Privacy policy

Effective October 26, 2026. This policy describes the internal TapMango Backup Runner operated by Tyler Cox.

Information accessed

With the operator’s consent, the utility uses Google’s limited drive.file permission. It reads the authenticated account email and owner identifier, storage quota, and metadata, permissions and content of files created or explicitly opened with this app. It uses that information to confirm the approved destination and verify encrypted backup objects. It does not request whole-Drive, Gmail or Google Photos access.

Backup content and encryption

When separately approved and enabled, the utility captures an authorized application database and related website media. Backup payloads and the detailed inventory are encrypted locally before transfer using authenticated encryption and a public recovery key. Small transport receipts and object metadata can contain backup identifiers, timestamps, byte counts and integrity hashes. Private recovery keys and unlock secrets are not uploaded as part of the normal backup bundle.

Qualification so far has uploaded synthetic encrypted test data only. It has not activated routine client-data backups.

Use, storage and sharing

Google account metadata and backup objects are used only to operate and verify the approved recovery workflow. Google stores the encrypted objects in the operator’s private Drive folder. Authorization secrets are stored in private operator files with restricted permissions, outside the website application and repository. The writer is not given the private decryption key.

The backup workflow does not sell Google user data, use it for advertising, or use it to train AI models. Operational alert delivery may send a bounded backup status code to the operator through Resend; it does not attach backups or merchant content. These information pages add no analytics, advertising, sign-in form or tracking script; their hosting provider may maintain ordinary request logs.

Retention and control

No routine schedule or automatic deletion is currently enabled. Test objects remain in the private folder. Future capture and retention require an approved plan; the utility stops on insufficient space rather than deleting existing copies or purchasing capacity. The Google permission can be withdrawn through the operator’s Google Account third-party connections settings. Revoking access stops future API access but does not itself remove previously stored files.

For access, correction, retention or deletion requests, contact tylercox9492@gmail.com. Requests require operator review and identity confirmation. No client data or credentials should be emailed.

Google API data

Use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements where applicable. Changes to this policy will be reflected here before the utility adopts materially different data practices.