CarotDAV Privacy Policy

Last modified on Sep 16 2026.

Here I inform you of CarotDAV privacy policies.

Basic Policy

CarotDAV collects, uses, stores personal information as little as possible.

Personal Data Storage

CarotDAV stores all of your personal data(A) locally on your PC. Connection information(B) contained in this personal data(A) may be transmitted to the corresponding online service/site as necessary to establish and use the connection.

Data Transmission

CarotDAV doesn't send any information to anywhere, except:

Connection information(B) and HTTP Access Information(C) to each corresponding online service/site.
HTTP Access Information(C) to support site(this site) during new version confirmation process.

CarotDAV doesn't contain any advertisements.

Behavior/Operation

CarotDAV is file management software, so it accesses user local/remote files according to user operations to fulfill user intentions.

CarotDAV renames, copies, moves, deletes, modifies, and lists files and/or file metadata only when the user operates it to do so. CarotDAV writes remote files only when the user operates it to upload local files. CarotDAV reads remote data only when the user operates it to download remote files.

CarotDAV cares about the file transfer, but not the file contents. CarotDAV may read the file contents byte by byte to check data loss during transfer, but CarotDAV doesn't check what the file type is, what the file is, or whatever the file is correct/valid/legal.

The only exception is "favicon" image file. CarotDAV automatically finds the "favicon" file and reads, analyzes, and stores it to display in the application window.

Online Services specific policy declaration

Google Drive

CarotDAV is a general-purpose file management application. When a user adds a Google Drive connection, CarotDAV requests access to Google Drive in order to allow the user to browse and manage existing files and folders in the user's Google Drive.

CarotDAV uses the Google Drive scope that permits access to the user's Google Drive because its file management functionality must operate on existing files and folders selected by the user through CarotDAV, and is not limited to files created by CarotDAV.

Access to Google User Data

CarotDAV may access the following Google user data as necessary to provide its Google Drive file management functionality:

Google Drive files and file contents
File and folder names
File and folder metadata
Folder structure
Other Google Drive information necessary to perform file operations
OAuth authorization tokens required to access Google Drive on behalf of the user

CarotDAV accesses this data only as necessary to perform its file management functions.

Use of Google User Data

CarotDAV uses Google Drive data according to user operations and solely for providing file management functionality.

CarotDAV renames, copies, moves, deletes, modifies, and lists Google Drive files and metadata when necessary to perform operations requested by the user.

CarotDAV uploads file contents when the user requests an upload and downloads file contents when the user requests a download.

The only exception is a file used as a "favicon". CarotDAV may automatically find, read, analyze, and store such an image locally in order to display it as an icon in the application.

CarotDAV does not use Google user data for:

advertising;
marketing;
profiling or analyzing user preferences;
application analytics;
unrelated application development or improvement; or
any purpose unrelated to the Google Drive functionality requested by the user.

Storage of Google User Data

CarotDAV is a desktop application and stores Connection information(B), including OAuth authorization tokens, locally on the user's PC.

Such locally stored personal data(A) is encrypted using AES-256 when necessary.

CarotDAV does not store Google Drive user data on servers operated by the CarotDAV developer.

Google Drive file contents are transferred directly between the user's PC and Google services as necessary to perform operations requested by the user.

Sharing and Transfer of Google User Data

CarotDAV does not sell Google user data.

CarotDAV does not transfer, disclose, or share Google user data with the CarotDAV developer or with third parties, except when a transfer is explicitly initiated by the user as part of a file operation.

CarotDAV does not change sharing permissions or other permissions of Google Drive files unless the user explicitly performs an operation requiring such a change.

Data Retention and Deletion

OAuth authorization information and other Connection information(B) stored by CarotDAV can be deleted by deleting the corresponding Google Drive connection setting in CarotDAV.

Users can also revoke CarotDAV's access to Google Drive from their Google Account settings.

CarotDAV does not retain Google Drive user data on servers operated by the CarotDAV developer.

Google API Services User Data Policy

CarotDAV's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Update of this Policy

I reserve the right to change this policy at any time. I will not inform you of updates to this policy because I don't have users' private information. You should check this policy periodically at your own risk.

Contact

If you have any questions about this policy, please contact me at reichan@white.plala.or.jp.

Term and Definition

In this privacy policy, the terms are defined below.

Personal Data(A): Personal Data includes account names, passwords, authorization tokens, and other Connection information(B). It also contains application graphical and/or local PC related information such as window size/position, column width, sort information, favicon image, and so on.
Connection information(B): Connection information includes account names, passwords, authorization tokens, cookies, and other information to authorize users to the corresponding services and sites.
HTTP Access Information(C): HTTP Access Information includes IP and/or HTTP related access information(IP address, server date/time, local date/time, HTTP version, client software name and version, user preferred language, and so on).