Privacy Policy

1. Who operates Uploadock

Uploadock is operated by Ognjen Šuvakov, an independent developer based in Serbia. For privacy requests, support, or abuse reports, contact support@uploadock.com.

The individual operating Uploadock is responsible for the account and service-operation data described in this policy. This policy covers folder owners and guests using Uploadock. The receiving folder owner separately decides why they collect your files, who may access them, and how long to keep them. Ask that owner about their handling of your uploaded content.

2. Information we handle

• Owner accounts: a Google account identifier, internal account identifier, timestamps, and login sessions. Google sign-in requests basic identity information; our account database does not retain your Google profile photo, name, or email.
• Drive connection: encrypted Google refresh credentials, granted permissions, and connection timestamps. Short-lived access credentials are used to contact Google and operate the owner’s folder picker.
• Upload requests: the destination folder identifier, title, instructions, availability, expiry, protected link credentials, and a password hash if a password is set. Request titles are visible to people with the link. For password-protected requests, instructions are shown after unlocking.
• Transfer setup: filenames, declared file sizes, file types, and Google upload session addresses are processed temporarily to initiate transfers. Folder names and available location information may be retrieved to help owners choose a destination. We do not keep a permanent file inventory or upload-completion history in our database.
• Folder routing: for folder uploads, we temporarily store relative folder paths, batch and request identifiers, destination folder identifiers, and expiry information so later files in large uploads reach the correct subfolders. Stored folder paths can contain personal, organizational, or sensitive names and are treated as user-related data, not anonymous data. Routing records carry expiry information and are removed by scheduled cleanup; they are not a permanent upload history.
• Service protection: network requests include an IP address and ordinary connection information. Abuse controls use temporary pseudonymous counters derived from IP addresses and request/account identifiers. These are not anonymous data.
• Support: if you contact us, we receive the information you choose to provide. Do not send passwords, Google credentials, or sensitive files in a support report.

3. Files and recipients

Uploadock’s application server does not receive or store uploaded file contents. Google receives the contents, filenames, and transfer information, and stores files in the connected owner’s Drive. Access after upload depends on that owner’s Google Drive sharing settings. Guests cannot browse the destination or other guests’ files through Uploadock.

Only upload files you intend to give to the recipient. Uploadock does not provide end-to-end encryption, inspect file contents, or scan uploads for malware.

4. Why we use this information

We use information to sign owners in, connect their Drive, manage upload requests, initiate guest transfers, prevent abuse, troubleshoot the service, and respond to support or legal requests. Where applicable data-protection law requires a legal basis, these activities rely on providing the requested service, legitimate interests in security and reliability, legal obligations, or consent where required. Google authorization can be withdrawn at any time.

5. Google permissions and data use

We request limited per-file Google Drive access using drive.file, rather than access to your entire Drive. Google does not offer an upload-only permission for this workflow. This permission can allow reading, downloading, editing and deleting files created through Uploadock or otherwise authorized for the app. It does not grant access to your entire Drive, and selecting a folder does not automatically authorize all its existing files. Uploadock provides guests with upload sessions, not the owner’s Google access or refresh tokens.

We use Google data only to operate and support the user-facing features described here. We do not provide people with routine access to your Google data; access for support, security or legal purposes is limited to circumstances permitted by Google’s User Data Policy. We do not sell Google user data, use it for advertising, or use it to train generalized AI models. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements where applicable.

Google handles data under its own Privacy Policy. Uploadock runs on a dedicated virtual server provided by Contabo in its “Hub Europe” hosting region. The application database on that server stores the account, connection and request information described above. Google provides sign-in, folder selection and Drive storage. Messages sent to our support address are forwarded by Porkbun to a Gmail mailbox managed by the operator. Porkbun and Google therefore process support-message contents, sender details and email routing information. The operator accesses service and support information from Serbia. The hosting region does not mean all processing by Google, Porkbun or Sentry is confined to that region. We may disclose necessary information to comply with law or address security and abuse.

6. Cookies and browser storage

We use an essential session cookie for owner login and temporary state for authorization flows. The guest browser may keep filenames, sizes, progress, and sensitive upload-session addresses in tab-scoped session storage to support recovery of up to 10 interrupted uploads after a reload. Unstarted queue items are not saved. Recovery records have a 24-hour application validity window and are removed when processed as completed, cancelled, or expired; browser cleanup timing may vary. Closing the tab or clearing site data can remove recovery information.

We use Google Analytics 4 to measure visits to public pages and clicks on the create-link action after you accept analytics. Google may receive cookie identifiers, page and event information, browser/device information, and network connection information. GA4 is configured to retain event-level data for 2 months and user-level data for 14 months. Reset on new activity is enabled, so new activity can restart the user-data retention period. These settings do not apply to standard aggregated reports. Your consent choice is stored in your browser for up to 180 days. You can change or withdraw it using Cookie Preferences in the footer of public pages where analytics is enabled. Withdrawal stops future analytics collection by the app, but does not erase information already sent. Declining optional analytics does not prevent use of Uploadock. Google sign-in and Picker separately use Google services that may have their own storage behavior.

Error diagnostics and analytics controls

We use Sentry to receive technical error reports to help us diagnose software failures. Reports can include error descriptions, application stack traces, release and environment information, and browser/runtime details. A browser connecting directly to a provider also exposes network connection information to that provider. Error diagnostics are separate from optional marketing analytics. Our Sentry organization uses the European Union data storage region. This does not mean that every aspect of provider processing takes place exclusively in the EU.

Our intended collection excludes file contents, filenames, folder paths, upload-link credentials, and Google authorization tokens. We do not use session replay. See Google privacy information and Sentry privacy information for their processing practices.

Clearing site data removes the locally stored consent choice but does not erase reports already sent to providers. You can contact us to request deletion of personal information in diagnostic reports, subject to applicable legal requirements.

7. Retention and deletion

Owner and request records remain until deleted. Disconnecting Drive removes the stored connection credential and closes requests. Deleting an account removes its live account, connection, session, and request records. Owner login sessions expire after seven days. Temporary abuse counters and folder-routing records expire and are removed by periodic cleanup. Folder-routing records have expiry timestamps used to limit their retention. An automated hourly cleanup worker deletes expired records from active storage; during temporary worker outages or cleanup lag, records may persist until the next successful run. When an upload request or account is deleted, associated routing records are deleted immediately. Deleting an upload request also removes its routing records. Expiry is not instantaneous physical erasure. We have not configured application database backups or Contabo backup services for this deployment.

GA4 retention is described in section 6. Sentry diagnostic events are subject to the retention rules of our active Sentry subscription. Subscription changes can affect this period. Contact us for information about retention or to request deletion of personal information in a report.

We delete resolved support conversations from our support mailbox within 90 days after resolution, unless continued retention is needed for an ongoing dispute or a legal obligation. Email providers may retain their own copies under their applicable policies.

Account deletion does not delete files already in Google Drive. Contact the recipient to request file deletion. An already-issued upload session may remain usable after a link is closed or a connection is removed. If we introduce database backups, we will update this policy to explain their retention and how deletion requests affect backup copies.

8. Your choices and rights

You can close or delete requests, disconnect Drive, or delete your account from the dashboard. You can also remove Uploadock’s Google access through your Google account settings. If Google revocation cannot be confirmed, the app will tell you.

Depending on your location, you may have rights to access, correct, delete, restrict, object to processing, or receive a copy of your personal data, withdraw consent, and complain to a data-protection authority. Contact support@uploadock.com to make a request; we may need to verify your identity. For uploaded files, contact the receiving owner as well.

9. Updates

We will update this page when our practices change and provide notice of material changes where required. We will obtain additional consent before a new use of Google data when required by Google’s policies or applicable law.