ClouAuth
Privacy & Data Protection

Privacy Policy

Your privacy and data security are fundamental to everything we build at clouburstlab.

Last Updated: September 26, 2026

1. Introduction

At clouburstlab ("we", "us", or "our"), we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what personal data we collect, why we collect it, how it is handled, and your rights when using clouburstlab authentication, Single Sign-On (SSO), and connected cloud storage services.

2. Information We Collect

We collect information necessary to deliver secure authentication and user-requested account features. The categories of information include:

  • Account Profile Data: Your name, email address, username, profile picture (avatar), pronouns, bio, and address when provided.
  • Security & Authentication Data: Passkeys (WebAuthn public keys), hashed backup codes, TOTP secrets, and securely hashed passwords (using bcrypt).
  • Third-Party Connected Accounts: When you authenticate or connect third-party providers (Google, GitHub, Microsoft), we receive your basic profile identifier, email, and OAuth authentication tokens.
  • Cloud Storage & Google Drive Data: If you explicitly connect Google Drive, OneDrive, or Dropbox, we receive authorization tokens and metadata required to perform the file operations you specifically request.
  • Device & Session Logs: IP addresses, user agents, browser types, and session timestamps to protect against unauthorized access and maintain security.

3. How We Use Your Information

We process your information strictly for legitimate operational purposes:

  • To authenticate your identity securely across connected applications and services.
  • To enable user-directed cloud storage operations (such as syncing or accessing files in Google Drive).
  • To manage your security settings, multi-factor authentication (2FA), and profile preferences.
  • To protect against fraud, unauthorized logins, and security vulnerabilities.

4. Google API Services & Limited Use Disclosure

clouburstlab's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google API Services User Data Policy.

  • We only request access to Google Drive scopes (such as drive.file and drive.readonly) when you explicitly choose to connect your Google Drive.
  • We do NOT use Google user data or Drive files for serving advertisements or for marketing purposes.
  • We do NOT use Google Workspace or Google Drive data to train, retrain, or improve generalized artificial intelligence (AI) or machine learning (ML) models.
  • Human access to your Google data is strictly forbidden unless we have your explicit permission for troubleshooting, it is necessary for security investigations (such as investigating abuse), or it is required by law.

5. Cloud Storage Integrations (Google Drive, OneDrive, Dropbox)

When you connect a cloud drive to your clouburstlab profile, access is granted strictly through official OAuth 2.0 authorization flows. We only access files or folders that you explicitly interact with through our services. Your access tokens are encrypted at rest using industry-standard symmetric encryption (AES-256-GCM), and we never read, alter, or transfer your files without your direct instruction.

6. Data Sharing & Third Parties

We do not sell, rent, or trade your personal data. We only share information with third-party applications when you explicitly grant them permission through our OAuth/OpenID Connect consent dialogs. You have complete transparency and control over these applications and can revoke access at any time.

7. Data Retention & Your Rights

You retain full control over your personal data:

  • Access & Update: You can view and update your personal details, email addresses, and security methods anytime in your Profile Dashboard.
  • Disconnect Services: You can disconnect third-party logins or cloud drives (Google Drive, OneDrive, Dropbox) with a single click in Connected Accounts.
  • Revoke Google Access: You can also revoke clouburstlab's access to your Google account at any time via Google Account Permissions (Google Account Connections)
  • Account Deletion: You can permanently delete your account and all associated credentials, tokens, and records at any time using the Danger Zone in your profile settings. → Danger Zone

8. Security Measures

We implement robust technical and organizational measures to safeguard your information. All communications are encrypted in transit using TLS 1.3/HTTPS, sensitive credentials and OAuth tokens are encrypted at rest, and authentication sessions are monitored for anomalous activity.

9. Contact Us

If you have questions, feedback, or requests regarding this Privacy Policy or our data practices, please reach out to our privacy team at support@clouburstlab.com or visit https://clouburstlab.com. support@clouburstlab.com.