Privacy Policy

1. Overview & Scope

This Privacy Policy describes how Kryon Backup, an internal server backup utility operated by Kryon Innovator co., ltd. (Bangkok, Thailand; contact: teerasak.w@gmail.com), handles authentication credentials and data when interacting with Google APIs and third-party cloud services.

Kryon Backup is an administrative tool designed solely for operator-authorized backups of internal server data to Google Drive using the open-source Rclone engine when configured. It is not a commercial SaaS application, public offering, or consumer service. No automated backup schedule is active by default.

2. Google Drive Data Accessed & Requested Permissions

When configured by an administrator, Kryon Backup requests access to Google Drive API services to perform operational backup tasks: creating, uploading, listing, reading, and verifying backup archive files in the configured destination path.

OAuth Scope & Consent Screen Disclosure:
The permissions displayed on the Google OAuth consent screen depend on the administrative authorization scope selected during setup (such as the application-specific drive.file scope if specifically selected, or a broader Google Drive access scope). While the permissions granted to the client application on the consent screen may permit broader Drive access, the utility's actual operational software behavior is strictly restricted to managing backup files within the configured backup destination path.

3. Storage & Protection of Credentials

Google OAuth credentials (access tokens and refresh tokens) are obtained through an interactive authorization flow initiated directly by the authorized system administrator.

• Server-Restricted Storage: OAuth credentials are stored locally on the operator's private backup server within restricted configuration files (file permission mode 0600 inside a directory mode 0700), accessible solely by the authorized system user account.
• No Credential Logging: OAuth tokens, refresh tokens, and passwords are never logged in application logs, printed to chat or public transcripts, or shared with third parties.

4. Client-Side Encryption & Security Boundaries

Kryon Backup applies cryptographic controls to protect server data:

• Wire-Level Encryption: Backup archive files and archive filenames under the crypt overlay are client-side encrypted using Rclone Crypt before being streamed over HTTPS to Google Drive. Destination folder metadata required by Google Drive API for routing is transmitted as standard API requests.
• Local Staging Boundary: Prior to encrypted streaming, local temporary staging archives on the server host are protected by standard operating system Discretionary Access Control (directory mode 0700, archive mode 0600).
• Key Custody & Recovery: Master encryption passphrases (and salts, if configured) are maintained directly by the operator in server configuration and in an off-host administrator password vault. Google does not hold, manage, or have access to encryption keys. There is no key recovery service through Google or third parties; loss of all operator key copies renders encrypted cloud archives permanently unrecoverable.

5. Data Usage & Google API Policy Compliance

Kryon Innovator co., ltd. enforces strict limitations on data usage:

• No Data Sale: User data and backup contents are never sold, rented, or monetized.
• No Advertising: Data accessed via Google APIs is never used for advertising, marketing, or behavioral tracking.
• No AI Model Training: Backup contents and metadata are never used to train generalized artificial intelligence or machine learning models.
• No Human Inspection: No human personnel read or access backup contents, except where explicitly required by the data owner for troubleshooting.

Google API Services User Data Policy Compliance Statement:
Kryon Backup's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. (Reference: Google API Services User Data Policy).

6. Third-Party Infrastructure & Technical Logs

Kryon Backup utilizes the following third-party infrastructure components:

• Google Drive API: Serves as the cloud storage destination for client-side encrypted backup archives.
• Cloudflare: Provides public DNS and web hosting for this informational legal documentation site. Cloudflare processes standard technical request metadata (such as IP addresses and request headers) for network routing and security purposes.

7. Data Retention & Revocation

Retention: Backup archives remain in the designated Google Drive storage location until the system administrator deletes or replaces them.

Access Revocation: You can revoke Kryon Backup's access to your Google Account at any time through Google Account Security Permissions. Revoking access immediately prevents the utility from uploading new backups. Revocation does not automatically delete existing backup archives already stored in Google Drive; existing archives may be deleted directly within Google Drive or upon administrative request, subject to applicable legal backup retention requirements.

8. Contact Information

For inquiries regarding this Privacy Policy or data handling practices, contact:

Kryon Innovator co., ltd.
Bangkok, Thailand
Email: teerasak.w@gmail.com