Privacy Policy

2. Why I collect it

The only purpose of the data I collect is to render the scan report you asked for: how much of your storage is being eaten by version history, which files are the biggest offenders, and roughly what that costs in Microsoft 365 storage fees. I do not use your data to train models, build marketing profiles, or sell to third parties.

3. Where it is stored

Metadata and account records are stored in a Neon PostgreSQL database. The region is configured at the project level and documented in the public deployment runbook; if you need the current region for compliance reasons, ask the founder via the contact channel below.

OAuth refresh tokens are encrypted at rest using AES-256-GCM with a dedicated 32-byte encryption key, held by the hosting platform as its own environment secret — separate from the secret that signs sign-in sessions. Integration with a managed key store (AWS KMS) is deferred to Phase 1 or later, when the project has an entity and an audit-log retention requirement. This is documented honestly so that you can decide whether Phase 0 is acceptable for your data.

3b. Access token lifecycle

When you authorize CloudSniff via Microsoft's consent screen, Microsoft issues two credentials: a short-lived access token and a long-lived refresh token.

What I persist:the refresh token, encrypted at rest using AES-256-GCM. Microsoft's default refresh-token TTL is 90 days. You can revoke it anytime via your Microsoft account permissions page.

What I never persist: the access token. I mint a fresh one from your refresh token at the start of each scan, use it for at most 15 minutes, and discard it from server memory. It is never written to the database, logs, or backups.

This means a snapshot of the database does not give an attacker active access to your OneDrive. They would have to also possess the encryption key, decrypt your refresh token, and call Microsoft to mint an access token — at which point Microsoft can still revoke it on your behalf.

The 15-minute window is stricter than Microsoft's default 60–90 minute access-token TTL. I chose this pattern to minimize the attack surface around your stored credentials.

4. How long I keep it

Scan data is automatically deleted 90 days after the scan completes. A scheduled job runs daily and removes scans older than the retention window, along with all of their child records.

Your account record persists while your account is connected so that you can return and view past reports within the retention window. If you delete your account from Settings, both the account record and all associated scan data are removed immediately.

5. Who I share it with

CloudSniff does not sell your data and does not share it with marketing or analytics partners. The only third parties that touch any of this data are the infrastructure sub-processors that run the application:

• Vercel — hosts the web application and serverless functions.
• Neon — hosts the PostgreSQL database described above.
• Inngest — orchestrates the background scan jobs. While a scan runs, Inngest transiently processes the file metadata the scan steps pass between them — file names, sizes, and item identifiers — as job-step data, encrypted in transit. Inngest retains step traces for roughly 24 hours, after which they are discarded. Inngest never receives file contents (the service itself never reads them).
• Microsoft — the source of the OAuth tokens and the Graph API the scanner reads from.

These vendors process data on the service's behalf to keep the application running. They do not receive your data for their own purposes.

6. Your rights

You can exercise the following rights at any time:

• Delete all of my data.Go to Account → Settings and use the "Delete my account" action. This removes your account record and every scan associated with it.
• Disconnect a cloud account. Settings also lets you disconnect a connected Microsoft account, which removes the stored OAuth tokens from the database.
• Revoke OAuth consent at Microsoft.You can independently revoke CloudSniff's access at myaccount.microsoft.com/permissions. Doing so makes any stored refresh token useless even before its natural expiry.
• Ask a question or request a copy of your data. Reach out via the contact channel below. Because this is a one-person project, response times are best-effort.

7. Cookies

CloudSniff uses a session cookie to keep you signed in after you authenticate. There are no third-party tracking cookies, no advertising pixels, and no analytics scripts in Phase 0. If that ever changes, this policy will be updated before the new cookies ship, and any analytics will be consent-gated where required.

7.1 First-party funnel telemetry

To measure whether visitors who click the landing page CTA actually finish connecting an account, CloudSniff records a small number of first-party events: a CTA click, a sign-in start, a sign-in completion, a cloud-account-connected event, and a scan-completed event. These are stored in CloudSniff's own database — there is no Google Analytics, no Posthog, no third-party SDK.

The CTA-click and sign-in-start events tag a randomly generated UUID stored in your browser's localStorage so the founder can see "X visitors clicked the CTA, Y of those completed sign-in." The UUID is not tied to your identity until OAuth completes, and you can clear it any time by clearing site data for CloudSniff. The later events are tied to your CloudSniff user and cloud account because they happen after sign-in.

None of these events carry the contents of your files. They are deliberately bare: an event name, a timestamp, the UUID, and (after sign-in) your user and cloud-account ids. They exist so the founder can tell whether the product is converting, not to profile you.

8. Phase 0 caveat

The founder is a UAE-resident individual, not a legal entity, and CloudSniff has no establishment in the EU, the UK, or any other jurisdiction whose privacy regime would normally attach to a SaaS company. The founder honors GDPR-style rights — access, deletion, portability — on a best-effort basis as a matter of practice, not because a legal obligation arises from a presence that does not exist.

If GDPR, UK-GDPR, CCPA, or similar legal obligations matter to your use case, please understand that Phase 0 is not the right tier of product for you. Phase 1, once an entity is formed and counsel is engaged, will publish a privacy policy that takes on those obligations explicitly.

9. Contact

Privacy questions, data-deletion requests that the Settings page does not cover, requests for a copy of your data, and concerns about anything in this policy go to support@cloudsniff.space. Because this is a one-person project, response times are best-effort.

10. Changes to this policy

This policy will change as the project evolves — for example, when key management moves to AWS KMS, when new sub-processors are added, or when the project leaves Phase 0. Material changes will be reflected in the "Last updated" date at the top of this page. Continued use of the service after that date constitutes acceptance of the updated policy.