Privacy Policy
Pre-release draft · Last updated August 18, 2026
OtoShelf remains in development. The internal build implements and verifies read-only Drive browsing, import, playback, offline save, video-to-audio-only conversion, metadata/artwork refresh, and local deletion without changing Drive originals. Live consent, My Drive, real-media, reconnect/relaunch, and physical-device checks are reported complete for the tested device; security and release checks remain open.
This pre-release policy describes the intended data handling and the current verification boundary. Before launch, it will be checked against the signed implementation, App Store disclosures, and Google consent screen.
1. Current status
The repository and internal development build implement read-only Google Drive browsing, folder and individual import with hierarchy preservation, playback, explicit offline save, video-to-audio-only conversion, artwork and metadata refresh, duplicate-save prevention, and on-device deletion that does not modify Drive originals. Automated checks, fixture/scripted flows, and Simulator development builds verify these boundaries. Live Google consent/My Drive/real-media/reconnect/relaunch end-to-end and physical-device audio/background/codec checks are reported complete for the tested device; restricted-scope verification, security assessment, and signed archive Privacy Report/App Store disclosure reconciliation remain open. Build 11 is available only for internal TestFlight testing; it is not a public or general TestFlight release, and Google OAuth approval is not implied. The sanitized evidence package is not published on this pre-release site.
2. Scope
This policy is intended to apply to the released OtoShelf iOS app and this website. Google services remain subject to Google’s own terms and privacy policy.
3. Data handled
The internal development implementation handles only the following information on your device as needed to verify its features; the final public data flow remains subject to the open release gates:
- Authentication state and read-only permission status required for Google sign-in
- Drive metadata—such as name, ID, format, and size—for folders you explicitly browse and supported media you select
- Library information, playback queue, settings, and offline status
- Audio you choose to save, including audio created on device from a video source
- If diagnostics are implemented: error codes, app and OS versions, timestamps, and sanitized state transitions needed to investigate a problem on device
The initial release is planned without a developer server, advertising SDK, analytics SDK, or third-party crash-reporting service. Listening history and music files will not be collected for advertising or analytics.
4. Purpose and your choices
Information is designed to be used only to display, play, and save music you select; retain settings; verify authentication state; and stop on-device processing safely if an error occurs. You explicitly choose which folders enter your library, which tracks are saved to your device, and when local data is removed. It is not used for recommendations, advertising, behavioral tracking, or third-party profiling.
5. Google Drive data
Google Drive is currently the only supported file source. Before using OtoShelf, you must place supported audio or video files in Google Drive. Direct import from iOS Files, iCloud Drive, Dropbox, OneDrive, NAS, or other file sources is not supported at this stage.
5.1 Permission requested
The implementation is scoped to request only https://www.googleapis.com/auth/drive.readonly as its Drive permission. Standard identity scopes required for sign-in may also be used. Live consent is reported complete on the tested physical device, but its sanitized release artifact is not published here. Restricted-scope verification remains open and is not implied by that test.
5.2 What is read
Starting from My Drive, OtoShelf is implemented to handle only folders you explicitly open and supported audio or video you select. It does not automatically scan your entire Drive, monitor changes, or perform scheduled synchronization.
5.3 Operations not performed
OtoShelf will not create, upload, update, rename, move, copy, delete, trash, or change permissions for files, metadata, locations, or sharing settings in Drive. Drive API traffic is designed to allow only approved read-only GET requests with no request body; HEAD requests are not allowed.
5.4 No transfer to a developer server
Metadata and media obtained from Drive are not designed to be sent to a developer server, advertising platform, analytics platform, or external crash service. Communication occurs between your device and Google services. Google may process access information required to operate its services under Google’s own policies.
5.5 Google API Services User Data Policy
OtoShelf's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This information will not be used for advertising, behavioral tracking, profiling, credit assessment, data sales, or training general-purpose AI or machine-learning models.
6. On-device storage
Audio you explicitly save is stored inside OtoShelf’s app container. Temporary streaming cache is kept separate from user-approved offline downloads. When the source is a video, a temporary full-video file may be needed in a dedicated on-device area while processing, but only verified audio is retained as the finished offline file. Temporary video is deleted after completion, cancellation, or failure. If a crash prevents immediate cleanup, only the dedicated temporary area is reconciled and cleared at the next launch.
8. Retention and deletion
- Authentication credentials are designed to remain in secure iOS credential storage while Drive is connected and to be removed from OtoShelf when you disconnect. Disconnecting does not automatically send a revocation request to Google; you can revoke access in your Google Account settings.
- Library data and selected metadata remain on device until you remove them from the library or delete local data for the account.
- Offline audio remains in the app container until you delete an individual track, all offline audio, the account’s local data, or the app itself.
- Streaming cache remains distinct from completed offline files and can be removed by iOS or by a user-initiated cache-clear action.
- If diagnostics are implemented, tokens, Drive IDs and names, email addresses, URLs, and local paths will not be recorded. Retention and deletion details will be finalized before release.
Disconnecting Google Drive and deleting your library or offline files are separate actions. Disconnecting will not automatically delete saved local data. Deleting on-device data never deletes or modifies the original files in Google Drive.
9. Security
Authentication tokens are designed to remain in secure iOS credential storage and never appear in screens, logs, URLs, filenames, or general preferences. Permission checks, fixed network destinations and operations, and separated local storage areas are used to prevent access beyond what is needed. Restricted-scope verification, security assessment, and signed-release privacy disclosure checks remain open before launch; the tested physical-device checks are reported complete.
11. Changes to this policy
This policy may be updated when features, laws, or review requirements change. Material changes will be posted on this page with a revised date. Before launch, the draft label will be removed and the policy finalized to match the released product.
12. Contact
T5U publishes OtoShelf. Privacy questions can be sent to [email protected]; the same address is listed on the Support page. Do not include personal information, authentication credentials, OAuth tokens, Google Drive file IDs, or sharing links unless they are specifically requested through a safer support process.