Short version: Stashpool has no server that sees your files, your password or your Google data.
What happens on your device
Files you add are encrypted in your browser with AES-256-GCM, using a key made from a password only you know. The encrypted pieces are uploaded directly from your browser to the Google Drive accounts you connected.
What Stashpool can access in Google Drive
Stashpool asks only for the drive.file permission. It can see and manage only the files Stashpool itself created (its encrypted pieces and the encrypted file list in a folder named "havuz"). It cannot see any other file in your Drive.
The one server-side piece
Google issues long-lived access only together with a secret that cannot be shipped to browsers. A small function adds that secret and forwards the request to Google. It receives the token request, never file data, and stores and logs nothing. Your long-lived Google tokens are kept only inside your encrypted file list, in your own Drive.
What we keep
Nothing. No accounts, no analytics, no cookies. Your browser remembers only the email address of your main account, to suggest it at sign-in.
Removing access
Remove Stashpool at myaccount.google.com/permissions. Deleting the "havuz" folder in each Drive removes all stored data.
Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Source code: github.com/oomer583/havuz