Privacy Policy

DixDrive ("we", "us") lets you connect the cloud storage accounts you already have (Google Drive, OneDrive, Dropbox, Yandex Disk, and MEGA) and manage them from one place, on the web and on your phone.

This policy explains what we collect, why we need it, how we protect it, and how you can take it back. It covers the DixDrive website, the web app, the mobile apps, and anything else we run under the DixDrive name.

Your account: You can sign in with Google or with an email and password. With Google, we receive your email address, your name, your profile picture, and the ID Google uses for your account. With an email and password, we keep your name, your email address, and a one-way hash of your password (argon2id). We never store the password itself and cannot read it. Each email address belongs to one sign-in method, so an email used with Google cannot also be used with a password, and the reverse.

One-time codes: We email you a 6-digit code to confirm a new email account, to reset a forgotten password, and to confirm sensitive actions such as deleting your account. We store only a hash of each code. A code expires after 10 minutes, stops working after 5 wrong tries, and can be used once.

Connected cloud accounts: When you connect a cloud account, the provider gives us access and refresh tokens so DixDrive can reach your files for you. MEGA have no separate authorization screen, so connecting one means giving us the email (or username) and password for that account, which we keep so the connection keeps working. Every one of these credentials is encrypted before it is stored (AES-256-GCM), and none of them is ever sent to your browser or phone.

File details: To show your files in one place, we keep a catalog of their details: names, sizes, file types, the IDs your provider gives them, folder paths, created and modified dates, checksums, and sync status. We use it for browsing, search, folder organization, storage health, and deciding where an upload goes.

Messages you send us: If you use the contact form, we keep your name, your email address, your message, and any screenshots you attach, so we can reply and fix what you tell us about.

Diagnostics: Basic technical information, such as device type, operating system version, sync timing, and error reports, so we can keep syncing reliable and spot abuse.

We store details, not files: Your files live in your own cloud accounts. DixDrive keeps the catalog described above, not copies of your files.

Direct transfers: Where your provider allows it, uploads and downloads go straight between your device and your provider.

Passing through, never kept: Some providers do not allow direct transfers from a browser. For those, the file passes through our servers on its way, in memory. It is never written to disk, never put in storage, and never cached.

Nobody reads your files: No DixDrive employee, contractor, or automated system opens or reads the contents of your files. We only act on your files when you ask us to.

DixDrive's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We keep what we store on your device to a minimum:

Sign-in cookies: Secure, HTTP-only cookies that keep you signed in to the web app. Scripts on the page cannot read them.

Browser storage: Your browser keeps a local copy of your folder tree and upload queue, so pages open quickly and interrupted uploads can pick up where they stopped. It stays on your device.

We do not sell, rent, or trade your personal data. We share it only with the services that run DixDrive:

Hosting and database: The servers and database that run DixDrive and store your account and file catalog, encrypted where described above.

Email delivery: The email provider that sends your one-time codes and account notices. It receives your email address and the message, and nothing else.

Contact form attachments: Screenshots you attach to a contact message are stored with Cloudinary, an image hosting service, so our team can view them.

Error monitoring: Aggregated error reports, used to find and fix problems.

When the law requires it: We may disclose account data if required by a valid subpoena, court order, or other binding government request under the laws of Bangladesh.

Encrypted at rest: Cloud account tokens and passwords are encrypted with AES-256-GCM before they reach our database. Your DixDrive password and one-time codes are stored only as argon2id hashes.

Encrypted in transit: Everything between your device, our servers, and your cloud providers travels over HTTPS (TLS).

Limits on guessing: Sign-in attempts, one-time codes, and password resets are rate limited. Resetting your password signs you out everywhere.

Disconnecting a cloud account: You can disconnect any cloud account at any time. We delete its tokens or stored password and its file catalog right away. The files themselves stay untouched in your cloud account.

Deleting your DixDrive account: You can delete your account from Settings, or by emailing [email protected]. We then delete your profile, your stored credentials, and your file catalog from our live systems within 30 days. Deleting your DixDrive account never deletes files in your cloud accounts.

Contact messages: We keep contact messages and their attachments for as long as we need them to resolve what you wrote about.

Wherever you live, you can ask to see the data we hold about you, correct it, export it, limit or object to how we use it, or have it deleted. We do not sell or share personal information as the California Consumer Privacy Act defines those terms.

For privacy questions or deletion requests, write to us: