MaxDrive is a local-first app. Your files stay in your Google Drive accounts — we never operate our own cloud servers to store your data. All sensitive information (tokens, encryption keys, biometric data) is stored only on your device using Android's hardware-backed Keystore encryption.
1.Introduction
Sanzox ("we," "our," or "us") develops and operates MaxDrive (package: com.sanzox.maxdrive), a mobile application available on the Google Play Store. This Privacy Policy explains how we collect, use, store, and protect your information when you use MaxDrive.
By downloading, installing, or using MaxDrive, you agree to this Privacy Policy. If you do not agree, please uninstall the app and discontinue use.
2.Information We Collect
2.1 Google Account Information
When you sign in with Google, we receive:
| Data | Purpose | Storage |
|---|---|---|
| Email address | Account identification & multi-account management | On-device (Isar DB) |
| Display name | UI personalization | On-device (Isar DB) |
| Profile photo URL | UI display | On-device (Isar DB) |
| OAuth access token | Google Drive API authentication | On-device (SecureStorage) |
| OAuth refresh token | Session persistence without re-sign-in | On-device (SecureStorage) |
We do not store your Google password. Authentication is handled entirely through Google's OAuth 2.0 protocol.
2.2 Google Drive File Metadata
MaxDrive syncs your file metadata (not file contents) from Google Drive to provide file browsing, search, and organization features:
- File name, size, MIME type, creation/modification dates
- Folder hierarchy and parent-child relationships
- Thumbnail URLs and file owner names
- Storage quota (used space, total space)
This metadata is cached locally on your device in an Isar database for offline access and fast loading.
2.3 Device Photos & Videos
If you enable the Photo Auto-Backup feature, MaxDrive accesses your device's photo library (via READ_MEDIA_IMAGES and READ_MEDIA_VIDEO permissions) to upload new photos and videos to your Google Drive. We:
- Do not upload photos without your explicit consent
- Do not access photos unless backup is enabled
- Do not send photos to any server other than your own Google Drive
2.4 Crash Reports & Diagnostics
We use Firebase Crashlytics (by Google) to collect anonymous crash reports in production builds. This includes:
- Stack traces and exception details
- Device model, OS version, and app version
- Crash timestamps
No personal data, file names, email addresses, or file contents are included in crash reports.
2.5 Push Notification Tokens
We use Firebase Cloud Messaging (FCM) to receive real-time sync notifications when your Google Drive files change. Your FCM device token is:
- Stored locally on your device
- Used only to deliver Drive change notifications
- Not shared with third parties for advertising
2.6 Biometric Data
MaxDrive supports biometric authentication (fingerprint/face) via Android's BiometricPrompt API for the Vault feature. We never access, process, or store your biometric data. All biometric operations are handled entirely by Android's hardware-backed security system.
2.7 Encryption Keys
When you use the Vault feature, an AES-256-GCM encryption key is generated and stored in Android's hardware-backed Keystore via Flutter Secure Storage. This key:
- Never leaves your device
- Is not transmitted to any server
- Is not accessible to us or any third party
3.Data We Do NOT Collect
- Never Your Google password or credentials
- Never Contents of your files (documents, photos, videos)
- Never Location data or GPS coordinates
- Never Contact lists, call logs, or SMS
- Never Advertising identifiers or tracking data
- Never Browsing history or search queries outside the app
- Never Biometric fingerprint/face templates
4.How We Use Your Information
| Purpose | Legal Basis |
|---|---|
| Authenticate with Google Drive API | Contract / Consent |
| Sync and display your file metadata | Contract / Consent |
| Upload and download files to/from your Drive | Consent |
| Auto-backup photos to your Drive (if enabled) | Explicit Consent |
| Encrypt/decrypt files in the Vault | Consent |
| Display sync progress and notifications | Legitimate Interest |
| Diagnose and fix crashes | Legitimate Interest |
| Deliver real-time sync notifications via FCM | Legitimate Interest |
5.On-Device AI File Tagging
MaxDrive includes an intelligent file tagging system ("NeuralMesh") that automatically categorizes your files into smart tags. This system:
- Runs entirely on your device (in a background isolate)
- Analyzes only file names and MIME types — never file contents
- Does not use any cloud-based AI or machine learning APIs
- Tags are stored locally in the on-device Isar database
6.Third-Party Services
| Service | Provider | Data Shared | Policy |
|---|---|---|---|
| Google Sign-In | Google LLC | Email, name, profile photo | Link |
| Google Drive API | Google LLC | File metadata, file content (upload/download) | Link |
| Firebase Crashlytics | Google LLC | Anonymous crash reports, device info | Link |
| Firebase Cloud Messaging | Google LLC | FCM device token | Link |
| Firebase Remote Config | Google LLC | App instance ID (anonymous) | Link |
We do not use any advertising SDKs, analytics trackers, or third-party data brokers.
7.Data Storage & Security
7.1 Local Storage
- Isar Database: File metadata, account info, upload sessions, and partitions
- Flutter Secure Storage: OAuth tokens, encryption keys, FCM tokens, and app settings — encrypted using Android Keystore (AES-256)
7.2 Security Measures
- All OAuth tokens are stored in Android's hardware-backed Keystore
- Vault files are encrypted with AES-256-GCM with unique per-chunk IVs
- Per-account mutex locks prevent token race conditions
- API credentials are loaded at runtime via Firebase Remote Config — never compiled into the APK
- Network communication uses HTTPS/TLS exclusively
- R8 code shrinking and ProGuard obfuscation in production builds
android:allowBackup="false"prevents backup extraction of sensitive data
8.Data Retention
- Account data: Retained until you disconnect the account or uninstall the app
- File metadata cache: Synced and refreshed periodically; cleared on account disconnect
- Upload sessions: Automatically cleaned after 24 hours of inactivity
- Crash reports: Retained by Firebase Crashlytics for 90 days per Google's policy
- FCM tokens: Retained until you uninstall the app or clear app data
9.Your Rights
Depending on your jurisdiction (GDPR, CCPA, or other applicable laws), you have the right to:
- Access: View all data stored by the app (available in Settings)
- Deletion: Disconnect your account to remove all locally stored data, or uninstall the app to delete everything
- Portability: Your files remain in your Google Drive — accessible from any device at any time
- Revoke access: Remove MaxDrive's access at myaccount.google.com/permissions
- Opt-out of crash reporting: Crashlytics is only active in production builds; debug builds send no data
- Disable features: Photo backup, biometric lock, and push notifications can each be independently disabled
10.Data Deletion
You can request complete data deletion through any of these methods:
- In-app: Disconnect your Google account in Settings → all local data for that account is immediately deleted
- Uninstall: Removing the app deletes all locally stored data including the Isar database, SecureStorage, and cached files
- Google Permissions: Revoke MaxDrive's access at Google Account Permissions
- Web form: Visit www.sanzox.com/delete-account to submit a deletion request. All data will be permanently purged within 7 business days.
- Email: Contact us at hello.sanzox@gmail.com
11.Children's Privacy
MaxDrive is not intended for children under the age of 13. We do not knowingly collect personal information from children. If you believe a child under 13 has provided us with personal information, please contact us and we will take immediate steps to delete such information.
12.Google API Services User Data Policy
MaxDrive's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, MaxDrive:
- Only uses Google Drive data to provide and improve app features visible to you
- Does not transfer Google user data to third parties except as necessary to provide the app's functionality
- Does not use Google user data for advertising purposes
- Does not allow humans to read Google user data (except with your explicit consent, for security investigations, or to comply with law)
13.International Data Transfers
Your file data is stored in your Google Drive, which may be hosted in data centers worldwide per Google's infrastructure. MaxDrive does not independently transfer your data to any servers. Crash reports are processed by Firebase (Google) under their standard data processing terms.
14.Changes to This Policy
We may update this Privacy Policy from time to time. When we make significant changes, we will:
- Update the "Last Updated" date at the top of this page
- Notify you through an in-app notification or the app's update notes on Google Play
Continued use of MaxDrive after changes constitutes acceptance of the updated policy.
15.Contact Us
If you have questions about this Privacy Policy or your data, contact us at: