
• Library and duplicate data: media-catalog records, extracted metadata including embedded tags, thumbnails, exact checksums, and perceptual fingerprints used for Gallery, Albums, tag collections, Memories, previews, and duplicate review.
• Operational information: picker-session state, import destination, job status, item outcomes, errors, retry state, timestamps, and security logs needed to operate and protect the application.

For imports from this device, your browser or operating system presents the media picker. It may include cloud-backed content such as iCloud Photos, but Files receives only the files you choose and never asks for or stores your Apple password. Files has no direct iCloud Photos connection.

3. Google Photos data

Files requests the Google Photos Picker read-only permission https://www.googleapis.com/auth/photospicker.mediaitems.readonly. It uses Google’s official Photos Picker and can access only the photo and video items you explicitly select for that picker session. It does not browse your entire Google Photos library, edit media, or delete source items from Google Photos.

Google Photos Picker does not provide Google Takeout JSON sidecars or GPS fields. Files may extract location from metadata embedded in downloaded media when it is present.

Google user data is used only to:

• show the connected Google account’s status to that Files user;
• retrieve the media items selected in Google Photos Picker;
• when requested, match selected Google filenames and creation dates to explicitly selected local media and repair local captured-date metadata and filesystem modification times without downloading Google media;
• use provider-supplied item details, including capture timestamps, to organize the requested import;
• download those selected items to the destination the user chose; and
• resume, retry, avoid duplicate downloads, or report the status of that requested import.

Metadata sync stores the selected local paths and file revisions, Google filenames, item identifiers, creation dates, MIME types and available dimensions, plus original and verified dates and per-file results. Background jobs continue after the panel closes. Results remain available to their owner until cleared; clearing results does not undo file changes. Server audit logs record paths, dates and outcomes, without provider credentials or download URLs.

4. OneDrive data

Files uses delegated Microsoft Files.Read permission to identify the connected personal OneDrive, browse its media and folders, display previews, discover OneDrive photo albums, and download media selected by the user. A user may select individual items, an album, or a folder for recursive import. Files does not request the Microsoft password and does not modify or delete source items in OneDrive.

OneDrive photo-album discovery uses a Microsoft Graph preview API. Other OneDrive browsing and downloads use the delegated read access granted during authorization.

5. Files stored in the application

Files reads and manages content within storage made available to the application. Features such as previews, Gallery, Albums, Memories, search, sharing, and editing process that content only to provide the requested private file-management experience and apply the user’s scope, permissions, and access rules.

Optional scheduled EXIF repair inspects local JPEG and PNG metadata and creates temporary verification copies. Repair mode retains the original file in private backup storage before replacing it with a verified repair. Backup manifests record ownership, paths, file attributes, timestamps and checksums; revision records avoid repeated processing of unchanged photos. Original backups are retained until an administrator removes them, independently of task-log retention, photo deletion or account removal. This task does not contact cloud photo providers.

Duplicate scans compare supported media across configured library locations using exact and perceptual fingerprints. Administrators see only files allowed by their scope and rules. The application does not automatically select duplicates for removal.

An authorized task manager may configure maintenance that reads AppleDouble-style sidecar files already stored beside media to recover a missing capture date. In apply mode, Files writes that date to supported media metadata and filesystem timestamps. It removes a matching sidecar only after both writes are verified; conflicts, unsupported formats, malformed data, and failed verification leave the sidecar in place.

6. How information is used

We use this information to:

• authenticate connected accounts and maintain your authorized connection;
• perform, resume, cancel, retry, and troubleshoot imports you request;
• avoid unnecessary downloads of an existing provider item or destination filename;
• store imported media in the destination you select and organize it using available embedded or provider metadata;
• index, display, preview, search, share, and manage content within the private Files application;
• identify exact copies and likely visual matches for explicit administrator review;
• secure the service, prevent abuse, and maintain reliability;
and
• respond to support, access, and deletion requests.

We do not use connected-account data or stored content for advertising, credit decisions, surveillance, or training general-purpose artificial intelligence models. We do not sell personal information.

7. Sharing and disclosure

We do not sell, rent, or share Google user data, Microsoft user data, or stored content with advertisers or data brokers. Information may be processed by infrastructure providers strictly to host, secure, or transmit this service; disclosed when required by applicable law; or handled with your explicit direction.

Imported media remains in the private Files storage selected by the user unless an authorized user deliberately creates a share or otherwise moves, downloads, or deletes it using Files.

8. Storage, security, and retention

OAuth access and refresh tokens are encrypted at rest and are not exposed to the browser after the server completes authorization. Connections and import jobs are separated by Files user. HTTPS, access controls, short-lived single-use OAuth state, PKCE, and server-side token exchange are used to protect authorization.

Connection records and OAuth tokens are retained while the connection is active and are removed when it is disconnected or the Files user is deleted. Temporary provider picker and download state is removed after completion or expiry. Import history and limited operational records may be retained as needed for retry, idempotency, security, and maintenance.

Imported photos and videos are ordinary files in the destination selected by the user. Disconnecting a provider or deleting a Files account does not automatically delete already imported files. An authorized user or administrator can manage those files separately.

Media indexes, thumbnails, checksums, and perceptual fingerprints may be retained and reused while their source files remain in the managed library. Selected duplicate files moved to quarantine are retained until an administrator restores or permanently purges them. A direct permanent-delete action is not recoverable through quarantine.

9. Your choices and deletion requests

You may:

• decline to connect a provider and use other Files features;
• choose which photos or videos to import and where to store them;
• cancel supported imports and remove completed import-job views;
• disconnect Google Photos or OneDrive in Files settings;
• revoke Files from your Google or Microsoft account settings; and
• request access to or deletion of account and connection information by emailing privacy@adrianvella.com.

We may need to verify that a requester controls the relevant Files account before fulfilling a request. Removing an import-job record does not remove files already imported into storage.

10. Children

Files is not directed to children under 13, and we do not knowingly invite children under 13 to use the application.

11. Policy changes

This policy may be updated when the application or legal requirements change. The effective date at the top will be revised, and material changes will be communicated to approved users when appropriate.