Privacy Policy

Last updated: 2026

Summary: Tiddly Drive 2 runs entirely in your browser with a stateless backend for token refresh only. It never uploads, proxies, or stores your TiddlyWiki content on any server operated by this project. The backend exists solely to securely refresh your authentication tokens, allowing year-long sessions without popup interruptions. The only remote services contacted are Google APIs needed to open and save the file you explicitly select, plus optional third‑party resources (fonts / icons) shown in the page head.

Stateless Backend for Authentication

Tiddly Drive 2 includes a minimal backend service that serves one purpose only: securely refreshing your Google authentication tokens. This enables you to keep your TiddlyWiki open for a maximum of 1 year without authentication popup interruptions. The backend is completely stateless and processes no user data:

  • No user content is transmitted to or stored on our servers
  • No session data, preferences, or personal information is retained
  • Only standard OAuth token refresh operations are performed
  • All requests are processed in real-time with no persistent storage

Data We Access

  • Selected File Content: The HTML of the TiddlyWiki file you open using Google Drive’s “Open with” flow.
  • Minimal Metadata: File name, mime type, modified time, and file version (for conflict detection).

Data We Do Not Collect

  • No analytics, tracking pixels, ads, or profiling.
  • No account emails, contacts, or any other Drive files beyond the one you choose.

OAuth Scope Justification

The app requests the following Google API scopes:

  • https://www.googleapis.com/auth/drive.file - Core functionality to read and update the specific file you pick. This does not grant broad read access to your entire Drive.
  • https://www.googleapis.com/auth/drive.install - Required for the "Open With" option to appear in Google Drive's context menu when you right-click files.
  • https://www.googleapis.com/auth/userinfo.email and https://www.googleapis.com/auth/userinfo.profile - Required for Google Workspace Marketplace publishing. This data is not used, stored, or accessed by the application.

Data Storage & Retention

No persistent storage outside your browser’s runtime is used. When you close the tab, the in‑memory content and token are discarded. Any local preferences (e.g. autosave enabled) are stored in the browser's localStorage.

Third‑Party Services

  • Google Identity Services / Drive API: Authentication & file operations.
  • Google Fonts / Material Icons: UI fonts & icons.

Security

All requests occur over HTTPS. Save operations perform a version check against Google Drive’s reported file version to help prevent accidental overwrites. No secret keys are embedded client‑side beyond the public OAuth Client ID.

Data Deletion

Because no server copy is retained, deletion is controlled entirely by you via Google Drive. Removing the file from Drive removes the only stored copy. Clear local preferences by deleting this site’s cookies in your browser.

Reporting Issues

Open a GitHub issue at tiddlydrive/issues for privacy or security concerns.

← Back to info home