Privacy Policy

1. Who we are and scope

This policy applies to the CloudOS service: the website, the CloudOS Windows app and the CloudOS Android app (package com.cloudos.mobile), which provide private cloud file storage. The service provider is the controller of personal data described here. Contact: cuanag20@gmail.com

2. Information we collect

2.1 Information you provide

• Account data: full name, username, email address and password (stored only as a bcrypt hash, never in plain text).
• Sign in with Google: if you choose it, we receive your Google account ID, name and email from Google to create and verify your account. We do not access Gmail, Google Drive, contacts or any other Google data.
• Two-factor authentication (2FA): if enabled, the TOTP secret for your account.
• Files and folders: the files you choose to upload or save to your CloudOS drive, including file and folder names, size, type and version history.
• Payment data: selected plan, amount, status, reference number and any transfer slip you upload (bank transfer / PromptPay).
• Reviews and support: text you submit in reviews or in emails to support.

2.2 Information collected automatically

• Device data: device name, operating system and version (e.g. Android 15, Windows 11) and a device-specific token (stored server-side as a hash).
• IP address and activity logs: time and IP address of sign-ins, key actions (registration, sign-in, plan changes) and the browser user-agent of sessions, for security and abuse prevention.
• Usage data: storage used, monthly request counts (to enforce plan quotas) and sync status.
• Cookies: the website uses strictly necessary session cookies for sign-in and security (including a CSRF token). No advertising cookies.

2.3 What we do not collect

We do not collect location, contacts, SMS, call logs, camera images or microphone audio, and the apps contain no third-party advertising or behavioral-analytics SDKs.

3. How we use your information

• Create and manage your account, authenticate you, verify email and recover passwords.
• Store, sync, download, share and restore files as you instruct.
• Enforce storage quota and device limits of your plan.
• Process payments, issue invoices/receipts and send service emails such as renewal reminders and quota warnings.
• Prevent fraud and password guessing (temporary account lock after repeated failed sign-ins) and keep the service secure.
• Comply with legal obligations and respond to lawful requests.

Our legal bases are performance of the service contract, your consent, our legitimate interest in security, and legal compliance.

4. Sharing and third-party providers

We do not sell or rent your personal data. We share data only with processors that help the service operate:

• Cloudflare R2 — stores your file contents, separated per user account. Files transfer directly between your device and R2 using short-lived URLs.
• Stripe — card payment processing. Card details go directly to Stripe; we never store full card numbers.
• Google — only if you choose Sign in with Google.
• Email / SMTP provider — verification, password-reset and receipt emails.
• Hosting and database providers — host the website and database.
• People you share links with — anyone with a share link you create can access that item; you can revoke the link.
• Authorities — when required by a valid legal request.

These providers may process data outside your country. We select providers that apply appropriate security safeguards.

5. Retention

• Deleted files: moved to trash and restorable for 7 days, then permanently deleted automatically.
• Version history: up to 5 versions per file; older versions are removed.
• Expired plans: we send email reminders first and may permanently delete files if a plan is not renewed within the period set by the service.
• Activity and security logs: kept only as long as needed for security and auditing.
• Payment records and receipts: kept for the period required by tax and accounting law.
• On account deletion: we delete or anonymize your data within a reasonable time, except data we must keep by law.

6. Security

• Passwords are stored as bcrypt hashes; device tokens are stored as hashes.
• Data in transit between apps and server uses HTTPS (the Android app disallows cleartext HTTP).
• Two-factor authentication and device revocation from the website are supported.
• Failed-sign-in limits with temporary lockout, CSRF protection and blocking of dangerous file types.
• The Android app opts out of system backup (allowBackup=false).

No system is 100% secure. If you notice anything unusual, change your password, revoke devices and contact us immediately.

7. Android app permissions

The app requests only what it needs:

• INTERNET, ACCESS_NETWORK_STATE — connect to the server and check network status.
• FOREGROUND_SERVICE, FOREGROUND_SERVICE_DATA_SYNC — keep large uploads/downloads running in the background until they finish.
• POST_NOTIFICATIONS — show transfer progress and results.

The app accesses only files you pick for upload, or choose to save, via the Android system file picker. It does not scan other files on your device.

8. Your rights

Depending on applicable law (including Thailand's PDPA B.E. 2562, and similar laws such as GDPR), you may:

• access and obtain a copy of your personal data;
• correct it (you can edit it yourself on the profile/settings pages);
• delete your data or close your account;
• restrict or object to processing where the law provides;
• withdraw consent at any time, without affecting prior processing;
• request data portability and lodge a complaint with a competent authority.

How to request account and data deletion

Request deletion yourself on the account deletion page (confirm with your password if you are signed in, or receive a confirmation link by email). In the Android app, go to Account › Delete account. We will delete your account and all your files within a reasonable time (normally within 30 days) and email you when it is done. If you cannot use that page, email cuanag20@gmail.com from your registered email address with the subject “Account deletion request”. You can also delete individual files yourself from the drive or website at any time.

9. Children

The service is not directed to children under 13 (or the minimum age set by local law) and we do not knowingly collect their data. If you believe a child has provided data, contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top will change, and we will notify you on the website or by email of material changes.

11. Contact

Questions or requests: cuanag20@gmail.com