1. What information we process and what Google user data we access

1-1. Without signing in

• Folders you pick and the files in them — read and written directly on your device through the browser’s (web) or iOS’s file-access features. The contents and names of your files and your folder lists are not sent to our servers.
• Information stored only on your device (browser or app storage): access information for the folders you connected, copy/move task records, trash records, preview thumbnails, PDF/EPUB bookmarks, display settings (such as language), this device’s ID and name, and a tally of 5G (relay) transfer usage. None of it is sent to our servers.

1-2. When you sign in (optional — remote features and Google Drive)

The Service requests the following OAuth scopes. This list is exhaustive.

• openid, https://www.googleapis.com/auth/userinfo.email
  → Your Google Account identifier and email address, used to sign you in and identify your account.
• https://www.googleapis.com/auth/userinfo.profile
  → Basic profile information such as your name and profile picture. Your name is shown as your account in the app.
• https://www.googleapis.com/auth/drive.file
  → Access only to files and folders you choose yourself in the Google Drive picker (Google Picker) and files the Service creates. The Service cannot see or access any other files or folders in your Drive.

Apart from the copies, moves and new folders you ask for, the Service creates exactly one file in your Drive on its own: “qorofile-작업공간.json” (a workspace file). It lets your connected Drive folders and device names follow you to a new device, and contains the list of connected Drive folders (folder ID, name, whether it is writable, when it was added), the list of your devices (device ID, the name you gave it, when it was first seen), and the time it was last updated.

Sign-in uses the same Google sign-in (the same account system) as the sibling service qoro todo, so the Google consent screen may show “qoro todo”. Permissions you have already granted to qoro todo (such as Calendar and Tasks) may be bundled into the same Google token, but qoro file calls no Google API other than Google Drive (drive.file) and does not access your calendar, tasks, or any other Google data.

1-3. When you use remote features (my devices, sharing)

• Connection signals: device ID, device name, device type (phone/computer), and the negotiation information needed for two devices to connect (network addresses, including IP addresses, and encryption key-exchange data). They are relayed to the other device in real time and are not stored.
• Share links, QR codes and 4-digit codes: unguessable random secrets.

1-4. Information generated automatically

Connecting to the Service creates standard request logs (IP address, User-Agent, request path), which are handled by the servers that host the app, deliver fonts, relay connections and check network addresses (Section 3).

The Service does not collect payment information, government identifiers, sensitive information (such as health or beliefs), contact lists, location, or advertising identifiers. Photos and files are handled on your device, and only the ones you pick.

2. How we use it

The Service uses the information above only to provide the features you ask for.

• Folders on this device: listing, previews, copy/move/rename/delete (to the trash) — all performed on your device.
• Previews: previews of photos (including HEIC), videos, PDF, EPUB, documents and archives are processed on your device; file contents are not sent to our servers.
• Email and account identifier: to sign you in, to let your own devices on the same account find each other (the channel for your devices is named after a hash of your account identifier), and to reply to your inquiries.
• Name: shown only as your account in the app.
• Google Drive (drive.file): for the file operations you request on the Drive folders and files you picked — listing, previews, copy, move, rename, delete (to the Drive trash) — and to sync the workspace file. Your browser (or the app) calls the Google Drive API directly; Drive file contents never pass through our servers.
• Transfers between devices: files and folder lists are sent directly from device to device (WebRTC), encrypted. Only when a direct connection is impossible (for example 5G ↔ Wi-Fi) do they pass through a relay server — still encrypted.
• 5G (relay) usage: tallied on your device and summed across your own devices over the direct device-to-device connection, to show and apply the monthly usage limit.

The Service never uses personal information or Google user data for advertising, marketing, profiling, credit assessment, or sale.

3. Who it is shared with, transferred to, or disclosed to

The Service does not sell personal information or Google user data, provide it for advertising or marketing, or transfer it to data brokers.The companies below are processors that perform functions essential to running the Service.

• Google LLC — authentication (OAuth), file operations in your Google Drive, the Drive picker (Google Picker), network address checks (STUN).
  Data transferred: the Drive file operations you request and the workspace file — this goes back into your own Google account. The address-check servers process IP addresses.
• Supabase Inc. — sign-in account and session management, storage of the encrypted Google refresh token (the same store as qoro todo), and real-time relay of connection signals between devices.
  Data transferred: email address, Google Account identifier, the basic profile Google provides at sign-in (name, profile picture URL), the encrypted refresh token, and connection signals (relayed in real time, not stored). File contents, file names and folder lists are not sent.
• Cloudflare, Inc. — relaying data between devices when a direct connection is impossible (TURN), network address checks (STUN).
  Data transferred: encrypted transfer data (Cloudflare cannot see the contents), IP addresses, transfer volume.
• Vercel Inc. — hosting and delivery of the web app, and running the sign-in server.
  Data transferred: standard request logs. Vercel does not store your files.
• jsDelivr (public CDN) — delivery of the display font files.
  Data transferred: only the standard request information carried by a font request (IP address, User-Agent).

What other users can see: when you share a folder by share link, QR code or 4-digit code, the person who connects can see the file list and the files in that folder. By default they can view, take copies and add new files; deleting is possible only when you allow it (in advance when sharing, or by approving a request). They see this device’s name. Once linked, the two devices reconnect whenever both are on (the link key is stored only on the two devices), and you can take back delete permission or unlink at any time under the account button → “Linked devices”. Your own devices signed in to the same account can see each other’s device names and folders, the links each device has made (never the link keys) and its 5G (relay) usage — this travels only over the direct device-to-device connection.

