GoogleCleaner
Your data, explained

GoogleCleaner Privacy Policy

Last updated: October 14, 2026.

This policy describes how GoogleCleaner, an independently developed Chrome extension, accesses, uses, stores, shares, and deletes Google user data. GoogleCleaner helps you review files and folders you own in Google Drive and move only the items you select and confirm to Trash.

Google data we access and why

  • Account information: your Google account email identifies the connected account and ensures a cleanup job runs only for its original account. The Drive account response also requests your display name, but GoogleCleaner does not display or otherwise use it.
  • Drive file metadata: item IDs, names, MIME types, modification dates, file sizes when available, and Drive links. This data supports listing, search, filtering, sorting, selection review, size summaries, and links back to Google Drive.
  • Authorization data: OAuth authorization codes, PKCE verifiers, access tokens, and refresh tokens or encrypted refresh handles. These authorize the account access you approve and renew sessions.
  • Cleanup records: account email, a job ID, selected item IDs and names, timestamps, processing status, attempt counts, errors, and results. These records support background processing, progress, and retry. Account-mismatch errors can include the other account's email.

GoogleCleaner requests https://www.googleapis.com/auth/drive because it lists and manages existing files you own, including files not created or opened by this app. Although this permission is broad, the code does not download or read document contents. GoogleCleaner does not collect your Google password, contacts, Gmail messages, or browsing history.

How we use your data

Google user data is used only to provide the visible account, file-review, filtering, selection, and cleanup features described above. A confirmed cleanup sends Google an instruction to move the selected item IDs to Trash. Selecting a folder includes its contents. GoogleCleaner never permanently deletes files or empties Trash, and does not resolve shortcut targets for cleanup. Search text, filters, sort order, and selections are processed in the extension's memory.

GoogleCleaner does not sell Google user data, use it for advertising, profiling, creditworthiness, lending, or data-broker databases, or use it to develop, improve, or train generalized or non-personalized AI or machine learning models. The extension contains no advertising or analytics code.

Who receives data

  • Google: handles account sign-in and permission screens. Drive requests go directly from the extension to Google's APIs, carrying authorization tokens, listing queries, pagination tokens, and selected item IDs for cleanup. Google returns account information, metadata, and results.
  • The GoogleCleaner authentication service on Vercel: exchanges authorization codes and PKCE verifiers with Google and refreshes sessions. It receives codes, verifiers, and encrypted refresh handles; it processes access and refresh tokens in memory and returns access tokens and encrypted refresh handles to the extension. It does not receive Drive file names, file contents, search text, selections, or cleanup results.
  • Vercel as hosting provider: processes authentication service traffic and may process operational request metadata, such as network addresses, request paths, status codes, and timing, under its Privacy Notice. Provider operational-log retention depends on the hosting configuration and service terms. The auth service code does not log request bodies, authorization tokens, or token responses.

Google data is not shared with advertisers, data brokers, or AI training services. GoogleCleaner's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Storage and retention

  • File lists and interface choices: kept in the popup's memory and cleared when that popup closes or its account state is reset.
  • Authentication sessions: access tokens and encrypted refresh handles are stored on your device in chrome.storage.session. They survive popup closure but are cleared by disconnecting, extension reload or removal, or restarting the browser. Access-token expiry is set by Google. Encrypted refresh handles expire seven days after each issuance; successful refresh can issue a replacement handle. Switching accounts replaces the active session.
  • Cleanup jobs and results: stored on your device in chrome.storage.local. The latest job remains until you dismiss a completed job, it is replaced by another job, or the extension's local data is removed. Disconnecting does not delete these records. Active or paused jobs cannot be dismissed through the current interface.
  • Authentication service: has no application database and does not persist codes or raw access or refresh tokens. It processes them for the authentication request. Encrypted refresh handles are returned to the browser rather than saved in a server-side account database.

When the Vercel service is not configured, the fallback sign-in uses Chrome's native chrome.identity token cache instead. The current configured account chooser uses the Vercel flow described here.

How data is protected

Network requests to Google and the authentication service use HTTPS. Sign-in validates OAuth state and the exact extension redirect, and uses PKCE to bind authorization codes to the originating request. The Web OAuth client secret stays in the server environment, outside the extension. Refresh handles use authenticated AES-256-GCM encryption. Extension session storage is not exposed to content scripts by this app. Cleanup jobs verify their account before processing. Local cleanup records are stored in Chrome's extension storage; GoogleCleaner does not apply additional encryption to those records.

Your controls and deletion

  • Disconnect: pauses active cleanup, cancels its scheduled wake-ups, clears the browser authentication session, and resets popup account and file state. A request already sent to Google may finish and its result is recorded. No new cleanup requests are dispatched while the job remains paused. Reconnecting does not automatically resume that job.
  • Remove local records: dismiss a completed job in the extension. To clear all locally stored jobs and sessions, remove the extension from chrome://extensions. Reinstalling starts with fresh extension storage.
  • Revoke Google access: open Google Account connections, select the app entry, and remove access. Disconnecting alone does not revoke Google authorization. Revocation does not remove local job records or undo changes already made in Drive.
  • Restore trashed files: use Google Drive's Trash and its restoration controls. Retention and deletion of items in Drive are governed by Google and your account settings, not by this extension.

Changes and contact

Changes to data handling will be reflected in this policy and its update date. For privacy questions or deletion assistance, contact julianaaoyola@gmail.com. Do not send passwords, access tokens, or private file contents. Because cleanup records are stored on your device, their removal must be performed in your browser using the controls described above.