Privacy Policy

Last updated: October 11, 2026

The short version

We store your files so you can get them back, and nothing more. We don't sell your data, share it for marketing, show ads, track you, or use your files for anything except running your account. The details below list exactly what we keep and who handles it, so you can check us.

This website

burnproofstorage.com is a marketing site. It has no accounts, no analytics, no advertising and no tracking. Its contact page does not send us anything; to reach us, email [email protected]. The rest of this policy covers the BurnProof Storage service: the web app at app.burnproofstorage.com and our Windows, macOS, Linux, Android and iOS apps.

What we collect

  • Account: your email address and name. Sign-in is run by AWS Cognito. We never see or store your password in readable form.
  • Billing: payments are handled by Stripe. We receive your plan and subscription status, not your card number.
  • Your files: what you upload, plus their names, sizes, folders and dates. We also compute a fingerprint (a SHA-256 hash) of each file so we can tell you when you upload a duplicate.
  • Previews: for images we keep a small thumbnail. For video and audio we keep a short preview clip. For text and PDF files we generate a short AI summary. You can turn previews off in the app's Settings, which stops them being shown on that device.
  • Technical logs: timestamps, request details and errors, used for security, billing accuracy and reliability.
  • If you choose to import from Google: when you connect Google Drive or Google Photos, Google gives us a token that lets the app read the files you select or import. We store that token to do the import and delete it when you disconnect.
  • On your device: folders you choose to back up are read only to upload them. The Android and iOS apps can show notifications and run in the background to finish a backup. Optional app lock (biometrics) stays on your device; we never receive your fingerprint or face data.

Google user data

This section applies only if you choose to connect Google Drive and/or Google Photos. If you never connect Google, we get nothing from Google.

What access we ask for. You pick which service to connect. Google shows you each permission on its consent screen and you can decline any of them.

  • Google Drive (scope drive.readonly, shown by Google as "See and download all your Google Drive files"): lets the app list and download files in your Drive so you can pick what to import. It cannot change, delete or share anything in your Drive.
  • Google Photos, picker (scope photospicker.mediaitems.readonly, shown by Google as "See and download any photos or videos you select in Google Photos"): lets the app read only the photos and videos you choose in Google's own picker.
  • Google Photos, library (scope photoslibrary.readonly, shown by Google as "View your Google Photos library"): lets the app read your photo library so a recurring import you turn on can bring in new items. It cannot change or delete your photos.

All three are read-only. We never write to, edit, delete or share anything in your Google account.

Why. Only to import the files you select into your BurnProof Storage account. We use Google data for nothing else.

What we store. The files you import, which are then handled like any other file in your account. To keep the connection working we also store the access token and refresh token Google gives us, and which permissions you granted. Tokens sit in our database on AWS, which encrypts stored data at rest, and are used only by our servers to talk to Google for your import.

Who sees it. We do not share, sell or rent Google user data. We do not use it for advertising. We do not use it to train AI or machine learning models. We do not transfer it to anyone except as needed to run the service: Amazon Web Services stores and processes it for us. People at BurnProof Storage do not read it, except where you ask us for support and give permission, where it is needed for security or abuse prevention, or where the law requires it.

Keeping and deleting it. When you disconnect Google in the app, we ask Google to revoke the token and delete our copy. When you delete your account, we do the same for every connection. Files you already imported follow the normal retention rules in this policy and the Terms; delete them in the app if you want them gone. You can also remove our access any time at myaccount.google.com/permissions. To ask us to delete your data, see Delete your account or email [email protected].

Google API Services User Data Policy. BurnProof Storage's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

What we do not do

  • We do not sell your information, ever.
  • We do not share your information with advertisers or data brokers.
  • We do not show ads or use advertising or analytics trackers.
  • We do not use your files to train any AI model.
  • We do not look through your files. People at BurnProof Storage do not open them. Software handles them only to store, preview, de-duplicate and restore them, as described on this page.

How we use it

To run and bill the service, store and restore your files, show previews, email you about your account (including when a restored file is ready), keep the service secure, and meet legal obligations.

Who handles it

  • Amazon Web Services: storage, compute, sign-in (Cognito), email (SES) and AI summaries (Bedrock). Text from a file is sent to AWS to produce its summary.
  • Stripe: payments and billing.
  • Google: only if you connect Drive or Photos. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

How long we keep it

We keep your account and billing records while your account is open and as long as the law requires afterwards. Your files are kept while your plan is active and are removed after cancellation as described in the Terms of Service. Deleted files are removed from storage; copies can persist briefly in AWS while deletion completes.

Your choices

You can update your account details and delete your account in the app. Depending on where you live, you may also have the right to access, correct, delete or export your data. Email us to use these rights. You can turn previews off in Settings, and disconnect Google at any time.

Security

Data is encrypted in transit (TLS) and encrypted at rest in AWS, and access is limited to what the service needs. No system is perfectly secure.

Children

The service is not for children under 13 (or the minimum age where you live), and we do not knowingly collect their information.

Changes and contact

If we change this policy we will update the date below and, for meaningful changes, tell you in the app or by email. Questions: [email protected].