Privacy Policy

Who processes your data

CloudVault is built and operated by NextTool, which acts as the data controller. You can reach us at info@nexttool.app about anything on this page.

We never receive your file contents

This is the most important point. The contents of your backed-up files are never sent to our servers. The desktop app uploads them straight into your own Google Drive or Dropbox account. We are not in the middle of that transfer and we cannot read your files.

Our server only keeps an index so you can check on your backup: file name, size, folder path, modification date and whether it has been backed up. The file itself is not there.

What we do collect

Account details: your email address, your name, and an irreversible hash of your password. If you sign in with a social account, no password is ever created.

Device details: the name, operating system and last-seen time of each computer running CloudVault. This lets you see your devices and lets us apply your plan's device limit.

File index: the metadata described above.

Subscription state: when your trial started, which plan you are on, and until when.

Purchase details: if you subscribe through Google Play or the App Store, the transaction and receipt information the store provides so we can verify your subscription. Your card and payment details never reach us; the store handles payment.

Technical logs: server records such as IP address and request time, kept for troubleshooting and abuse prevention.

Ads in the Android app

The CloudVault Android app shows banner ads through Google AdMob to users without a Pro subscription. Pro subscribers see no ads.

For ads, AdMob may collect and share with Google your advertising ID (Android Advertising ID) and device identifiers, approximate location (from your IP address), app activity, crash logs and performance data. This is used to serve ads, measure ad performance and prevent fraud.

In the European Economic Area, the UK and similar regions we first ask for your consent to ad personalization (Google UMP consent form). If you decline, non-personalized ads are shown. You can change your choice later.

On Android you can reset or delete your advertising ID in device settings (Settings → Google → Ads). For how Google uses this data, see policies.google.com/technologies/ads.

The contents and names of your files are never used for advertising or shared with the ad network.

Signing in with a social account

If you choose to sign in with Google, Apple or GitHub, we receive exactly three things from that provider: your email address, your display name, and the identifier of your account with them.

We do not request or receive your contacts, posts, photos or friend list, and we never post anything on your behalf.

If you use Apple's "Hide My Email" option, your account is created with the relay address Apple generates and we never see your real address.

Access to your cloud account

CloudVault connects to Google Drive using the drive.file scope only. That scope allows an app to see and manage only the files it created itself.

On Dropbox, access is limited to the app's own dedicated folder. CloudVault cannot see anything you keep outside it.

The rest of your Drive — your other documents, photos and folders — stays closed to CloudVault, and Google enforces this technically. Backed-up files live in your own storage and remain yours through your own account.

Who we share data with

We do not sell your data. We do not hand it to anyone for marketing, with one exception: the data listed above that is shared with Google AdMob for ads in the Android app.

These parties are involved in making the service work: the cloud provider where your files are stored, Google Drive or Dropbox; the sign-in provider you chose; Google Play or the App Store for subscription verification; Google AdMob for ads on Android; and the data centre that hosts our server.

If we are legally required to disclose information, we share only what the request actually covers.

Cookies

We only use cookies the service needs to function: one to keep you signed in, one to protect forms against forgery, and one to remember your language.

The website has no advertising or tracking cookies and no third-party analytics. Ads in the Android app are described separately above.

How long we keep it

Account and index data is kept for as long as your account exists. When you delete your account it is permanently erased within 30 days.

Technical logs are kept for at most 90 days.

Your rights

You have the right to access, correct, delete and receive a copy of the data we hold about you. Write to info@nexttool.app and we will respond within 30 days at the latest.

The Data Deletion page walks through removing your account step by step.