Privacy Policy | TerraBytes

Effective date: 25 September 2026

Data controller

Personal data we collect

When you complete signup we may collect: name, email address, phone number and password (stored securely). We also collect minimal technical data (IP address, user agent) for security and fraud prevention.

Purpose and legal basis

We process your data to create and manage your account, provide the service, communicate with you and comply with legal obligations. The legal bases include performance of a contract, legitimate interests (security, fraud prevention, service improvement) and your consent where requested.

Data the TerraBytes app accesses in your connected accounts

The TerraBytes desktop app can connect to Google Drive, Gmail, Microsoft 365 (SharePoint, OneDrive and Exchange Online), NetApp and local or network drives. Connecting an account is your choice and always happens on the provider's own sign-in page; TerraBytes never sees your password.

What the app reads. To find what can be cleaned up, the app reads the metadata of your files and messages: names, folders, sizes, file types, creation, modification and access dates, version history, storage quota, and the names of file owners and last editors. For mailboxes this is the subject, sender, recipients, dates, sizes, folder and attachment names of each message.

What the app reads only when you ask. The content of a file, email or attachment is fetched only when you open it in the app's preview. It is shown on your screen, is not stored and is not sent to TerraBytes.

What the app changes. Only what you explicitly select: moving items to the trash or Deleted Items, permanently deleting them, or restoring them.

Where this data stays. Everything the app reads from a connected account is stored in a database on your own device. It is never uploaded to TerraBytes servers, and TerraBytes staff cannot see it. Classification (duplicates, old versions, records that may fall under retention laws) runs on your device, using names and metadata only. Your data is never used to train models.

Sign-in tokens. The token that keeps an account connected is stored encrypted on your device, with the key in the operating system's keychain (macOS Keychain or Windows Data Protection). Removing a storage in the app deletes its token and its local database. You can also revoke TerraBytes at any time in your Google account permissions or Microsoft account apps.

What reaches TerraBytes servers. Only your account details (name, email address, phone number), subscription status, app version and sign-in sessions. Never the contents or metadata of your files or messages.

Google API Services User Data Policy (Limited Use)

TerraBytes' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The app requests the Google Drive scope (to read file metadata and version history, and to move, delete or restore files you select) and the Gmail scope (to read message metadata, show a message you open, and move or delete messages you select), together with your basic profile (name and email address) to label the connected account. Data obtained through these scopes is:

used only to provide and improve the storage-cleanup features you see in the app;
never transferred to anyone else, except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with prior notice to you;
never used or transferred to serve advertisements;
never read by a human, unless you ask us for support and give consent, it is needed for security purposes, or it is required by law;
never used to develop, improve or train generalised artificial intelligence or machine-learning models.

Microsoft 365 data

For SharePoint, OneDrive and Exchange Online the app asks for delegated Microsoft Graph permissions to read and write files and sites (Files.ReadWrite.All, Sites.ReadWrite.All), to read and write mail (Mail.ReadWrite) and to read your basic profile (User.Read). These permissions are used only as described above: metadata is read to find what can be cleaned up, content is fetched only when you open a preview, and items are changed only when you select them. Your organisation's administrator may need to consent to these permissions and can revoke them at any time.

Data sharing and processors

We may share account data with trusted third-party processors (e.g. hosting, authentication providers) who act under contract and only process data on our behalf. We do not sell personal data, and data from your connected accounts is not shared with anyone.

International transfers

If data is transferred outside the EEA, we ensure adequate safeguards (standard contractual clauses or transfers to providers with appropriate protection).

Retention

We retain account information as long as your account exists and for a limited period afterwards to meet legal or operational needs. Specific retention periods depend on the data and purpose.

Your rights

You have rights under the GDPR, including the right to access, rectify, erase, restrict processing, object to processing, and data portability. To exercise your rights or lodge a complaint, contact us at info@terrabytes.app. You may also contact your local data protection authority.

Security

We implement reasonable technical and organizational measures to protect personal data. No system is completely secure; if a security incident occurs we will follow applicable notification obligations.

Cookies

We use cookies and similar technologies for essential functionality and analytics. You can manage cookie preferences via your browser; see our cookie notice (if available) for details.

Changes to this policy

We may update this policy. Material changes will be communicated as appropriate.

For questions, contact info@terrabytes.app.