Skip to content

Privacy Policy for rclone

Last updated: 20 September 2026

Application and operator

This policy covers the application named rclone on the Google OAuth consent screen, operated by Bourke Technology. It is a personal OAuth client used with the open-source rclone software to manage the operator's own Google Drive files. 

This policy also covers information collected through bourketechnology.com. It describes this personal installation, not the data practices of the independent rclone project or other installations using that software.

Google data accessed and collected

After the account owner approves access through Google, rclone uses the Google Drive API. This integration requests https://www.googleapis.com/auth/drive, which permits access to files available to that account, excluding the separate Application Data folder. The permission is broader than an individual folder; the owner's commands and configuration determine the operations performed.

The integration accesses the following data when needed for those operations:

  • File contents: data uploaded, downloaded, copied, backed up or restored. When transferring restic backups, this includes the encrypted repository objects produced by restic.
  • File and folder metadata: names, identifiers, folder relationships, file types, sizes, timestamps, checksums and available ownership or permission information.
  • Account and storage information: account identifiers, display name or email address where returned by the Drive API, and storage usage or quota information.
  • Authorisation credentials: OAuth access and refresh tokens issued by Google so that rclone can make authorised API requests.

Google handles sign-in; this integration does not collect the Google Account password. It does not request access to Gmail, Calendar, Contacts or Google Photos.

How and why Google data is used

File content is processed to carry out transfers, backups, restores and synchronisation. Metadata is used to list and organise files, compare source and destination folders, check transfers and determine which files need to be updated. Account and quota information is used to identify the connected Drive account and report available storage. Tokens are used to authenticate the owner's commands and scheduled jobs.

Write access allows rclone to create, update, move, rename or delete files as directed by those commands and jobs. A synchronisation job can remove destination files to match its source. Google data is used only for these file-management functions.

Storage and processing

Rclone runs on an operator-managed server hosted in Oracle Cloud Infrastructure (OCI). OAuth tokens are normally saved in the rclone configuration on that server. Logs may contain filenames, paths, metadata and error details; a configured cache can contain file contents. These are stored according to the server's configuration.

Restic is used to create encrypted backup repositories. Restic handles backup encryption, while rclone provides the Google Drive connection and transfer operations. Restic is backup software running under the operator's control, not an additional hosted storage provider.

Files and backups are stored in Google Drive and the local or remote destinations chosen by the operator. The public website is an information page and does not act as a relay or storage service for rclone's Drive transfers. Selecting another cloud storage provider means that provider will receive and store the transferred files.

Sharing, transfers and human access

Google receives the requests and data needed to provide Google Drive and authorisation. Oracle Cloud Infrastructure hosts the server that processes data and stores the rclone configuration, logs and any local working files. A storage service selected by the operator receives the files and metadata needed to perform the requested transfer or backup. These providers process that information under their own terms and privacy policies, and their processing locations may be outside Australia.

We do not sell or rent Google user data. We do not disclose it to advertising platforms, data brokers or information resellers. Other disclosures are limited to those necessary for security purposes or to comply with applicable law, consistently with Google's Limited Use requirements.

The account owner can access their own files. We do not permit other people to read Google user data unless the owner expressly authorises access to specific data, or access is necessary for security purposes or to comply with applicable law.

Google API Limited Use

Our handling of information obtained through Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Google user data is not used for advertising, unrelated profiling, credit decisions or lending. Google Workspace API data is not used to develop, improve or train generalised or non-personalised AI or machine-learning models. These limits also apply to data derived from Google user data.

Retention and deletion

  • Tokens: stored token values remain in the local configuration until removed or replaced. Removing Google's authorisation invalidates access but does not erase the local configuration or its backups.
  • Files and backups: retained in Drive and selected destinations until the operator deletes them or a configured retention rule removes them. Deleting one copy does not automatically remove other copies or provider-retained versions.
  • Logs and caches: retained and cleared according to the installation's logging, cache and backup settings. The operator can remove them from the systems where they are stored.

To stop access, revoke the connection named rclone in Google Account connections and stop any associated scheduled jobs. To remove locally held data, delete the relevant rclone connection and token configuration, then remove any unwanted files, logs, caches and backup copies. Revoking access alone does not delete previously copied files.

To request access, correction or deletion of personal information held by Bourke Technology, email [email protected]. We may need to verify the requester's identity without asking for passwords or OAuth tokens. We will explain any legal reason that prevents deletion and respond within a reasonable time.

Data protection

Google OAuth and Drive API traffic uses HTTPS to encrypt information in transit. Access to the OCI server's tokens, logs, caches and files is governed by its user accounts and file permissions.

Restic encrypts backup contents and snapshot metadata in its repositories and authenticates the stored data to detect modification. Restic repository credentials are needed to decrypt the backups. This protection applies to restic backup data; it does not automatically encrypt source files, rclone OAuth tokens, the rclone configuration or diagnostic logs.

OAuth tokens and restic credentials require separate protection on the OCI server. The operator is responsible for restricting access to those credentials and keeping them out of public website content and shared logs. Rclone configuration encryption and whole-disk encryption are separate controls; this policy does not claim they are enabled merely because restic is used.

Website visitors and enquiries

If you contact us, we receive the name, email address and message you provide. If comments are enabled, the website receives the comment and submitted contact details; the comment and chosen display name may be published. Hosting and security providers may process IP addresses, browser information and request logs to operate and protect the website.

We use this information to respond to enquiries, moderate comments, investigate abuse and meet applicable legal obligations. We keep it for as long as needed for those purposes, then delete or anonymise it when it is no longer required. Published comments may remain until removed. Website service providers may process information outside Australia.

Cookies may remember comment details if you choose to save them. Embedded content from other websites may collect information under those websites' own policies. You can control cookies through your browser settings.

Changes and contact

We will update this page when our data practices change. Before accessing additional Google data or using it for a new purpose, we will notify the affected account owner and obtain any required consent. The updated date appears at the top of this policy.

For privacy enquiries or complaints, contact [email protected]. We will investigate and respond within a reasonable time. You may also contact the Office of the Australian Information Commissioner about privacy concerns.