Privacy Notice — Merge Drive

Introduction

This Privacy Notice describes how Merge Drive (“Merge Drive,” “we,” “us,” or “our”), operated by TeamSlice, collects, uses, and discloses personal information. It applies to our website at mergedrive.com, the web app at app.mergedrive.com, and the Merge Drive Android app (together, the “Services”).

“Personal information” means information that identifies or can reasonably be linked to an individual, as protected under applicable privacy laws.

Who this notice covers

This notice covers anyone who visits our website, creates a Merge Drive account, or connects a cloud storage account to Merge Drive. Merge Drive is a file manager: it shows and acts on files that stay stored with your own cloud provider (Google Drive, Microsoft OneDrive or Dropbox).

Information we collect

Information you provide

Account information. Your name, email address and password (stored hashed) when you create a Merge Drive account.
App data you create. Items you star, items you move to Trash through Merge Drive (name, type, size and location so they can be restored), and files or folders you share with team members.
Support and feedback. Information you share when you contact us for help or send us feedback.

Connected cloud accounts

Account identity. The email address of each Google Drive, OneDrive or Dropbox account you connect.
OAuth tokens. The access and refresh tokens issued by that provider, so Merge Drive can perform the actions you request.

We do not copy or store the contents of your cloud files on our servers. File contents are streamed from your cloud provider to your device only when you open, preview or download them.

Information collected automatically

Log and device data. IP address, browser or device type, operating system, timestamps and similar technical data, used for security and troubleshooting.
Cookies and local storage. Used only to keep you signed in and remember basic preferences. You can control cookies through your browser settings.

Google user data

When you choose to connect Google Drive, Merge Drive requests these permissions:

https://www.googleapis.com/auth/drive — to list the files and folders in your Google Drive, preview and download them, and perform the actions you request: upload files, create folders, rename, move, and move items to Trash or restore them. Merge Drive is a full file manager for your existing Drive files, which requires access to files not created by Merge Drive.
https://www.googleapis.com/auth/userinfo.email — to show which Google account is connected and to let you connect more than one account.

How we use, store and share Google user data:

Use. Only to provide the user-facing features described above, at your request. We do not read your files for any other purpose.
Storage. Only OAuth tokens and your Google account email are stored, encrypted, on our servers. Tokens are never sent to your browser or device.
Sharing. We do not sell, rent or share Google user data with third parties. Files are shared with other Merge Drive users only when you explicitly share them.
No advertising or AI training. Google user data is never used for advertising, and is never used to develop, improve or train generalized AI or machine-learning models.
Human access. Our staff do not read your Google data unless you ask us to for support, it is required for security purposes, or it is required by law.

Merge Drive’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft OneDrive and Dropbox

If you connect OneDrive, Merge Drive requests Files.ReadWrite, User.Read and offline_access. If you connect Dropbox, Merge Drive requests files.metadata.read, files.content.read, files.content.write and account_info.read.

These permissions are used in the same way and with the same limits as Google data above: only to show your files and perform the actions you choose.

How we use information

Provide, operate and maintain Merge Drive, including the merged file view, search, preview, upload, move, rename, star, share, Trash and restore.
Create and manage accounts, and authenticate users.
Send service messages, such as important account or security notices.
Respond to support requests.
Monitor reliability, diagnose issues, and prevent fraud and abuse.
Comply with legal obligations and protect the rights, safety and security of Merge Drive, our users and others.

How we share information

We do not sell personal information. We may share information only in these situations:

Your cloud providers. Requests are sent to Google, Microsoft or Dropbox to perform the actions you choose in the app.
Team members you share with. When you share a file or folder, the people you share it with can see it in Merge Drive.
Service providers. Vendors who help us host infrastructure or send email, under contracts that limit their use of the data.
Legal and safety. When required by law or legal process, or to protect rights, security or safety.
Business transfers. In connection with a merger, acquisition or sale of assets, subject to appropriate protections.

Security

All traffic between your device, our servers and cloud providers is encrypted with HTTPS/TLS.
OAuth tokens are encrypted at rest and are only used by our servers.
Sign-in to cloud providers uses OAuth 2.0 with PKCE; we never see your Google, Microsoft or Dropbox password.
Access to production systems is restricted to authorized staff.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Retention and deletion

Disconnect a cloud account. In Merge Drive, open Settings and choose Disconnect. We immediately delete the stored tokens for that account.
Revoke access at the provider. You can also remove Merge Drive from your Google Account permissions, your Microsoft account, or your Dropbox connected apps at any time.
Delete your account. Email hello@teamslice.ca from your account email and we will delete your Merge Drive account, connected-account tokens, stars, trash records and shares within 30 days.
Server logs are kept for up to 90 days.

Children

Merge Drive is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it.

Your rights and choices

Depending on where you live, you may have rights to access, correct, delete or export your personal information, or to object to or restrict certain processing. You can disconnect cloud accounts at any time in the app. To make a privacy request, email hello@teamslice.ca. We may need to verify your identity before responding.

International transfers

Merge Drive may be hosted and supported in countries other than where you live. When we transfer personal information internationally, we take steps designed to provide appropriate safeguards required by applicable law.

Changes to this notice

We may update this Privacy Notice from time to time. We will post the updated version with a revised effective date. If changes are material, we will notify you in the app or by email.

Contact us

Questions about this Privacy Notice or our privacy practices:

For product terms, see our Terms and Conditions.