TYR
The Cloud Power Tool 

GDPR- & Privacy Policy

Last update / Effective date: 05-SEP-2026

TYR is developed and operated by FluxThoughts (CVR 27665020), Denmark ("we", "us", "our"). This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights under the General Data Protection Regulation (GDPR) and other applicable laws.

By using TYR, you agree to the terms of this Privacy Policy.

1. Who We Are

Data Controller:
FluxThoughts
CVR 27665020
Denmark
Contact: tyr@fluxthoughts.com

2. What Data We Collect and Why

2.1 Google Account and OAuth Tokens

Signing in to TYR and connecting a cloud are two separate steps, and they may involve two different Google accounts.

When you sign in to TYR using your Google Account, we receive and store your Google account email address and short-lived sign-in tokens (an access token and an identity token), held by our authentication library. They expire on their own and are not renewed.

When a Google Drive is connected to your TYR account, we receive and store:

• The email address of the Google account that granted access
• An OAuth access token and refresh token for that account

Why: These tokens are required to connect to the Google Drive that was granted to TYR and perform file metadata operations (reading, renaming, tagging, starring, updating descriptions and properties), and — only when you request a preview — to stream a short preview of a file to your device (see Section 2.3).

Whose authority TYR acts with. TYR acts with the authorisation given at Google's consent screen, by whoever completed it. That need not be the account you signed in with: any TYR user may connect any Google Drive they have access to, including their own. Every change TYR makes is made as the granting account. If the connected Drive belongs to someone else, Section 12 is addressed to them.

Legal basis (GDPR Article 6(1)(b)): Processing is necessary to perform the service you have requested.

2.2 Google Drive File Metadata

To enable fast browsing, filtering, and bulk operations, TYR builds and stores an index (the Cloud Index File, or CIF) of the connected Google Drive on our servers. This index contains:

• File and folder names
• File IDs
• Folder structure and hierarchy
• File metadata (descriptions, starred status, custom properties, file types and sizes, sharing status, file counts)
• The name and email address of each file's owner, as supplied by Google Drive — including for files that other people have shared with you.

If you connect more than one Google Drive to your TYR account, each Drive gets its own separate index.

What we do NOT store: File contents, document text, images, or any binary file data. We index metadata only.

Why: The index is essential for TYR's core functionality — without it, every operation would require a live API call to Google, making bulk operations impractically slow.

Legal basis (GDPR Article 6(1)(b)): Processing is necessary to perform the service you have requested.

2.3 File Previews (On Your Request)

Bulk updates change many files at once, so TYR lets you preview a file first to make sure it is the one you mean. A preview only happens when you tap Preview on a file — it never happens automatically.

• For photos, TYR shows the small preview image that Google Drive already generates — not the full-size original.
• For video and audio, the file streams from Google Drive directly to your device, and playback stops automatically after five seconds.

Preview content goes from Google Drive to your device only. It does not pass through or get stored on our servers, we do not log it, we never share it with anyone, and we do not use it for any purpose other than showing you the preview you asked for.

Legal basis (GDPR Article 6(1)(b)): Processing is necessary to perform the service you have requested.

2.4 Google API Services — Limited Use Disclosure

TYR's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, regarding data obtained through Google Drive APIs ("Google user data"):

• We only use Google user data to provide and improve TYR's user-facing features: indexing, browsing, filtering, and bulk-updating your Google Drive file metadata, and showing you the file previews you request — all at your direction.
• We do not transfer Google user data to third parties, except as necessary to provide these features (our hosting subprocessor, Railway.app, listed in Section 6), to comply with applicable law, or as part of a merger or acquisition with prior notice to you.
• We do not use Google user data for advertising of any kind.
• We do not allow humans to read your Google user data, unless: (a) we have your explicit affirmative consent for specific data; (b) it is necessary for security purposes (such as investigating abuse); (c) it is necessary to comply with applicable law; or (d) the data has been aggregated and anonymised for internal operations.
• We do not use Google user data to develop, improve, or train generalised artificial intelligence or machine learning models

2.5 Update History

TYR stores a log of bulk update operations you perform, including:

• Which fields were updated (e.g. name, description, starred status)
• Timestamps of updates
• Success/failure counts per operation
• Encrypted record of the values applied, for rollback purposes

Why: This enables the rollback feature — allowing you to undo a bulk update if needed.

Legal basis (GDPR Article 6(1)(b)): Processing is necessary to perform the service you have requested.

2.6 Subscription and Payment Data

TYR offers paid subscription tiers, as listed in the app and the App Store, at the price shown there. If you subscribe, purchases are handled entirely by Apple via In-App Purchase. We do not receive or store your payment card details. We receive from Apple (via RevenueCat):

• Your subscription status (active, expired, cancelled)
• Your subscription tier
• The identifier your subscription is held under, which is your TYR account identifier
• A record of each subscription event we receive, including events we take no action on

We keep those event records so that we can explain how an account arrived at the tier it holds, and whether a refund has been granted before.

Why: To determine which features you are entitled to use.

Legal basis (GDPR Article 6(1)(b)): Processing is necessary to perform the contract (your subscription).

2.7 Operational Records

TYR keeps a record of notable operational events on its servers — for example a failed update job, a rate limit from Google, or a lost database connection — so that a recurring problem can be recognised and fixed.

• These records contain no identifier for you. Where an event needs to be attributed to a user at all, it carries a one-way code derived from your account identifier, which cannot be reversed and is used only to tell one person's events from another's when counting.
• Detailed event records are kept for 14 days. Daily totals, which contain no per-user information at all, are kept for 400 days.
• We use them to operate and repair the service. They are not used for advertising, profiling, or measuring individual behaviour.

We do not use third-party analytics or crash-reporting services, and TYR sends no usage data to any such service. If that changes, we will update this Policy before enabling it and, where required by law, ask for your consent.

Legal basis (GDPR Article 6(1)(f)): Our legitimate interest in keeping the service working correctly and secure.

3. How We Store and Protect Your Data 

• The durable credentials for your connected cloud — the access and refresh tokens that let TYR reach the connected Drive — are encrypted at rest on our servers. Separately, signing in to TYR creates short-lived tokens that are held by our authentication library in its own store and are not encrypted at rest. They expire on their own and are not renewed; they are not the credentials TYR uses to reach a connected cloud.
• All communication between TYR and our servers uses TLS encryption in transit.
• Our backend is hosted on Railway.app (servers in the EU — Amsterdam, Netherlands).
• The sensitive parts of your metadata index — file names, descriptions, custom properties, and owner details — are encrypted while stored on our servers, and your index is accessible only to your authenticated account.
• Preview content is never stored on our servers (see Section 2.3).
• We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. How Long We Keep Your Data 

When you delete your TYR account, deletion is scheduled immediately. The grace period is 30 days, during which you can still change your mind by signing back in and cancelling the deletion. When it has elapsed, the deletion is carried out by a process that runs once an hour, so removal follows at the next run rather than at the exact instant the 30 days end.

What is deleted, stated precisely: everything that identifies you — your account, your email address, the credentials for every connected cloud, every stored index, your update history, your saved filters, your jobs, your subscription event records, and your usage records. Anonymous records that cannot be traced back to you are kept — our operational records (Section 2.7), performance statistics about update jobs, and a record that a deletion was requested and carried out, which exists so that we can show the request was honoured. None of them contains your identity, your email address, or anything that can be reversed to reach it. Where such a record needs to tell one person's entries from another's, it holds a one-way code and no account identifier — which is precisely why the deletion record can survive the deletion it records.

5. Your Choices About Stored Indexes

You can rebuild the index of your currently connected Google Drive at any time from within the app; rebuilding replaces the stored index with a fresh one. Indexes of Drives you have previously connected remain stored (so that reconnecting is fast) until you rebuild them or delete your TYR account. Deleting your TYR account permanently removes all stored indexes.

6. Third-Party Services

TYR uses the following third-party services which may process your data:

We do not use advertising networks and TYR contains no advertisements. 

7. Data Transfers Outside the EU

Our backend servers are located in the Netherlands (EU) and your data does not leave the EU in normal operation. Google's OAuth and Drive API services are operated by Google LLC (USA); Google is certified under the EU-US Data Privacy Framework, providing adequate safeguards for this transfer.

8. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of access — You can request a copy of the personal data we hold about you.
• Right to rectification — You can ask us to correct inaccurate data.
• Right to erasure — You can ask us to delete your personal data ("right to be forgotten"). Disconnecting a cloud immediately and permanently erases the stored credentials for it. To erase everything that identifies you — including all stored metadata indexes — delete your TYR account from within the app; deletion follows the 30-day grace period described in Section 4, and what is kept afterwards is described there.
• Right to restriction — You can ask us to restrict processing of your data in certain circumstances.
• Right to data portability — You can request a copy of your data in a structured, machine-readable format by emailing tyr@fluxthoughts.com. We prepare it by hand and send it within 30 days. There is no automatic export in the app.
• Right to object — You can object to processing based on legitimate interest.
• Right to withdraw consent — Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at: tyr@fluxthoughts.com
We will respond within 30 days. You also have the right to lodge a complaint with the Danish data protection authority:
Datatilsynet
Carl Jacobsens Vej 35
2500 Valby, Denmark
www.datatilsynet.dk

9. Children's Privacy

TYR is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority (Datatilsynet) as required by GDPR Article 33 and 34, within 72 hours of becoming aware of the breach.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will email the address on your account and post a dated notice on this page, and we will update the "Last update / Effective date" at the top. Continued use of TYR after changes take effect constitutes acceptance of the updated policy.

12. If Someone Has Connected Your Google Drive to TYR

This section is addressed to you if you are the owner of a Google Drive that has been connected to TYR — whether or not you use TYR yourself. You may be reading this from the consent screen Google showed you before you granted access. It is written for you rather than about you, because you have rights over the data described here and they do not depend on having a TYR account.

What TYR holds about you

If you granted TYR access to your Google Drive, we store on our servers:

• The email address and display name of the Google account that granted access
  — yours. Both are supplied by Google when access is granted, and are shown in the app so a TYR user can see which cloud is connected.

• An index of your Drive's metadata: file and folder names, file identifiers, folder structure, descriptions, starred status, custom properties, file types and sizes, sharing status, and the name and email address of each file's owner. The sensitive parts of this — names, descriptions, custom properties and owner details — are encrypted while stored.
• Access and refresh tokens for your account, encrypted at rest, which are what let TYR reach your Drive.
• A record of the update jobs run against your Drive. The per-file detail of what was changed is kept for 90 days and then deleted (Section 4). The job record itself is not deleted on a schedule: it keeps its counts and the address of the granting Google account — yours — until the TYR account is deleted.

We do not store the contents of your files. No document text, no images, no binary file data — metadata only.

Two different things, and this is the part most easily missed

Signing in to TYR and connecting a cloud to TYR are separate acts, and they can be done by two different Google accounts.

Someone signs in to TYR with a Google account. That gives them a TYR account. It does not connect any Drive. Separately, a Google Drive is connected — and that is the grant that lets TYR read and change files. Any TYR user may connect any Google Drive they can get access to, including their own. The two accounts are often the same person. They need not be.

TYR acts with the authority of whoever completed Google's consent screen — not with the authority of whoever is signed in to the app. If you granted access to your Drive, then changes made through TYR to files in that Drive are made as you, with your permissions, and appear in Google Drive as your changes. That is how Google's delegated access works, and it is why this section exists.

Withdrawing access — you can do this yourself, and you need nobody's permission

You do not need the TYR user's cooperation, and you do not need a TYR account.

Having what we hold about you erased

Email us at tyr@fluxthoughts.com and ask. You have the same rights over this data as any other person we hold data about — access, rectification, erasure, restriction, portability and objection — and they are described in Section 8. You may exercise them directly with us; you do not have to go through the TYR user, and we will not require you to.

13. Contact

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

FluxThoughts
CVR 27665020
Denmark
Email: tyr@fluxthoughts.com

TYR - The Cloud Power Tool
Find anything. Organize everything.