Privacy Policy

homelab-backup · effective 13 November 2026

This policy explains how homelab-backup ("the app") handles data, including data obtained from Google APIs. The app is a personal backup tool used only by its owner to back up their own home server to their own Google Drive. It is not a public service and has no other users.

1. Data the app accesses

Google user data

• Google Drive files created by the app. The app requests only the scope https://www.googleapis.com/auth/drive.file. With this scope Google allows the app to access only the files and folders that the app itself has created (the folder homelab-backup and the backup files inside it). The app cannot see, read, modify or delete any other file in the user's Google Drive.
• Drive storage quota (total, used and free space), to show how much room is left for backups.
• OAuth tokens issued by Google (access token and refresh token) so the app can upload backups without asking the owner to sign in every night.

The app does not access the user's name, email address, contacts, Gmail, calendar, photos library or any other Google service, and does not request any other permission.

Other data

The content being backed up comes from the owner's own home server (configuration files, database dumps, source code, photos, virtual machine images). It is the owner's own data.

2. How the data is used

• To create, list, read and delete the app's own backup files in the owner's Drive: upload new backups, check which backups exist, download a backup when the owner restores data, and delete backups older than the retention period (7 daily, 4 weekly, 12 monthly copies; 4 weekly virtual machine copies).
• To display the Drive storage quota and backup status on the owner's private administration page.

Google user data is used only to provide this backup function to the owner. It is not used for advertising, analytics, profiling, training machine-learning models, or any other purpose.

3. Storage and protection

• Encryption before upload. Backup content is encrypted on the owner's server before it is sent to Google Drive (restic, AES-256; rclone crypt for virtual machine images, including encrypted file names). Google only ever stores encrypted data, and the encryption passwords never leave the owner's server and the owner's offline records.
• Tokens. OAuth tokens are stored only on the owner's home server in a configuration file readable only by the system administrator account (file permission 0600). They are never sent anywhere except to Google's own servers.
• The administration page is reachable only from the owner's private network (Tailscale) and is protected by a password and two-factor authentication.
• All communication with Google uses HTTPS.

4. Sharing and disclosure

The app does not share, sell, rent, or transfer Google user data or backup data to any third party. No other person or company receives the data. The only parties involved are the owner and Google (which stores the encrypted files in the owner's own Drive).

5. Limited Use

homelab-backup's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Retention and deletion

• Backups are kept according to the retention period in section 2 and older copies are deleted automatically.
• The owner can delete all data at any time by deleting the homelab-backup folder in Google Drive.
• The owner can revoke the app's access at any time at myaccount.google.com/permissions; the app then deletes its stored tokens when disconnected from its administration page.

7. Changes

If this policy changes, the updated version will be published on this page with a new effective date.

8. Contact

Questions about this policy: dkpro90@gmail.com