Last updated: 2026-10-23
This Privacy Policy describes how oplist collects, uses, stores, shares and deletes data. oplist is a personal, self-hosted instance of the open-source OpenList software, operated by a single individual (the "Owner") on the Owner's own private server, solely for the Owner's personal use. It is not a public service and has no other users.
1. Data we access from Google
When the Owner authorises oplist with their Google account, oplist requests access to Google Drive through the Google Drive API. The data accessed is:
- Google Drive file and folder metadata: names, IDs, sizes, MIME types, modified times and folder structure, needed to display a file listing.
- Google Drive file contents, only when the Owner opens, downloads, streams or copies a file.
- Basic account identification provided by Google during authorisation (such as the account email address), used only to confirm which account was connected.
- An OAuth refresh token issued by Google, used to maintain the authorised connection without asking the Owner to sign in repeatedly.
2. How we use Google user data
Google user data is used solely to provide and operate the file-management features the Owner requested: listing, browsing, searching, downloading, streaming, uploading, renaming, moving and deleting the Owner's own files in the Owner's own Google Drive, and exposing those files to the Owner's other personal software on the same private server. Data is not used for advertising, marketing, credit assessment, or any other purpose.
3. Data sharing
Google user data is not sold, rented, or shared with third parties. It is not transferred to any other party except: (a) to Google itself, as part of the Google Drive API requests the Owner initiates; and (b) within the Owner's own private server and private network, to the Owner's own devices and media software at the Owner's direction. No human other than the Owner accesses the data.
4. Data storage and protection
The OAuth refresh token and application configuration are stored only on the Owner's private server (NAS) in the application's private data directory, which is not publicly accessible. File contents are processed in transit for streaming/download at the Owner's request and are not permanently stored by oplist unless the Owner explicitly downloads or copies a file to their own storage. Access to the application requires the Owner's login credentials.
5. Data retention and deletion
The refresh token is retained only while the Owner keeps the Google Drive connection configured. The Owner can delete the data at any time by: (1) removing the Google Drive storage configuration inside oplist, which deletes the stored token from the server; and (2) revoking oplist's access at any time in their Google Account under Third-party access (https://myaccount.google.com/permissions). Upon revocation or removal, oplist can no longer access the Google account.
6. Limited Use disclosure
oplist's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, oplist does not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models, and does not use Google APIs for AI-generated Non-Consensual Intimate Imagery (AI NCII).
7. Other data
oplist does not run analytics, advertising trackers or third-party cookies on this site.
8. Changes and contact
If this policy changes, the updated version will be posted on this page with a new date. Contact: 613638680q@gmail.com