Privacy policy

Effective 26 September 2026.

ShiftMyData moves files between cloud storage services on your instruction. Doing that requires access to those services on your behalf, so this document sets out exactly what is held, where, for how long, and what is deliberately never held at all.

ShiftMyData is operated by Naresh Kumar D, a sole proprietorship in India, who is the data controller for the information described below.

What is collected

Your account

Your email address, a hash of your password, the display name you choose, and — if you enable two-factor authentication — an encrypted copy of your authenticator secret. Passwords are hashed with Argon2id at OWASP-aligned parameters and are never stored or logged in a recoverable form.

Connected cloud accounts

When you connect a cloud service, that provider issues access and refresh tokens which are stored encrypted (see Security). Alongside them is kept the provider name, an identifier for the connection, and any folder you nominated as its root.

Transfers

For each transfer: the source and destination paths, file and folder names, sizes, timestamps, checksums where the providers support them, progress, and the outcome. Schedules, notification settings and share links are stored as you configure them, and significant account actions are written to an audit log.

Technical

Server logs recording IP address, request path and timing, kept for operating the service and investigating abuse. Session cookies are HTTP-only, transmitted only over HTTPS, and expire after twelve hours.

What is never collected

• Your files, as stored copies. File contents are streamed directly between the two providers and are not written to our disks. The single exception is explained below.
• Card numbers, CVV or expiry dates. Payment details are entered on the payment provider's own page and never reach our servers. We can hold only the provider's opaque references and the amount.
• Your cloud passwords. Connections use OAuth, which does not disclose them.

The exception, stated plainly: a torrent or remote-URL download cannot be streamed, because the destination file does not exist until it has been fetched. Those downloads are written to a temporary working directory on the server, uploaded, and deleted when the job ends. Nothing is seeded back to any network. No other transfer type touches our disks.

Google user data, and our Limited Use commitment

When you connect Google Drive, ShiftMyData requests the https://www.googleapis.com/auth/drive scope. That scope is needed because the service's entire function is moving files that already exist in your Drive, and the narrower per-file scope cannot list files it did not itself create.

With that access, ShiftMyData:

• lists the folders and files you browse, to show them to you;
• reads the files you select, to copy them to the destination you chose;
• writes files to your Drive when it is the destination of a transfer;
• deletes files from it only when you have chosen a move or a mirroring sync that says so.

ShiftMyData's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: data obtained through Google APIs is used only to provide the transfer features you ask for; it is not transferred to anyone except as necessary to provide those features, for security purposes, or to comply with applicable law; it is never used for advertising; and it is never read by a human except with your explicit consent, where necessary for security, or where required by law.

You can revoke this access at any time by disconnecting the account in ShiftMyData, or at your Google account permissions page. Revoking stops all future access immediately.

How it is protected

• Provider credentials are encrypted by the application, not by the database. Each set of tokens is sealed with AES-256-GCM under its own data key, which is itself wrapped by a master key held only in the server's environment. Each seal is bound to the row that holds it, so ciphertext cannot be moved between accounts. A database dump, backup or replica therefore yields no usable tokens.
• Credentials are never written to disk in readable form. They are decrypted in memory for the duration of an operation and passed to the transfer engine directly; no configuration file on the server holds them.
• Logs are scrubbed. Tokens, secrets and authorisation headers are redacted automatically before anything is written.
• All traffic is over HTTPS, with HSTS enabled.

What this is not: end-to-end encryption. Running a transfer on a schedule while you are away requires the server to be able to use your tokens, so it necessarily holds keys that can decrypt them. Anyone needing storage the operator cannot read should use an encrypted destination, which encrypts contents in transit before they reach the provider. Filenames, paths and transfer history are stored unencrypted.

Who else sees it

• The cloud providers you connect — necessarily, to perform transfers.
• Our hosting provider, which operates the servers the service runs on.
• Our payment provider, which handles payments and receives only what a payment needs.
• Law enforcement or regulators, where we are legally required to respond.

Your data is not sold, rented, or shared with advertisers. There are no advertising or analytics trackers on this site.

Retention

Account details are kept while the account exists. You can delete the account yourself at any time, from Account settings in the application. When you do, its connected accounts and their stored credentials, transfer history, schedules, share links, notification channels, sub-accounts and delegated access, and its activity log go with it straight away, in one database transaction rather than by a cleanup job that might not run. Transfers still running are stopped first. Files in your cloud accounts are not touched. Disconnecting a single cloud account deletes its credentials immediately, and you can do that yourself at any time too. Payment records are kept because tax law requires them. They stay attached to an anonymous record with no name, no email address and nothing to sign in with; it holds only a one-way fingerprint of the address, which cannot be turned back into it, so that the free allowance and single-use coupons are not given to the same address twice. So is one line recording that an account was deleted, when, and the network address the request came from, as evidence that it was asked for. Server logs are kept longer where security requires it.

Your rights

You may request a copy of your data, ask for corrections, or ask for deletion, by writing to the address below. You can also delete your whole account yourself, from Account settings in the application, or on request to that address; disconnecting your clouds, which removes their stored credentials, you can do yourself at any time. Depending on where you live you may have further rights under local data protection law, and nothing here limits them.

Children

The service is not directed at anyone under 16, and accounts should not be created for them.

Changes

Material changes will be announced in the application before they take effect, and the effective date above will change. Continuing to use the service after that date means accepting the revised policy.

Contact

Questions about this document go to arpudhanaresh@gmail.com.