Privacy Policy
Last Updated: October 14, 2026
1. Introduction
Fuze Storage ("Fuze", "we", "us", or "our") is an open-source multi-cloud storage aggregator designed to empower users to unify their personal free cloud storage quotas into a single virtual drive. We support integration with multiple third-party storage providers, including Google Drive, Microsoft OneDrive, Dropbox, Box, and pCloud, as well as community-authored open-source connectors.
Zero-Proxy Architecture Guarantee (All Providers)
Fuze employs a client-side streaming architecture. Your files, documents, photos, and video data stream directly between your web browser and the connected cloud storage providers. Fuze servers never proxy, download, inspect, or store your raw file contents. All chunking, reassembly, and Merkle root cryptographic integrity checks occur locally within your browser.
2. Information We Collect
- Account Credentials: When you register an account with Fuze, we collect your email address and an Argon2id-hashed representation of your password.
- OAuth 2.0 Access & Refresh Tokens: When you link your cloud accounts, we store securely encrypted OAuth 2.0 credentials using AES-256 encryption at rest. These tokens are used solely to authenticate API requests to manage files and retrieve storage quota information on your behalf.
- Virtual File Metadata: We store virtual file system metadata (file names, sizes, MIME types, folder paths, and provider chunk maps) in our PostgreSQL database to render your virtual folder directory inside the application.
3. Third-Party Cloud Providers & Platform Compliance
Fuze connects to multiple storage backends via their official REST APIs. Below is the breakdown of how each provider's data is handled:
3.1 Google Drive & Google API Services User Data Policy
Fuze's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:
- Scope Requested: We only request
https://www.googleapis.com/auth/drive.file. This non-sensitive scope limits Fuze to only reading, modifying, and deleting files that Fuze itself created or that you explicitly open with Fuze. We never access your other Google Drive files. - No Third-Party Sharing: Google user data is never shared, sold, or transferred to third parties or advertising platforms.
- No AI Model Training: Google user data is never used to train generalized machine learning or artificial intelligence models.
3.2 Microsoft OneDrive (Microsoft Graph API)
Fuze requests standard delegated scopes (Files.ReadWrite and offline_access) through the Microsoft identity platform to upload and retrieve file chunks and monitor quota consumption. Microsoft user data is never shared or inspected.
3.3 Dropbox (Dropbox API v2)
Fuze interacts with Dropbox using OAuth 2.0 PKCE / token authorization (files.content.write, files.content.read, and files.metadata.read) to manage dedicated storage chunks.
3.4 Box (Box Platform API)
Fuze uses Box OAuth 2.0 User Authentication with read and write permissions on Box folders. All file transfers occur over direct client upload sessions.
3.5 pCloud (pCloud REST API)
Fuze connects to pCloud via its global and European endpoints using OAuth 2.0 to stream chunks directly to your authenticated pCloud storage drive.
3.6 Community & Future Storage Connectors
All upcoming and community-built connectors (e.g. Mega, MediaFire, Nextcloud, WebDAV, Proton Drive) must adhere to our strict zero-proxy architecture and open-source audit standards.
4. User Rights, Token Revocation & Data Deletion
You retain complete ownership and control of your accounts and stored files:
- One-Click Disconnection: You can disconnect any cloud provider at any time from your Fuze Settings dashboard. Disconnecting a provider immediately purges all associated encrypted access and refresh tokens from our database.
- Provider-Side Revocation: You can revoke Fuze's API access directly from each provider's security portal:
- Account Deletion: If you delete your Fuze account, all user profile records, encrypted tokens, and file metadata are permanently destroyed.
5. Contact Us
If you have questions regarding this Privacy Policy, your connected cloud providers, or data handling, please reach out to the project maintainer: