TYR
The Cloud Power Tool 

GDPR- & Privacy Policy

Last update / Effective date: 20-JUL-2026

TYR is developed and operated by FluxThoughts (CVR 27665020), Denmark ("we", "us", "our"). This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights under the General Data Protection Regulation (GDPR) and other applicable laws.

By using TYR, you agree to the terms of this Privacy Policy. 

1. Who We Are

Data Controller: 
FluxThoughts
CVR 27665020
Denmark
Contact: tyr@fluxthoughts.com 

2. What Data We Collect and Why

2.1 Google Account and OAuth Tokens

When you sign in to TYR using your Google Account, we receive and securely store:
• Your Google account email address
• An OAuth access token and refresh token

Why: These tokens are required to connect to your Google Drive and perform file metadata operations (reading, renaming, tagging, starring, updating descriptions and properties) on your behalf, and — only when you request a preview — to stream a short preview of a file to your device (see Section 2.3).

Legal basis (GDPR Article 6(1)(b)): Processing is necessary to perform the service you have requested. 

2.2 Google Drive File Metadata

To enable fast browsing, filtering, and bulk operations, TYR builds and stores an index (the Cloud Index File, or CIF) of your Google Drive on our servers. This index contains:
• File and folder names
• File IDs
• Folder structure and hierarchy
• File metadata (descriptions, starred status, custom properties, file types and sizes, sharing status, file counts)
• The name and email address of each file's owner, as supplied by Google Drive — including for files that other people have shared with you.

If you connect more than one Google Drive to your TYR account, each Drive gets its own separate index.

What we do NOT store: File contents, document text, images, or any binary file data. We index metadata only.

Why: The index is essential for TYR's core functionality — without it, every operation would require a live API call to Google, making bulk operations impractically slow.

Legal basis (GDPR Article 6(1)(b)): Processing is necessary to perform the service you have requested. 

2.3 File Previews (On Your Request)

Bulk updates change many files at once, so TYR lets you preview a file first to make sure it is the one you mean. A preview only happens when you tap Preview on a file — it never happens automatically.
• For photos, TYR shows the small preview image that Google Drive already generates — not the full-size original.
• For video and audio, the file streams from Google Drive directly to your device, and playback stops automatically after five seconds.

Preview content goes from Google Drive to your device only. It does not pass through or get stored on our servers, we do not log it, we never share it with anyone, and we do not use it for any purpose other than showing you the preview you asked for.

Legal basis (GDPR Article 6(1)(b)): Processing is necessary to perform the service you have requested. 

2.4 Google API Services — Limited Use Disclosure

TYR's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, regarding data obtained through Google Drive APIs ("Google user data"):
• We only use Google user data to provide and improve TYR's user-facing features: indexing, browsing, filtering, and bulk-updating your Google Drive file metadata, and showing you the file previews you request — all at your direction.
• We do not transfer Google user data to third parties, except as necessary to provide these features (our hosting subprocessor, Railway.app, listed in Section 6), to comply with applicable law, or as part of a merger or acquisition with prior notice to you.
• We do not use Google user data for advertising of any kind.
• We do not allow humans to read your Google user data, unless: (a) we have your explicit affirmative consent for specific data; (b) it is necessary for security purposes (such as investigating abuse); (c) it is necessary to comply with applicable law; or (d) the data has been aggregated and anonymised for internal operations.
• We do not use Google user data to develop, improve, or train generalised artificial intelligence or machine learning models

2.5 Update History

TYR stores a log of bulk update operations you perform, including:
• Which fields were updated (e.g. name, description, starred status)
• Timestamps of updates • Success/failure counts per operation
• Encrypted record of the values applied, for rollback purposes

Why: This enables the rollback feature — allowing you to undo a bulk update if needed.

Legal basis (GDPR Article 6(1)(b)): Processing is necessary to perform the service you have requested. 

2.6 Subscription and Payment Data (Pro Tier)

If you subscribe to TYR Pro, purchases are handled entirely by Apple via In-App Purchase. We do not receive or store your payment card details. We receive from Apple (via RevenueCat):
• Your subscription status (active, expired, cancelled)
• Your subscription tier
• A non-personal subscription identifier

Why: To determine which features you are entitled to use.

Legal basis (GDPR Article 6(1)(b)): Processing is necessary to perform the contract (your subscription).

2.7 Analytics and Crash Reporting (Planned)

We plan to introduce anonymous analytics and crash reporting in a future update. When we do:
• We will update this Privacy Policy before enabling it
• Data will be anonymised and aggregated — no personally identifiable information will be sent
• You will be informed and, where required by law, asked for your consent

Legal basis (when introduced): Legitimate interest (GDPR Article 6(1)(f)) for crash reporting; consent (GDPR Article 6(1)(a)) for analytics where required. 

3. How We Store and Protect Your Data 

• OAuth tokens are encrypted at rest on our servers.
• All communication between TYR and our servers uses TLS encryption in transit.
• Our backend is hosted on Railway.app (servers in the EU — Amsterdam, Netherlands).
• The sensitive parts of your metadata index — file names, descriptions, custom properties, and owner details — are encrypted while stored on our servers, and your index is accessible only to your authenticated account.
• Preview content is never stored on our servers (see Section 2.3).
• We do not sell, rent, or share your personal data with third parties for marketing purposes. 

4. How Long We Keep Your Data 

When you delete your TYR account, deletion is scheduled immediately and all personal data associated with your account — including all stored indexes — is permanently deleted from our servers after a 30-day grace period, during which you can still change your mind by signing back in and cancelling the deletion.

5. Your Choices About Stored Indexes

You can rebuild the index of your currently connected Google Drive at any time from within the app; rebuilding replaces the stored index with a fresh one. Indexes of Drives you have previously connected remain stored (so that reconnecting is fast) until you rebuild them or delete your TYR account. Deleting your TYR account permanently removes all stored indexes.

6. Third-Party Services

TYR uses the following third-party services which may process your data:

We do not use advertising networks and TYR contains no advertisements. 

7. Data Transfers Outside the EU

Our backend servers are located in the Netherlands (EU) and your data does not leave the EU in normal operation. Google's OAuth and Drive API services are operated by Google LLC (USA); Google is certified under the EU-US Data Privacy Framework, providing adequate safeguards for this transfer.

8. Your Rights Under GDPR

As a data subject, you have the following rights:
• Right of access — You can request a copy of the personal data we hold about you.
• Right to rectification — You can ask us to correct inaccurate data.
• Right to erasure — You can ask us to delete your personal data ("right to be forgotten"). Disconnecting your Google account immediately and permanently erases your OAuth tokens. To erase everything we hold — including all stored metadata indexes — delete your TYR account from within the app; deletion completes after the 30-day grace period described in Section 4.
• Right to restriction — You can ask us to restrict processing of your data in certain circumstances.
• Right to data portability — You can request your data in a structured, machine-readable format.
• Right to object — You can object to processing based on legitimate interest.
• Right to withdraw consent — Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at: tyr@fluxthoughts.com
We will respond within 30 days. You also have the right to lodge a complaint with the Danish data protection authority:
Datatilsynet
Carl Jacobsens Vej 35
2500 Valby, Denmark
www.datatilsynet.dk 

9. Children's Privacy

TYR is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority (Datatilsynet) as required by GDPR Article 33 and 34, within 72 hours of becoming aware of the breach.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you within the app and update the "Last updated" date at the top of this page. Continued use of TYR after changes take effect constitutes acceptance of the updated policy. 

12. Contact

If you have any questions about this Privacy Policy or how we handle your data, please contact us: 

FluxThoughts
CVR 27665020
Denmark
Email: tyr@fluxthoughts.com

TYR - The Cloud Power Tool
Find anything. Organize everything.