BOX PRIVACY POLICY

This document describes how Cloud Storage ("we", "us", "our", the "App") accesses, uses, stores, and shares Box user data when a user connects their Box account through our Cloud Drives feature. It supplements our main Privacy Policy.

1. Who We Are

Cloud Storage is a cloud file storage platform available at https://cloudstorage.bar. We allow users to import files from third-party cloud storage providers (including Box) into their Cloud Storage account.

2. Compliance with Box Terms

Our use of the Box API complies with the Box Platform documentation, the Box Terms of Service, and the Box Privacy Notice.

3. Permissions Requested

When a user connects their Box account, we request the following scope:

• Read all files and folders stored in Box — needed to list and import files

Why this scope is needed: the user must be able to browse their Box folders and select files for import. We do not request write permissions and cannot modify, create, or delete files in the user's Box account.

4. What Box Data We Access

Only files and folder metadata that the user explicitly browses or selects for import. Specifically:

• File and folder names, sizes, modification dates, and folder structure — fetched on demand when the user opens a folder in our Cloud Drives browser
• File contents — only when the user clicks "Import" on a specific file or folder. The file is streamed directly from Box into the user's Cloud Storage storage
• The user's Box account email/login — used only as the display label for the connected drive

5. How We Store Box Data

• OAuth tokens (access token + refresh token) are stored in our database and used solely to make subsequent rclone API calls on the user's behalf
• File contents are streamed directly through our server and stored in the user's Cloud Storage account on our backend storage. After import, the file is treated like any other file the user uploaded directly
• We do not retain Box file IDs, paths, or metadata beyond the import operation
• We do not cache or index Box content not actively being imported

6. Data Retention

• OAuth tokens are kept until the user disconnects the drive or deletes their Cloud Storage account
• Imported files follow the Cloud Storage main retention policy — the user controls them and can delete them at any time

7. Sharing and Disclosure

We do not sell, share, or transfer Box user data to any third party. Specifically:

• We do not share Box data with advertising networks, data brokers, or analytics providers
• We do not use Box data to train AI/ML models
• The only "transfer" that occurs is the user-initiated copy of selected files from their Box into their own Cloud Storage storage account
• We may disclose Box data only when required by valid legal process or to investigate abuse / security incidents

8. Security

OAuth tokens are stored securely. All connections to Box APIs use HTTPS. Access to our database is restricted to authorized personnel and audited.

9. How to Revoke Access and Delete Data

• In-app: open Cloud Drives in Cloud Storage, click the trash icon next to the connected Box entry. This deletes the OAuth tokens from our database immediately
• From Box: visit https://app.box.com/account → Apps → find Cloud Storage and disconnect
• Full account deletion: deleting your Cloud Storage account removes all OAuth tokens and associated data
• By email: contact us using the address below to request manual deletion of any data we hold

10. Children's Privacy

Cloud Storage is not directed to children under 13. We do not knowingly collect personal information from children under 13.

11. Changes to This Policy

We may update this Box Privacy Policy from time to time. Material changes will be reflected in the "last updated" date below.

12. Contact

For questions about this policy, to request data deletion, or to report a security concern, please use the contact options on the main Cloud Storage website (https://cloudstorage.bar).

Last updated: 2026-04-07