Privacy policy

Who runs this service

This instance of Crossdrive at drive.compasscto.com is operated by the person or organisation who deployed it. Crossdrive is open-source software; its authors do not run this instance and cannot see its data. The operator has not published contact details here, so direct questions to whoever gave you this address.

What Crossdrive does

Crossdrive lets an AI client that you have approved (for example Claude or ChatGPT) work with files and mail in the cloud accounts you connect to this instance. It only acts when that client calls one of its tools on your behalf.

Data it accesses

• Google Drive: file and folder names, metadata, contents and sharing settings, to list, search, read, create, move, copy, rename, share and trash files.
• Gmail: messages, threads, labels and attachments, to search and read mail, create drafts, apply labels and, only if you enable it for an account, send mail.
• OneDrive and Dropbox (beta): file and folder names, metadata and contents, for the same file operations.
• Your sign-in: the email address of the account you sign in with, to check that you are allowed to use this instance.

Data is fetched from the provider when a request needs it and returned to the AI client that asked. Crossdrive does not keep copies of files or messages.

Data it stores

• OAuth refresh tokens for each connected account, encrypted (AES-256-GCM) in storage controlled by the operator.
• An audit log of actions that change something: time, client, account label, action, file or message ids and names, and for mail the recipients and subject. File contents and mail bodies are not logged.

Short-lived access tokens are cached in memory and expire within an hour.

Sharing

Data is not sold, rented or shared with anyone, and is not used for advertising. It goes only to the AI client you connected, at its request. There are no analytics or tracking scripts on this site.

Google API Services: Limited Use

Crossdrive's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, Google user data is used only to provide the file and mail features you request through your AI client; it is not transferred to others except as needed to provide those features, to comply with law, or as part of a merger or acquisition; it is not used for advertising; it is not used to develop, improve or train generalised AI or machine-learning models; and no person reads it except with your explicit agreement, when needed for security purposes such as investigating abuse, or to comply with applicable law.

Revoking access

• Use Disconnect on /connect to remove an account and delete its stored token.
• Remove the app from the provider's own permissions page: Google, Microsoft or Dropbox. This invalidates the stored token immediately.
• Remove the connector in your AI client to stop that client from calling Crossdrive.

Retention and deletion

Tokens are kept until you disconnect the account. Audit log entries are kept by the operator for as long as the instance runs, so that changes can be reviewed and undone; ask the operator to delete them.