AffHelper Backup
Data / Rights / Security

AffHelper Backup Privacy Policy

Version date: 22 October 2026. Scope: AffHelper Backup only, its Google OAuth integration, and transfers of backup archives through rclone. This document is not the complete privacy policy of the main AffHelper application.

Current stage: the Google Drive connector is authorized and a harmless test file upload has succeeded. Scheduled uploads of production archives, automatic retention cleanup and the 5 GB budget are not active yet. This policy distinguishes current operations from intended safeguards.

1. Controller and contact details

AffHelper Backup (“we”, “operator”) is intended to upload previously prepared AffHelper backup archives to a Google Drive account selected by its owner, using rclone and the Google Drive API.

Operator: an individual using the project name “Aff Helper” (a project designation, not a claim that a company is incorporated). Privacy contact: pamos2012@gmail.com. Website: https://affhelper.win/. Additional identification required for a particular legal request may be requested at the contact email.

The main AffHelper service may have separate controllers, processors and agreements covering customer information. This policy does not supersede those arrangements.

2. Purpose and boundaries

Google OAuth access to the selected personal Google Drive is granted by the owner and used for backup administration. Employees and future customers of the main AffHelper product do not obtain independent access to the owner’s personal Google Drive through this connector. The main service requires separate access controls and disclosures.

The integration enables the owner to authorize Google Drive access and send archives that were created outside Google Drive into the selected account. Where necessary for verification or recovery, it can list, download, modify and, under an explicitly configured retention policy or instruction, delete files created by or made available to the integration.

The integration is not intended to scan unrelated personal documents, index an entire Drive, read Gmail, access Google Photos, sell data, build advertising profiles or share information with ad networks. Telegram accounts are not accessed through Google Drive API. Any Telegram-related data present in source backup archives originates from the separate AffHelper backup workflow, not from Google APIs.

3. Categories of data processed

3.1 Google OAuth and Drive information

Authorizing the application does not cause all personal files in your Drive to be uploaded to our infrastructure. The actual access is controlled by the authorized scopes and configuration.

3.2 Content of AffHelper backup archives

Depending on how the source backup job is configured, its archives may contain application databases, user and permission settings, operational logs, processed conversations, credentials for third-party integrations and Telegram session files. These may contain personal data, business confidential information and access credentials. The content is determined by the separate backup process, not by the Google Drive scope.

3.3 Public website visitor information

These static webpages do not include our own JavaScript, registration forms, analytics pixels or advertising trackers. The hosting and security provider (Cloudflare) may still process IP addresses, request timestamps, HTTP headers and security or delivery logs. We do not claim that the infrastructure provider maintains no logs.

4. Google permissions requested

The integration requests https://www.googleapis.com/auth/drive.file. This permits creating files and working with specific Drive files created with the application or opened or shared with it. It does not provide the same broad access as the full .../auth/drive permission.

Within the access granted, the integration may create, inspect metadata, modify, download and delete relevant files. Deletion is performed only if a separate retention policy has been configured or an authorized owner instructs it. The rclone configuration and actual OAuth scope must match what Google displays at consent.

You can revoke access through Google Account security settings. Revocation stops future authorized operations once tokens are no longer valid but does not automatically erase already uploaded backups.

5. Purposes and Google API Limited Use

Information is used only to: (a) connect the account authorized by the owner; (b) transfer, verify and restore backup archives; (c) troubleshoot operational issues and protect access; and (d) comply with mandatory applicable law. Data obtained through Google APIs is not sold, used for advertising, used for training AI models or used to profile individuals.

Our use of information obtained from Google APIs is subject to the Google API Services User Data Policy, including Limited Use requirements where applicable. Routine human examination of the content of Google files is not part of the integration. Access by authorized persons is limited to cases with a lawful basis and necessity, for example on the owner's explicit recovery request or when investigating a security incident.

6. Legal bases and controller/processor roles

Where GDPR or comparable law applies, the relevant legal basis depends on the data and role: contractual performance or the owner's request, legitimate interests in backup availability and security, compliance with legal obligations, or consent where required. A Google OAuth grant is not blanket consent to processing all personal data within AffHelper's source archives.

The main AffHelper product must separately document lawful bases, controller/processor roles, customer contracts and cross-border transfer safeguards for its own processing.

7. Storage and infrastructure

Backup files originate in the AffHelper owner's infrastructure. The rclone process runs on an administrator-controlled server. Files are uploaded to the owner-selected personal Google Drive, not to Google Cloud Storage as part of this integration.

Rclone OAuth tokens and configuration are stored in rclone configuration files on the server and should only be available to the appropriate service account. Diagnostic logs may temporarily contain metadata, but should not contain secrets or archive contents. Exact paths, permissions and log retention must be confirmed by the infrastructure owner.

Current integration: rclone has been authorized for a personal Google Drive and a harmless test upload was completed successfully. Scheduled backups, the final working-archive folder and logging configuration are still being prepared.

8. Encryption and protection of backups

The planned workflow produces encrypted archives before upload to Google Drive and stores decryption keys separately from those archives. Real backup files should not be uploaded until encryption is validated, an independently held recovery key exists, and a restore test has succeeded.

Current status: encrypted backups were prepared during technical testing, but the exact encryption algorithm, independent recovery key custody and coverage of future scheduled backups still need to be confirmed before enabling routine uploads. Unencrypted archives should not be sent to the cloud.

Data is transmitted using protected network connections. Google Account access, OAuth tokens and server access should be protected through multi-factor authentication, least-privilege permissions, separate secret storage, change control and error monitoring. No measure can entirely remove security risk; incidents are handled in accordance with applicable law.

9. Recipients and international transfers

Services that may participate in the integration include:

Data processing and transfers may involve more than one country because the VPS is located in Germany and Google and Cloudflare use global infrastructure. Any applicable cross-border transfer requirements depend on the relevant parties' actual locations and the nature of the data. A country selected in Google Cloud settings does not establish the operator's residence.

We do not sell or transfer Google Drive data to advertisers, data brokers or third parties for credit scoring or profiling.

10. Retention and backup deletion

Retention depends on the configured backup policy and the available quota in the selected Drive account. Once an archive reaches the configured retention period, a separately configured task may remove it, while preserving sufficient recoverable versions.

Planned storage budget: up to 5 GB in total for all AffHelper backup archives in the personal Google Drive. The working target is 4.5 GB with a 0.5 GB reserve. The intended workflow is daily encrypted backups with multiple recoverable versions; the provisional target is up to 7 daily and 4 weekly versions, subject to actual archive sizes. Eligible expired copies may be removed only according to an approved retention policy after a newer usable copy has been verified; the last known restorable backup must be preserved. Insufficient free space should stop an upload and trigger an error notification rather than exceed the budget. Scheduling, quota enforcement and automatic deletion are not configured or active yet. Revoking OAuth access does not automatically erase files already stored in Drive.

11. Diagnostic logs and metadata

Diagnostics may record the time and result of a transfer, file size, path, job ID and error code. Even a file name or path can sometimes be sensitive, so logs require appropriate access controls and a retention policy.

Operational logs are intended to record successful or failed uploads without storing OAuth tokens, encryption keys, or archive contents. Exact log locations, retention periods, and notification methods have not yet been configured and must be documented before automated backups start.

12. Revocation, erasure and disconnection

The account owner can revoke AffHelper Backup access from Google Account settings. An authorized administrator can stop scheduled jobs, remove local OAuth configuration and delete relevant Google Drive files according to agreed procedures. Google Drive Trash, backup versions and legally required retention may affect the timing and completeness of deletion.

Requests about access, revocation or erasure can be sent to pamos2012@gmail.com. Revoking a Google grant does not by itself erase previously uploaded backup archives or source data held within the main AffHelper application.

13. Individual rights

Where applicable law provides these rights, data subjects may request information, access, correction, erasure, restricted processing, portability, objection or a complaint to a supervisory authority. Rights can be subject to lawful exemptions, retention obligations and other parties' rights.

Requests may be sent to pamos2012@gmail.com. After verifying the requester’s authority, the request will be directed to the party responsible for the data. Applicable statutory response periods govern.

14. Security incidents

If compromise of OAuth tokens, archives or encryption keys is suspected, authorized staff should restrict access, revoke or rotate affected credentials, preserve relevant evidence and assess harm. Required notices to individuals, customers or regulators are made according to applicable law and deadlines.

15. Children and sensitive data

AffHelper Backup is not intended for independent use by children and does not deliberately obtain children's data through Google Drive API. Source AffHelper archives may nevertheless contain sensitive or child-related information depending on the main service's data, which remains subject to the source operator's legal obligations.

16. Cookies and tracking

This static website does not use its own advertising cookies, user-registration forms, analytics scripts or embedded trackers. Infrastructure providers may use technical security mechanisms documented in their own policies. This site does not request Google authorization silently; authorization is requested separately on Google's official consent screen.

17. Policy amendments

The operator updates this policy and version date following material changes to data categories, Google permissions, recipients or processing purposes. If its use of Google user data changes materially, users receive appropriate disclosures and, where required, give renewed consent before such new processing takes place.

18. Contact information and references

This policy describes the existing test Google Drive connector. It and any relevant contractual documentation will be updated before production backup automation or separate customer accounts are introduced.