Privacy Policy for Alucard Sync
1. Introduction & Architectural Disclosures
This Privacy Policy governs the manner in which Rhaegar Systems ("we," "our," or "us") accesses, processes, handles, and protects information in connection with the Alucard Sync desktop application ("Application" or "Software").
Local-First, Direct Pipeline Architecture
Alucard Sync is an entirely client-side desktop utility built using Tauri 2 and native Rust. All network transmissions—including OAuth 2.0 cryptographic authentication handshakes and multi-threaded resumable file transfers—occur directly between the local client executable running on your device and Google LLC's official API endpoints over Transport Layer Security (TLS 1.3). Rhaegar Systems does not maintain, operate, or utilize intermediary application servers, storage proxies, or central databases to intercept, inspect, mirror, or retain your files, directory trees, or access credentials.
2. Information Accessed, Processed, and Stored
Alucard Sync accesses only the technical parameters strictly necessary to deliver desktop file transfer, directory synchronization, and storage quota management features.
A. Google User Profile Information
Upon explicit authentication via Google OAuth 2.0, the Application retrieves read-only account metadata via https://www.googleapis.com/drive/v3/about:
- Attributes Accessed: Display Name, Primary Email Address, and Avatar/Profile Photo URL.
- Storage Quota: Total storage allocation, used bytes, and trash byte metrics.
- Operational Purpose: To display authenticated identity in the local interface, confirm active session state, and render drive capacity meters.
B. Google Drive Files and Directory Metadata
Subject to your explicit consent to the Google Drive API scope (https://www.googleapis.com/auth/drive), the Application accesses:
- Object Metadata: File and folder identifiers, labels, byte sizes, MIME types, modification timestamps, parent folder relationships, and MD5 hashes.
- Content Streams: Binary data streams transferred during user-initiated download, upload, or export operations.
- File Operations: File creation, directory generation, item renaming, and permanent deletions explicitly commanded by the user.
C. Local System Environment
- Local Storage Targets: Local directory paths selected by the user for file downloads (defaulting to
~/Downloads) or file uploads selected via Linux native file picker dialogues (GTK / KDE / portal). - System Hardware Metrics: Local detection of logical CPU cores (
std::thread::available_parallelism) to dynamically balance parallel worker thread allocation (4 to 32 threads). This operational data is evaluated entirely in-memory and is never transmitted off the host device.
D. Exclusions from Collection
- The Application never collects, intercepts, or logs Google account passwords. All credential verification is handled exclusively by Google’s secure OAuth 2.0 loopback server.
- The Application contains no background telemetry, user analytics, device fingerprinting, keystroke logging, or behavioral tracking modules.
- The Application contains no advertising frameworks or commercial tracking SDKs.
3. Purpose and Scope of Data Processing
All information accessed by the Application is processed exclusively on the host device to execute user-directed file operations, including:
- Generating and displaying remote Google Drive folder hierarchies.
- Managing parallel, chunked resumable downloads and uploads via HTTP Range headers.
- Recording local byte boundary offsets to enable seamless pause and resume operations.
- Preserving authenticated session states across application restarts.
Rhaegar Systems does not sell, rent, monetize, distribute, or utilize user data, file contents, or metadata for commercial profiling, targeted advertising, or the training of artificial intelligence or machine learning models.
4. Local Credential Storage and Security Safeguards
Authentication credentials and operational data are secured locally on the host machine using operating system-level encryption:
Long-lived OAuth 2.0 Refresh Tokens are written to the Linux Secret Service / Keyring system (such as GNOME Keyring or KWallet) under collection item RhaegarSystems.AlucardSync. Cryptographic protection is enforced through the user's logged-in desktop session keyring, ensuring credentials remain protected and encrypted at rest.
Non-sensitive configuration files and operational caches are maintained in the user's standard XDG configuration directory (~/.config/alucard-sync/):
session.json: Active session identifiers, access token expiration timestamps, and user profile cache.transfers.json: Local operational records of ongoing, paused, and completed transfer tasks.drive_tree_cache.json: Local structured cache of remote directory metadata to facilitate low-latency navigation.download_manifests/: Binary chunk progress manifests enabling resumable downloads.
5. Third-Party Integrations and External Network Calls
Network calls initiated by the Application are strictly restricted to the following external domains:
- Google LLC:
accounts.google.com,oauth2.googleapis.com,www.googleapis.com. Direct execution of OAuth 2.0 authentication handshakes, Drive directory querying, file streaming, and connectivity pings. Subject to the Google Privacy Policy. - Cloudflare, Inc.:
speed.cloudflare.com. Invoked solely upon user execution of the manual network speed test utility with synthetic, non-identifiable binary data blocks. No personal data or user files are included. - Authentication Relay Portal:
alucardauth.rhaegarsystems.com. A static, client-side web utility provided by Rhaegar Systems to assist in receiving OAuth authorization codes during browser-based login flows. Executes entirely within the user's browser runtime and does not record, log, or persist authentication tokens, authorization codes, or IP addresses on any remote server.
6. Google API Services User Data Policy Compliance
- Human Access Prohibition: No personnel, contractors, or agents of Rhaegar Systems are granted access to view, read, or inspect user files, metadata, or Google account information.
- Transfer Restrictions: Google user data is never transferred to external third parties, advertising platforms, data brokers, or information resellers.
- Machine Learning Restrictions: Google user data is never used to train, evaluate, or fine-tune artificial intelligence, machine learning, or automated decision-making algorithms.
7. Data Retention, Session Termination, and Revocation Rights
In-Application De-Authentication: Initiating the Log Out procedure within the Application immediately deletes the stored refresh token from the system Keyring, deletes session.json, and clears all in-memory access tokens.
Local Artifact Removal: Uninstalling the Application via your package manager and removing ~/.config/alucard-sync permanently deletes all local transfer logs, directory caches, and resumable download manifests.
Revocation via Google Account Controls: Access permissions granted to the Application may be permanently revoked at any time via your Google Account dashboard under Third-party Apps & Services.
8. Age Restriction (Strict 18+ Policy)
The Application is intended exclusively for individuals aged eighteen (18) years or older. Rhaegar Systems does not knowingly permit access to, nor collect or process data from, individuals under eighteen (18) years of age. If you are under eighteen years of age, you are strictly prohibited from installing or using this Software.
9. Statutory Grievance Redressal Mechanism
10. Policy Amendments
Rhaegar Systems reserves the right to amend this Privacy Policy to reflect technical updates, architectural modifications, or statutory changes. Any revisions will be published on the official website alongside an updated timestamp. Continued use of the Software after publication constitutes acknowledgment of the revised terms.