Privacy notice
Personal use only. This OAuth app backs up one self-hosted Valheim server for its owner's personal use. It is not a backup service or public product, and other people are not invited or supported to use it.
Google information accessed
The app requests the Google Drive drive.file scope. This scope lets it create files and manage files created by the app or specifically made available to it; it is not broad access to every file in Google Drive. The backup is configured to use the owner's valheim-backups folder. Folder targeting is part of the app configuration, while Drive's scope governs the app's file-level access.
How information is used
Google Drive access is used only to store and maintain Valheim world backup snapshots. The backup job reads world archives from the owner's server storage and uses Restic to encrypt repository data before upload. Google receives and stores encrypted repository contents plus file metadata needed to store and manage those files. The app does not use Drive data for advertising, profiling, or AI/ML training, and does not share it with other people or unrelated services.
Where information is processed and stored
The backup runs in the owner's self-hosted Kubernetes homelab. The Google OAuth refresh token and Restic repository password are stored in a protected Kubernetes Secret, outside the public source repository. Google processes OAuth requests and stores the uploaded encrypted repository. Anyone with both the repository and Restic password may be able to decrypt backup contents, so the password is separately protected.
Retention and deletion
When scheduled backups are enabled, Restic applies the retention policy configured by the owner (currently planned as 48 hourly, 7 daily, 4 weekly, and 12 monthly snapshots). The schedule is currently suspended, so it does not make recurring backups. The owner can revoke the app's Google access in Google Account security settings and delete backup files from Drive. Revoking access does not delete existing files automatically. A separate copy of the Restic password is needed to restore data after loss of the cluster.
Security and intended audience
This app is intended only for the owner's personal use. No other Google accounts are invited or supported. Google Production status may allow any Google account to attempt the consent flow; it does not itself enforce an owner-only restriction. Encryption reduces exposure of backup contents at rest, but does not prevent loss or deletion of files or protect against compromise of both the repository and its password.
Google API Services User Data Policy
Use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
Contact and changes
This notice may be updated when the app's behavior or data handling changes. Questions about this personal-use app can be sent to tyler.kalbach08@gmail.com.