Backup privacy policy
Effective October 28, 2026. This policy covers Google Drive connections used by XNote, Timecrate and Norvi Vault.
Data accessed and purpose
These tools use Google Drive APIs to list, upload, download and verify files needed for your configured backup, recovery or file-access workflow. Depending on the granted scope, access may include existing Drive files and their names, sizes, identifiers and timestamps. Full Drive permission is broader than one backup folder.
Where data goes
The tools run on your computer or infrastructure configured by its operator. They send authorized API requests and selected files directly to Google Drive. OAuth tokens and connection settings are stored on that computer or infrastructure; access to those credentials must be protected by its operator. Google processes requests under its own privacy policy.
Encryption
XNote cloud recovery kits encrypt backup contents before upload. Timecrate and Vault depend on their configured archive encryption and storage encryption. An rclone crypt destination encrypts contents and names locally. Encryption does not hide all metadata: the provider can observe transfer times and sizes, and some backup formats expose device names or recovery metadata. Recovery keys and crypt passwords must be kept safely; losing the required recovery material can make encrypted backups unrecoverable.
Use and sharing
Google user data is used only to provide the backup, recovery and file-access functions you configure. It is not sold, used for advertising, or used to train general-purpose AI models. These integrations do not send backup contents to a NorviTech-operated collection server. Your infrastructure operator and the cloud provider may have access appropriate to their roles and your encryption configuration.
Retention and deletion
Local files and cloud copies follow the retention settings of the tool and storage you configure. Disconnecting or uninstalling a tool does not necessarily delete existing backups. Delete unwanted copies through the tool or your storage provider, and remove local credentials when retiring a connection. Keep required recovery copies until you have verified their replacements.
Your controls
You choose whether to connect Google Drive, which data to back up and when to restore it. Revoke access through Google account connections. Revocation prevents further authorized requests using that grant; it does not erase copies already stored.
Google API policy
Use of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
Contact
For questions about these Google connections, use the support email shown on their Google consent screen. Do not put backup contents, passwords, tokens or recovery keys in public issue reports.