Privacy Policy

“Byteport” (“we”, “us”) operates the Byteport dashboard at dashboard.byteport.com and the Byteport API at api.byteport.com. This policy applies to both. It does not cover the third-party cloud providers you connect — their handling of your data is governed by their own privacy policies.

• Account information. Your name and email address, handled through our authentication provider (Supabase), to create and secure your account.
• Storage-connection credentials. To connect a provider you either authorize us via OAuth (Google Drive, Dropbox, OneDrive, Box) or provide access keys (Amazon S3, Cloudflare R2, Wasabi, Backblaze B2, Google Cloud Storage, Azure Blob Storage). For OAuth we store the resulting access and refresh tokens; for key-based providers we store the access key and secret (and, where needed, a region or endpoint). All of this is encrypted at rest — see How we store and protect your data.
• File metadata. When you browse a connection we retrieve metadata about your files and folders — names, sizes, types, and modification dates — to display and navigate your file list.
• File contents, during transfers only. When you start a transfer, we read the files you selected from the source account and write copies of them to the destination account and folder you chose. The bytes stream through Byteport servers in memory while that transfer runs and are discarded as soon as they are written to the destination. We do not keep, inspect, or store file contents, and we never read file contents for any purpose other than a transfer you initiated.
• Transfer records.For each transfer we keep the job’s status, the source and destination paths and file names, byte and object counts, and any per-file error messages, so you can monitor, review, and retry transfers.
• Support information. If you contact support, the subject, message, and any attachments you send — along with your name and email — are processed to answer you.
• Billing information. An account identifier, your email, and usage counts, used for metering and billing. Payment card details are handled by our payment processor and are never stored by Byteport.
• Technical information. Standard request data needed to operate and secure the service. We do not run third-party advertising or analytics trackers by default.

With the authorization you grant (OAuth) or the keys you provide, we connect to your storage provider on your behalf for two purposes only:

• to list your files and folders — their names, sizes, types, and modification dates — so you can browse and navigate them; and
• to copy the files and folders you selectfrom one connected account to another, when you start a transfer. This means reading the selected files’ contents from the source and writing copies of them into the destination folder you chose. Transfers are additive: they create new copies at the destination and never change the source.

Those are the only things we do with your storage access. We do not:

• store the contents of your files — during a transfer, bytes pass through Byteport servers in memory only for as long as it takes to write them to the destination, are never written to disk, and are never retained afterward;
• read the contents of any file you did not select for a transfer;
• modify, move, rename, or delete your existing files in any connected account;
• use your file data or metadata for advertising, profiling, or any purpose other than providing the features you use;
• sell your data or share it with data brokers; or
• use your file data or metadata to develop, improve, or train artificial-intelligence or machine-learning models.

We access this data solely to provide the file listing and transfer features you use, and we retain the access only for as long as your connection exists (see Retention and deletion).

We request the minimum permissions needed to do two things: list your files and folders, and copy files between your accounts when you ask us to. Copying requires reading the contents of the files you select at the source and creating new files in the destination folder you choose — so, unlike a browse-only tool, we request read and write access. We use write access only to create the copies you requested; we never modify, move, or delete files that are already in your account, and we never read files you did not select for a transfer.

You can review and revoke Byteport’s access at any time from your provider’s own security settings (for example, your Google Account permissions page or Dropbox’s connected-apps page).

• Credentials and tokens are encrypted at rest using AES-256-GCM envelope encryption, with a per-account data key wrapped by AWS Key Management Service (KMS). They are decrypted only transiently, in memory, to communicate with your provider — they are never returned to your browser and never written to our logs.
• File metadata is cached only in your browser for a short time (to keep the interface responsive) and clears automatically; it is not stored on our servers.
• File contents in transit move from the source provider through Byteport servers to the destination provider over TLS, in memory, in bounded chunks, and are discarded as each chunk is written. They are never written to disk, never logged, and never retained after the transfer.
• Infrastructure. Byteport runs on Amazon Web Services (Aurora PostgreSQL for account and credential storage, KMS for encryption keys) across multiple regions. Data in transit is protected with TLS.

We do not sell your personal information. We share data only with (a) the cloud providers you connect — necessarily, to carry out your requests — and (b) the service providers we rely on to operate Byteport:

We may also disclose information if required by law, to enforce our terms, or to protect the rights, safety, and security of Byteport and its users. If Byteport is involved in a merger or acquisition, we will notify you before your information becomes subject to a different privacy policy.

• We keep your connection credentials and tokens until you remove the connection or delete your account.
• Removing a connection permanently deletes the credentials and tokens we stored for it.
• Deleting your account deletes your account and the connection credentials and tokens associated with it.
• You can also revoke Byteport’s access at any time directly from your provider’s security settings, independently of Byteport.
• File metadata cached in your browser clears automatically (within about 30 minutes) and when you sign out.
• File contents are never retained after a transfer finishes. Transfer records (status, paths and file names, counts, and per-file errors) are kept as part of your account history so you can review and retry transfers, and are deleted when you delete your account.

You can access and update your account information, remove any connection, revoke provider access, and delete your account at any time from the dashboard. Depending on where you live (for example under the GDPR or CCPA), you may also have the right to access, correct, delete, or export your personal information, or to object to certain processing. We do not sell personal information. To exercise any of these rights, contact us at help@byteport.com.

We protect your data with encryption at rest (AES-256-GCM with AWS-KMS-managed keys) and in transit (TLS), least-privilege access, and the practice of never returning your stored credentials to the browser or writing them to logs. No method of transmission or storage is completely secure, but we work to protect your information and to promptly address any issues.

Byteport is operated from the United States and processes data on AWS infrastructure that may be located in the United States and other regions. Where we transfer personal information across borders, we do so in reliance on appropriate safeguards. By using Byteport you understand your information may be processed in these locations.

We may update this policy from time to time. When we do, we’ll revise the “last updated” date above, and for material changes we’ll provide additional notice. Your continued use of Byteport after an update means you accept the revised policy.

Questions about this policy or your data? Email us at help@byteport.com.