PolyDrive Privacy Policy
Last updated: September 4, 2026
PolyDrive is a macOS utility that mounts your own cloud storage and network accounts as Finder locations, and mounts local ext2/ext3/ext4 disk images and block devices as read-only Finder volumes. This policy explains what PolyDrive does and does not do with your data.
Summary
PolyDrive does not operate any server, does not collect analytics or telemetry, and does not have an account system of its own. Every drive you add belongs to you — PolyDrive connects directly, on your Mac, between Finder/File Provider and the storage provider you chose. We (the developer) never see your files, your credentials, or any record of your activity.
What PolyDrive stores, and where
| Data | Where it's stored | Ever leaves your Mac? |
|---|---|---|
| Server/endpoint, bucket, account, and other connection settings you enter when adding a drive | macOS Keychain (app's own access group) | No |
| Access keys / secret keys (S3-compatible and vendor object-storage drives) | macOS Keychain | Sent only to the storage endpoint you configured, to authenticate your own requests |
| OAuth access and refresh tokens (Dropbox, OneDrive, Google Drive, Box) | macOS Keychain | Sent only to that provider's own API, to authenticate your own requests |
| File contents and directory listings | Not stored by PolyDrive at all — streamed on demand between Finder/File Provider and the provider's API | Goes directly to/from the provider you chose |
| App preferences (e.g. "open at login", last connection-check result) | macOS UserDefaults |
No |
| Activity log — what PolyDrive did, including the names of files and folders a transfer failed on | A file in the app's own container | No, unless you export it yourself |
PolyDrive never stores your access keys or secrets in UserDefaults,
config files, or logs — only in the Keychain.
The activity log
PolyDrive keeps a record of what it has done — drives connecting, folders refreshing, shares mounting, transfers finishing or failing — which you can read in its Activity window. It has to name files to be useful: an upload that failed is only worth reporting if it says which file failed.
That record stays on your Mac. It is never sent anywhere, never uploaded to us, and never included in any automatic report; there is no automatic report. It holds the most recent few thousand entries and discards older ones. "Export…" writes it to a file you choose, and "Clear…" deletes it. Credentials are never written to it — only to the Keychain.
OAuth sign-in (Dropbox, OneDrive, Google Drive, Box)
When you add one of these drives, PolyDrive opens the provider's own sign-in
page via macOS's ASWebAuthenticationSession (a system-provided,
sandboxed browser view — PolyDrive's code never sees your password). After
you approve access, the provider redirects an authorization code back to
PolyDrive, which exchanges it for an access/refresh token pair directly with
that provider's servers, using the industry-standard OAuth 2.0
Authorization Code + PKCE flow. Tokens are stored in the Keychain and are
used only to make API calls to that same provider on your behalf.
PolyDrive does not run any backend service and is not a party to your session with the provider beyond performing this handshake locally on your Mac.
Google user data. PolyDrive's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Information from your Google Drive is used only to show and transfer your files in Finder at your request. It is stored only on your Mac, in that drive's local cache and in the Keychain. It is never sent to PolyDrive (there is no PolyDrive server), never sold, never used for advertising, never shared with any third party, and never read by a person. It reaches another app only when you yourself open or copy a file.
Local disks
Mounting a local ext2/ext3/ext4 disk image or block device involves no network activity and no data described above — PolyDrive reads the device you select directly.
Network access
PolyDrive is sandboxed (App Sandbox). It uses network access only to:
- Talk to the storage endpoint(s) you configure (S3-compatible services, WebDAV/FTP/Seafile servers, or the OAuth providers listed above).
- Run a local loopback (
127.0.0.1) HTTP listener during OAuth sign-in for providers that require a localhost redirect URI (OneDrive). This listener only accepts the one redirect from the sign-in browser window and is not reachable from outside your Mac.
PolyDrive uses cryptography in three places, and all of it is standard and published (NIST, IETF) — nothing proprietary. First, the transport layer: TLS for HTTPS connections to your providers (provided by macOS for OAuth sign-in and by an open-source library inside the app for storage connections) and SSH for SFTP, used solely to authenticate and secure your own connections. Second, Cryptomator vaults: the app implements the published Cryptomator vault format (scrypt, AES-SIV, AES-GCM, AES-CTR) so that a vault you already have can be read and written in Finder. Third, the MEGA protocol, which is end-to-end encrypted by design. Keys and vault passwords are generated and held only by you and stored only on your Mac, in the Keychain. PolyDrive has no access to them or to your decrypted data, and there is no key escrow or recovery mechanism: a lost vault password cannot be recovered by us or by anyone else.
Third parties
PolyDrive itself does not share data with any third party. When you connect a drive, your credentials and file requests go directly to the storage provider you chose, subject to that provider's own privacy policy and terms of service — we recommend reviewing those separately.
PolyDrive includes no analytics, advertising, or crash-reporting SDKs.
Children's privacy
PolyDrive is a general-purpose file-management utility not directed at children and does not knowingly collect data from children.
Changes to this policy
If PolyDrive's data handling changes (for example, a future update adds optional crash reporting), this document will be updated and the "Last updated" date above will change accordingly.
Contact
Questions about this policy: [email protected]