Privacy Policy

Google Drive access and permissions

Google sign-in is optional until you choose to configure photo protection. You authorize the app through Google's consent screen using a Google Desktop-app OAuth client configured on your computer. The requested permission is https://www.googleapis.com/auth/drive.file, described by Google as access to the specific Drive files you use with this app. It is not full access to all files in your Google Drive.

The app creates new private backup folders and files, then reads back its backup photos and manifests to verify that they match the originals. It reads file metadata, parent-folder identifiers, ownership, trash status and sharing permissions to confirm that its backup destinations remain private. It does not scan unrelated Drive files, access Gmail, Google Contacts or Google Calendar, or request permission to do so. Earlier backups created through a different OAuth app remain untouched.

Data used and why

The app reads original photo bytes and gallery listings from the approved live and development Red Rock Shine websites. It creates a combined backup when the observed galleries change, and rechecks existing backups when they have not changed. Original images are copied without stripping embedded metadata; anything already inside an original image, such as EXIF data or visible people and vehicle details, remains in its private backup.

Backup manifests contain gallery scope and photo identifiers, original object paths, display order, focal coordinates, file types, byte counts, SHA-256 checksums and Drive file or folder identifiers. These records allow the app to verify completeness and detect damaged or changed copies. Manifests exclude gallery captions, user-supplied filenames, OAuth credentials and temporary upload-session URLs.

A private local journal records the source binding, check and verification times, checksums, backup identifiers and a fixed failure category. Status output includes verification times and a private backup-folder link. Google Drive data is used only to create, check and support owner-approved photo protection and recovery; it is not used for advertising, profiling or training AI models.

Storage and security

Backup photos and manifests are stored in new folders in the Google account you select. The app checks that each destination is owned by that account and has owner-only permissions. It never adds public, link, domain, group or other-user sharing. The owner can later change permissions in Drive; the app will refuse destinations that no longer satisfy its privacy checks.

The Google Desktop client details and offline refresh token are encrypted using Windows Data Protection API (DPAPI), scoped to the current Windows user. Local app state is stored under that user's Local AppData folder, with access restricted to that user and Windows SYSTEM. Short-lived access tokens are used in memory for authorized HTTPS requests to Google. Credentials are not sent to the Red Rock Shine website, included in backup manifests, or printed in normal status output.

The utility transfers photo bytes to Google Drive over HTTPS and downloads them again for size and checksum verification. It does not overwrite original website photos, change gallery records, overwrite existing Drive backup files, or automatically change sharing permissions. These safeguards reduce risk but cannot guarantee protection from a compromised Windows account, disk loss, Google account compromise or every service outage.

Sharing and disclosure

The app sends the approved backup content and necessary authentication requests to Google to provide Drive storage and sign-in. Google processes that information under its own privacy policy and service terms. Requests to the source websites are subject to their normal server request logging; the Windows utility does not send its Google OAuth credentials to those websites.

Red Rock Shine does not sell Google user data or use it for targeted advertising. The Windows utility has no automatic reporting service that sends your Drive files, credentials or private journal to Red Rock Shine. If you choose to share a status report or backup content for support, share only what is needed and never send credentials. Red Rock Shine uses information you voluntarily share for the requested support, and may disclose it when required by applicable law. The app does not automatically share backups with support staff or other third parties.

Google Privacy Policy

Retention and deletion

All completed backups, incomplete copies and separately created restore-test copies are retained in your Google Drive until you delete them yourself. There is no automatic deletion or retention expiry. This can consume additional Drive storage. A folder without a completed, verified manifest is not a successful backup.

You control your Drive copies and can delete them through Google Drive. Stop the scheduled task and review recovery needs before deleting any backups. Disabling or uninstalling the utility, or revoking Google access, does not delete stored Drive copies. Deleting a backup can make future verification fail and can remove your recovery copy.

The private local journal is needed to prevent duplicate or ambiguous writes and to identify the last verified snapshot. Preserve it across restarts and do not reset it to bypass a failure. If you discontinue protection, first disable the task and confirm that no check is running; you may then remove local credentials and app files after reviewing any retained backups. A future installation after journal loss requires reconciliation before starting again.

Your control and revoking access

Daily checks require your separate approval for scheduled private Drive writes and for reading the live gallery. Only the single approved Windows computer should run them. Keep that Windows account signed in, and keep the computer and both gallery sources available. A current verification covers photos observed at that check, not uploads made afterward.

To stop future scheduled checks, disable “Red Rock Shine Daily Photo Protection” in Windows Task Scheduler. You can revoke the OAuth app's access from your Google Account's third-party connections page. Revocation prevents future authorized Drive access but does not erase existing backup copies. Avoid interrupting an upload in progress; ambiguous writes require review, not an automatic retry.

You can inspect your private files in Google Drive and check operational status using Check-PhotoProtection.ps1. You do not need to disclose Google credentials to Red Rock Shine to exercise these controls.

Manage Google Account third-party connections

Google API Services User Data Policy

Red Rock Shine Windows Photo Protection's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google API Services User Data Policy

Contact and policy updates

For privacy questions or help with access, retention or deletion, contact Red Rock Shine at redrockshine@gmail.com. Do not send passwords, OAuth client JSON, refresh tokens or temporary upload-session URLs.

Updates to this policy will be posted on this public page with a revised effective date. A policy update does not by itself grant additional Google permissions or authorize a different backup host, broader access, new sharing or a changed retention policy.

Email Red Rock Shine