International transfers: the servers of the companies above may be located outside the Republic of Korea (for example in the United States), and the items above are transferred over the network when you use the Service and processed in those regions. You may refuse the transfer by contacting us, but features that require sign-in will then be unavailable (managing folders on this device works without signing in).

Any other disclosure happens only in response to a lawful request under applicable law, limited to the minimum required.

4. How it is protected

• Encryption in transit: all communication with servers is encrypted with HTTPS (TLS). Connections between devices are encrypted with WebRTC’s DTLS and stay encrypted even through a relay server.
• Encryption at rest: the refresh token issued by Google is encrypted with AES-256-GCM before it is stored. The encryption key exists only in server environment variables.
• Never exposed to the client: the encrypted token and the key are never sent to the browser. The Service receives only short-lived access tokens for Drive operations and never stores access tokens on the server.
• Access control: the table holding tokens is protected by Row Level Security and is reachable only with server credentials.
• Protected sign-in result: the sign-in result is delivered encrypted and sealed, as a short-lived value that only the tab (or app) that started the sign-in can open.
• Limited sharing: share links use an unguessable 128-bit random secret. An invitation (link, QR code or 4-digit code) is valid for only 3 minutes; a 4-digit code is single-use and closes after too many attempts. Deletion by the other person is blocked by default and possible only when you allow it.
• Nothing stored on servers: file contents, file names and folder lists are not stored on our servers.
• No human access: no person, including the operator, reads your Google user data (except where Google’s policy permits, such as security incidents, legal obligations, or your explicit consent).
• No ads or analytics: no advertising, analytics or tracking tools or cookies are used.

5. How long it is retained and how it is deleted

• Information on your device: stays on your device until you delete it. Disconnecting a folder removes its access information; items in the trash are emptied automatically after 7 days (you can also delete them permanently right away). Bookmarks and task records can be cleared in the app, and everything is removed by clearing the site data in your browser or deleting the iOS app.
• Connection signals and invitation codes: not stored on servers; they disappear once delivered. Invitations expire after 3 minutes.
• Account and encrypted token: kept while you keep your account. “Delete account” in the account panel (or the same item in the qoro todo menu) immediately deletes the account and the information the Service keeps (including the encrypted token) and asks Google to revoke access — because qoro todo uses the same account, your qoro todo data (groups, share links, polls, the budget in its Drive app folder, etc.) is deleted too, and groups you created disappear for other members. On this device it also removes what is tied to the account (your device list, connections to those devices and to Drive folders, the sign-in cookie), and removes every link to devices connected by share link, QR code or 4-digit code, along with the permissions you gave each other (a linked device that is off is told the next time it is on). Your other devices that were signed in to the same account do the same cleanup once they confirm the account is gone. Local folder connections, bookmarks and the trash on this device, and the files on your devices and in your Drive, are not deleted. You can also ask us at the contact below.
• Drive workspace file: it lives in your own Google Drive and you can delete it yourself at any time. “Delete account” in qoro file deletes it too. If you delete your account from the qoro todo menu it stays, so please delete it from your Drive yourself.
• Signing out: ends only the qoro file sign-in on this device (sign-ins in other apps and on other devices are not affected).
• Deletion requests: email ilovz73ai@gmail.com with your account email address, and we will destroy the information the Service keeps and reply within 7 business days of receipt.
• Revoking access yourself: you can revoke access at any time in Google Account → Security → Third-party apps & services (it appears as “qoro todo”). Under Google’s policy, a refresh token that goes unused for 6 months expires.
• Method of destruction: electronic files are deleted so that they cannot be recovered. The Service handles no payments or transactions, so no records must be retained by law.

6. Limited Use disclosure and AI/ML non-use affirmation

qoro file’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We use Google user data only to provide or improve the user-facing features described in this policy.
• We do not use or transfer Google user data to serve advertisements.
• We do not sell Google user data or transfer it to data brokers or information resellers.
• We do not use data obtained from Google Workspace APIs to develop, improve, or train generalized or non-personalized AI or ML models, and we do not transfer it to third parties for that purpose.
• No person reads Google user data, except where permitted for security, legal compliance, or with your explicit consent, as allowed by Google’s policy.

7. Your rights

You have the right to request access to, correction of, deletion of, and suspension of processing of your personal information, by contacting us below. In the app you can manage it yourself with Sign out, Disconnect (a folder), Remove from list (a device), Rename device, Delete permanently (the trash) and Remove bookmark, and Delete account in the account panel deletes the account and the information the Service keeps immediately (Section 5). We do not collect personal information from children under 14.

8. Cookies and on-device storage

• Sign-in cookie (qorofile-auth): set only when you sign in, for this site only, to keep you signed in.
• On-device storage: the information listed in 1-1 and your display language choice.
• App cache: app screen files and fonts are stored on your device for fast and offline launch. Your files are not included.
• No advertising, analytics or tracking cookies are used.

9. Operator, contact and changes

• Operator: QNI (큐엔아이) · Representative: Hyoseon Lee · Business registration no. 548-23-02232
• Privacy contact: ilovz73ai@gmail.com
• Service: https://file.qorotodo.ooo
• If this policy changes, we will post the changes and their effective date on this page before they take effect.