Slowgrain Cleaner for Google Drive Privacy Policy
1. Service and controller
Slowgrain Cleaner for Google Drive is a file-management app provided by MORAON Studio under the Slowgrain brand. This policy describes how the app accesses and uses Google user data. Google Drive™ is a trademark of Google LLC. Slowgrain Cleaner for Google Drive is not affiliated with or endorsed by Google LLC.
Legal business name: MORAON Studio (모라온 스튜디오), sole proprietor registered in the Republic of Korea
Jurisdiction: Republic of Korea
Privacy contact: slowgrain.dev@gmail.com
Effective date: 2026-10-23
2. Google user data and permissions
The app uses https://www.googleapis.com/auth/drive.file to work only on files the user picks in Google Picker or sends from Google Drive's "Open with" menu. It reads information about those files and, when the user asks for cleanup or restoration, moves them to or restores them from the Drive bin. The app never permanently deletes or shares files. Selecting a folder does not give the app access to the files or folders inside it, and the app does not discover new files or browse the whole Drive. Schedules the user turns on recheck only the set of files the user has already allowed and saved.
Information processed for selected files may include file IDs, names, MIME types, parent-folder details readable within the allowed scope, sizes, checksums, creation and modification times, versions, ownership and capabilities, app-private file metadata, image and video dimensions and video duration, previews and derived analysis fingerprints. This information is used only for duplicate and similarity review, user-requested cleanup and restore, and app features the user requests.
OAuth scopes
drive.file: reads files the user picked or sent with "Open with", and moves them to or restores them from the bin and sets app-private keep markers when the user asks.drive.install: connects the app to Google Drive's "Open with" menu.drive.appdata: stores, reads and deletes the app's settings, analysis fingerprints and operation history in the user's hiddenappDataFolder.script.scriptapp: creates and manages Apps Script triggers for scheduled checks and cleanup the user turns on.script.external_request: makes Google Drive API requests for the selected files and app-data file I/O from Apps Script, and verifies a purchase with the Paddle API after the user pays.
The app does not request whole-Drive scopes such as drive, drive.readonly or drive.metadata*, or any email scope. It sends no email and never reads Gmail. Users may revoke access in their Google Account security settings; features that need the revoked access will stop working.
3. Where data is processed and stored
- Apps Script user properties: account licence, schedule settings and some analysis state.
- The user's hidden Drive app data folder: the saved list of selected files (if the user turns it on), analysis fingerprints and cleanup/restore history. These files are not shown in ordinary Drive folders.
- App-private metadata on individual files: when the user turns "Always keep" on or off, the app stores or removes a keep marker in that file's private app metadata. File content is not changed.
- Browser: most analysis of selected photos and videos runs in the user's browser. Reduced analysis fingerprints may be saved in browser IndexedDB to avoid repeating work, and interface preferences in browser local storage.
- Optional local analysis helper: only after the user installs and connects it, the app passes selected file IDs, version/checksum metadata and a short-lived Google OAuth token to a helper running on the user's computer at
127.0.0.1. The helper temporarily downloads the requested originals for analysis and removes them when the job ends. Derived fingerprints and resume checkpoints may remain in the user's local cache; the user can stop the helper and remove.cache/drive-cleaner-helperin the home folder (on Windows,%USERPROFILE%\.cache\drive-cleaner-helper).
4. Payments
Pro payments are handled by Paddle, the merchant of record. The app's buy button opens the checkout page at https://slowgrain.app/drive-cleaner/buy/, and Paddle collects the payment details directly. A random confirmation value is passed to that page so the purchase can be linked to the user's Google account; it contains no email address or file information. After payment the app checks the transaction and subscription identifiers, the price and that value with the Paddle API, and stores the app licence state in user properties. What Paddle collects, how long it keeps it and how refunds work are governed by Paddle's policy and checkout.
5. Sharing, sale, advertising and analytics
The app does not sell Google user data or use it for advertising. It does not expose file contents or lists to other users. Cleanup and restoration follow the signed-in account's permissions and the user's chosen action. The app contains no third-party advertising or product-analytics SDK. Paddle is involved as a payment processor only when the user starts checkout.
Recipients and transfers of Google user data
- Google LLC: Information and content from files the user has allowed are sent through the Google Drive API to the app interface and Google Apps Script functions needed to provide the requested features. App settings, saved file lists, analysis fingerprints and operation history may be stored in the private
appDataFolderof the user's Google account. Google processes this data as the cloud provider for Drive, Apps Script and storage. - The user's browser and device: Information about selected files is sent to the user's browser for display and duplicate/similarity analysis. Only if the user explicitly connects the optional local analysis helper are the selected file contents and identifiers, together with a short-lived Google OAuth token, passed to that helper running at
127.0.0.1on the same computer. The helper is not a remote Slowgrain server and does not send the files to a separate MORAON Studio server. - Paddle: When the user starts checkout, Paddle receives information needed to process payment, transactions and subscriptions. A random confirmation value may also be sent to associate a purchase with the app account. The app queries the Paddle API with transaction identifiers and price information to verify a purchase. Drive file contents, names or lists, Drive metadata, media and analysis fingerprints are not sent to Paddle.
- GitHub Pages: As the hosting provider for the product and policy website, GitHub Pages may process ordinary visitor request and security logs such as IP addresses. Drive information accessed by the app is not sent to GitHub Pages.
Other than the disclosures to these providers needed to deliver the features described above, we do not provide or transfer Google user data to third parties. We do not sell it or use it for advertising, data brokering or training generalized AI/ML models. We may disclose information to the extent required by valid legal process or necessary to protect service security and rights. Except where legally required, the operator will obtain the user's affirmative permission before reviewing file content for support.
6. Retention and deletion
Settings, fingerprints and history remain until the user deletes app data; there is no automatic expiry. Privacy and app data → Delete my app data deletes app-owned storage files, app user properties, app triggers, and the app analysis cache and preferences in the current browser. It does not change original Drive files. Revoking Google access does not by itself delete stored app data, so delete app data first where possible. If deletion reports an error, contact slowgrain.dev@gmail.com.
The in-app deletion does not delete a separate local-helper cache, Google, Apps Script or Google Cloud security and diagnostic logs, or transaction records Paddle must keep by law. "Always keep" markers on individual files are kept so the user's keep choices survive; the user can remove them from the scan results. Files in the Drive bin can be restored or permanently deleted by the user in Google Drive.
7. Security and policy
The app does not show OAuth tokens in its interface or store them in its own database. A token passed to the local helper is held in memory only for the job and discarded when it expires. The security controls and policies of Google Apps Script, Google Drive and Paddle also apply. No internet transmission or third-party platform can be guaranteed risk-free.
The use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used to train generalized artificial intelligence or machine-learning models. The provider does not read file content for support without the user's affirmative permission, except where required for security or by law. Changes to data handling will be reflected here with an updated effective date.
8. Contact and changes
Privacy, deletion or security requests: slowgrain.dev@gmail.com
Business: MORAON Studio (모라온 스튜디오), sole proprietor registered in the Republic of Korea
Business mailing address: 36 Yangcheon-ro 75-gil, Building 102, Unit 1, Gangseo-gu, Seoul, Republic of Korea (서울특별시 강서구 양천로75길 36, 102동 1호, 염창동, 진산빌라)
9. Website and service providers
These public information pages use no advertising, analytics, tracking pixels, web fonts or account forms. The one exception is the checkout page (/drive-cleaner/buy/), which loads Paddle.js to open the checkout. GitHub Pages hosts the website and may process ordinary request and security logs such as IP addresses. App data is processed by the Google services described above, by the local helper when connected, and by Paddle when the user pays; these providers may process data internationally under their terms and safeguards. Support emails are kept as long as needed to resolve the request and meet legal obligations; request deletion at the privacy contact.
Public policy: https://slowgrain.app/drive-cleaner/privacy/ · Support. This publication does not state that Google or CASA has certified the app.