What MergeDrive stores and why.
This page describes the current application’s data handling. Use the contact form for privacy questions or deletion requests.
Email verification
Email/password signups remain pending until a six-digit email code is verified. Codes expire after 15 minutes and have limited attempts and resends. Pending signup data, including a password hash, is scheduled for deletion after 24 hours. Brevo processes the recipient address and email content. Sending limits or delivery failures never activate an account.
Account information
MergeDrive stores your name and email address and a password hash if you choose password sign-in. Social sign-in stores the provider identity identifier linked to your account. Account roles, status and sign-in times support account management; authenticated daily activity is recorded for monthly service metrics. Administrative changes are recorded in an audit history. Login-provider tokens are used for authentication and are not retained as storage credentials.
Connected clouds and file metadata
We store connection identifiers, encrypted cloud credentials, quota information, file names, sizes, checksums, locations, folders and transfer history so your workspace can operate. File bytes pass through the server for supported file operations and verification.
Launch waitlist and invitations
The waitlist stores your email, consent time and invitation status. Joining does not create an account or start a trial. When an administrator sends your requested invitation, Brevo processes the recipient address and email content. Personal invitation links expire after seven days and are single-use. Send-attempt records expire after 30 days; waitlist records remain until removed. Use the leave-waitlist link in your invitation to disable it, or contact us to request removal.
Browser storage and cookies
Essential cookies keep you signed in and protect requests. Your browser may temporarily store selected upload files until completion or cancellation. A local preference remembers dismissal of the trial offer. Clearing browser storage may require selecting original upload files again.
Developer data and contact messages
API usage counters, key hashes and webhook configuration support developer projects. Request logs expire after 30 days. Contact form submissions include your name, email, topic and message and are scheduled for deletion after 180 days; database expiry may take additional time. Messages are saved to the support inbox, with no automatic email forwarding currently configured.
Your controls
Disconnecting a cloud removes its usable credentials from MergeDrive but leaves provider files in place. Revoke provider access directly with Google or Microsoft if needed. For account data or privacy requests, use Contact and select Privacy. Never submit passwords, API keys, access tokens or sensitive file contents.