Chính sách quyền riêng tư

Privacy Policy

This policy applies to CyberTin and other software developed by Atin Productions. CyberTin is an application that runs on the user's computer (macOS and Windows) and helps them browse and transfer files between their computer and their own Google Drive account.

Data CyberTin accesses

When a user signs in with their Google account, CyberTin requests the https://www.googleapis.com/auth/drive scope in order to read and manage files in that user's Google Drive. Specifically, the application accesses:

• File and folder names, sizes, and modification times
• Thumbnail previews of files stored in Drive
• File content, only when the user actively downloads or uploads a file
• Sharing permissions, only when the user opens the collaborator management panel

How the data is used

The data is used solely to display the file listing inside the application interface and to carry out the exact operations the user requests: download, upload, rename, share, manage permissions, move to trash, or delete.

CyberTin does not use Google Drive data for advertising, does not perform behavioural analytics, does not use it to train artificial intelligence models, and does not sell it to anyone.

Where data is stored

Atin Productions operates no servers for CyberTin. Files are transferred directly between the user's Mac and Google's servers over an encrypted connection, and never pass through any Atin Productions infrastructure. File content resides only on the user's own machine and in their Google Drive account.

Access and refresh tokens are stored only on the user's own device: in the macOS Keychain in the Mac version, and in the file %APPDATA%\CyberTin\tokens.json inside the Windows user profile in the Windows version. They are transmitted only to Google's authentication and API servers. The file listing shown in the application exists only in memory while the application is running and is discarded when it closes.

Unfinished transfer queue: so that transfers can resume after a shutdown or crash, CyberTin writes the list of incomplete uploads and downloads to a transfers.json file in the user's application-data folder on their own machine (~/Library/Application Support/CyberTin/ on Mac, %APPDATA%\CyberTin\ on Windows). It contains metadata only (file names, Drive file IDs, local paths, sizes, progress, Google upload-session URLs) and never file content, and it is deleted when no unfinished items remain.

Update check: on launch and every 24 hours afterwards, the application downloads a public file, https://data.atin.productions/cybertin/latest.json, to see whether a newer version exists. This request carries no Google data, file names or account information; the web server keeps only standard access logs (IP address, time, application version) for operational purposes. The application never installs anything by itself: users decide whether to download a new version.

How we protect your data

CyberTin applies the following safeguards to protect users' Google data, including sensitive data such as OAuth tokens and file content:

Encryption in transit

• All connections to Google (accounts.google.com, oauth2.googleapis.com, www.googleapis.com) use HTTPS/TLS. The application never sends Google data over an unencrypted connection.
• File content travels directly between the user's device and Google, through no intermediate server.

Secure sign-in

• Sign-in uses Google's standard OAuth 2.0 flow in the system browser. CyberTin never sees or stores the user's Google password.
• The authorization-code flow uses PKCE (S256) and a random state parameter to prevent authorization-code interception and request forgery.
• The sign-in redirect listener binds only to 127.0.0.1 (loopback), so other machines on the network cannot reach it.

Encryption and access control at rest

• macOS: tokens are stored in the Keychain, which is encrypted by the operating system, with the AfterFirstUnlockThisDeviceOnly attribute: readable only after the device has been unlocked, never synced to iCloud, and never migrated to another device. macOS lets only the CyberTin app that created the item read it; other apps require the user's explicit approval.
• Windows: the token file lives in the user's profile (%APPDATA%) and is protected by that Windows account's NTFS file permissions, so other Windows user accounts on the same machine cannot read it. We recommend enabling BitLocker for full-disk encryption.
• The Windows version's interface is served by a local server that listens only on 127.0.0.1 and is not exposed to the network.

Data minimization

• Atin Productions operates no server that receives, stores or processes Google data. No Atin Productions staff or third party can access a user's Drive data or tokens.
• The application includes no third-party analytics, advertising or crash-reporting SDKs, and sends no Google data off the device other than to Google itself.
• File content is read only when the user actively uploads or downloads; sharing permissions are read only when the user opens the collaborator panel.
• The file listing lives only in memory; the queue file holds metadata only and is deleted when no unfinished transfers remain.

Revocation and incident response

• The Disconnect button immediately removes the tokens from the device. Users can also revoke access on Google's side at any time (see below).
• If we discover a security vulnerability, we will release a fix and announce it through the in-app update notice and this website. Security issues can be reported to hi@atin.productions.

Sharing with third parties

CyberTin does not share users' Google data with any third party.

Compliance with Google's Limited Use policy

Revoking access and deleting data

A user may click Disconnect inside CyberTin to remove the stored session from that machine (the Keychain on Mac, the tokens.json file on Windows).

A user may also revoke all of CyberTin's permissions at any time from their Google account permissions page. Once revoked, CyberTin can no longer access any Google Drive data.

Because Atin Productions stores no Google user data on any server, there is no stored data for users to request deletion of.

Children

CyberTin is not directed at users under 13 and does not knowingly collect data from children.

Changes to this policy

If this policy changes, the updated version will be published at this same address with a new revision date.

Contact

Questions about this policy may be sent to hi@atin.productions.