Privacy Policy
This Privacy Policy explains how WPressHub ("we", "us", or "our") handles information when you use Drive Transfer for WordPress (the "Service"). Questions or privacy requests may be sent to wpresshub@gmail.com.
1. Service purpose
The Service lets authorized WordPress administrators transfer files and Media Library items between their WordPress website and their own Google Drive account. Transfers are initiated and controlled from the plugin interface.
2. Google user data we access
We request the Google Drive drive.file permission. This permits the Service to create and manage files it creates, and to access files or folders the user explicitly opens or selects for the app through Google Picker. Depending on the action requested by the user, the WordPress plugin may access selected file names, identifiers, MIME types, sizes, checksums, folder relationships, and file content needed to upload or download those files.
We use Google user data only to provide the visible transfer, file-selection, connection, refresh, and revocation features requested by the user. We do not use Google user data for advertising, credit decisions, surveillance, or the sale of data.
3. How transfers and authorization work
- File content transfers directly between the user's WordPress server and Google Drive. The WPressHub OAuth connection service does not proxy, receive, or store transferred file content.
- Google access and refresh tokens are delivered to the connected WordPress installation through a short-lived, one-time authorization transaction.
- The WordPress plugin stores its Google tokens encrypted in that WordPress site's database. The site operator controls that hosting environment.
- The central service does not retain a usable refresh token after the one-time claim. It retains a keyed, irreversible fingerprint used to bind later refresh and revocation requests to the same installation.
4. Other information we process
For security and operation, we process the connected site's HTTPS origin, random installation identifiers, encrypted installation credentials, OAuth state and transaction metadata, replay-prevention nonces, rate-limit identifiers, timestamps, request status, IP address, and limited server logs. We do not intentionally log Google tokens, request bodies containing tokens, or transferred file content.
5. Storage and retention
- Pending OAuth transactions expire after 10 minutes and are removed by scheduled cleanup. A successfully claimed token bundle is deleted immediately as part of the claim transaction.
- Replay-prevention nonces and rate-limit records are retained only for their short security windows and are removed by scheduled cleanup.
- Installation security records are retained while the connection is active. On successful revocation, the installation is marked revoked and its token fingerprint is removed.
- Operational logs may be retained for a limited period needed for security, reliability, abuse prevention, and legal compliance.
6. Sharing and processors
We do not sell Google user data or personal information. Information may be processed by infrastructure providers strictly to host, secure, and operate the Service; by Google as necessary to provide Google Drive and OAuth; when required by law; or to investigate security incidents and abuse. We do not permit processors to use Google user data for their own advertising purposes.
7. Google API Services User Data Policy
Drive Transfer for WordPress's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
8. Security
We use HTTPS, short-lived OAuth transactions, state validation, PKCE, encrypted credentials, authenticated requests, timestamps, replay-protected nonces, rate limiting, least-privilege access, and restricted server files. No service can guarantee absolute security, and site operators remain responsible for securing and updating their WordPress hosting.
9. Your choices and deletion
You may disconnect and revoke Google Drive access from the plugin. This removes local OAuth tokens and asks Google to revoke the authorization. You can also remove the app from your Google Account security settings. To request deletion of service-side installation metadata associated with your site, contact wpresshub@gmail.com and identify the connected site domain.
10. Children
The Service is intended for business website administrators and is not directed to children under 13.
11. Changes
We may update this policy when the Service or applicable requirements change. Material changes affecting Google user data will be disclosed before the new use takes effect where required.