Security and Data Handling

A short summary of how Cloudply protects your data. The full details are in the Privacy Policy.

No servers, no central storage

Cloudply has no server component. Media is transferred between your provider accounts while the app runs on your device. There is no Cloudply infrastructure that stores, processes, or could leak your photos and videos.

Credentials stay on your device

• OAuth tokens are stored in the operating system's secure storage (Android Keystore / iOS Keychain).
• Tokens are never logged, uploaded, or committed to source control.
• OAuth credentials used to build the app are injected at build time and are not part of the app repository.

Transport and authorization

• All provider communication uses the providers' official, authenticated APIs over encrypted connections.
• Sign-in uses each provider's official OAuth consent flow, so you see exactly what Cloudply can access.
• Google Photos access is picker-based and limited to the items you select.

Temporary files are transient

Media staged during an active transfer lives in the app's temporary storage and is removed when the transfer completes. Temporary files are never kept outside an active transfer lifecycle.

Limited permissions by design

Cloudply requests the minimum permissions needed to transfer media: read and write access to the folders you authorize, and notification access so transfer progress can be shown. It does not request contacts, location, or other unrelated permissions.

Incidents and contact

Because no user media or credentials are stored outside your device, the practical risk surface is limited to your own device. If you discover a security issue, report it to [email protected].