Privacy policy

Applies to: https://zdrive.zcloud.cz, https://drive.zcloud.cz, the zDrive apps (web, Windows, macOS, Linux, Android, iOS), the zdrive-backup tool and the API and MCP interfaces (https://mcp.drive.zcloud.cz/mcp).

The Czech version is authoritative. This English text is a translation for your information; in case of conflict the Czech version prevails.

1. Who the controller is

The controller of your personal data is Martin Zahálka, a sole trader (OSVČ), ID no. 07783809, registered address Havlíčkova 1550/54, 680 01 Boskovice, Czech Republic ("we" or "the operator"). The service is offered under the zcloud.cz brand.

Data protection contact: martin@zcloud.cz. We have not appointed a data protection officer; we do not meet the conditions of Art. 37 GDPR (we do not monitor users and do not process special categories of data).

2. Our role

• For data about your account, your devices and the operation of the service we are the controller.
• For the content of your files we decide only how it is technically stored and transferred, and we act solely on your instructions in the app (upload, sync, share, delete). We do not look into the content, with the exceptions in section 5.
• If you use the service as a business to store personal data of other people (clients, employees), we are their processor and section 12 of the Terms of Service (processing terms under Art. 28 GDPR) applies to us.
• Personal data of third parties contained in your files (for example photos of other people) is stored on your instruction. It is up to you to have the right to store and share it and, where needed, to inform those people.

3. Where the data comes from and what is mandatory

• Account data comes from you (registration, profile settings, use of the app).
• When you sign in with a ZCLOUD account (Microsoft Entra External ID, including a Google account federated through Entra) we receive your e-mail, name and the tenant and object identifiers from Microsoft.
• Recipients of your share link with write permission can add content to a shared folder; such a file becomes part of your storage.
• Mandatory data: e-mail, display name (required at registration in the app) and (for a password account) password. Without them an account cannot be created and the service cannot be provided. The profile picture URL is optional; we do not check what you enter.
• Providing the data is a contractual requirement, not a legal one.

4. What data we process, why and for how long

Everything in this table is processed because it is necessary to provide the service you contracted with us (Art. 6(1)(b) GDPR), unless stated otherwise. Legitimate interest (Art. 6(1)(f)) always means our interest in operating the service securely and in establishing and defending our rights.

The mobile app does not use push notifications today and we store no push token.

5. What we do not do, and what we do automatically

• We show no advertising and do not sell or rent your data.
• We use no analytics tools, tracking cookies or crash-reporting tools.
• We do not profile you and make no automated decisions about you (Art. 22 GDPR); no decision about your account or content is made by a machine.
• We do not use your files to train artificial intelligence or for anything other than providing the service.
• We do not look into file content. The exceptions are handling your support request, a notice of illegal content, or a legal obligation.
• Automatic technical processing of images: for every uploaded file that is an image, the server automatically reads the technical EXIF data (including GPS coordinates if the photo contains them) and generates thumbnails for the Photos feature. We do not recognise or evaluate the image content in doing so. If you do not want GPS coordinates stored, remove them from the file before uploading. You may also object to the storage of GPS coordinates; until the app has a setting for this, we handle the objection manually by deleting the coordinates stored for your photos, but they are read again for photos you upload later. We plan to make photo processing for the Photos feature an optional setting that you switch on yourself; we are not giving a date yet.
• We do no face recognition or other recognition of photo content. If we ever add such a feature it will require your separate explicit consent.

6. How long data stays stored (files, trash, versions, account deletion)

• Deleting a file moves it to the trash. You can restore it from there. The trash is not emptied automatically; you empty it yourself in the app.
• Older versions of a file are kept up to 10 per file; when a new version is created, the oldest beyond that number is removed from the version list.
• Physical deletion from storage: emptying the trash and removing a version remove the records and the data is no longer available in the service. The corresponding data blocks in object storage, thumbnails and hidden photo data are, however, not removed automatically. We remove them manually, at the latest within 30 days of emptying the trash, removing a version or deleting the account. We do not promise automation of the clean-up.
• Account deletion: self-service deletion in the app does not exist yet. Ask by e-mail from the account's address to martin@zcloud.cz. We manually remove the account, account data, devices, tokens, share links and the records of files, versions and trash within 30 days of the request. File content, versions and thumbnails in object storage are removed manually within the period stated in the previous point. Support communication remains for the period in section 4.
• Backups: The database is backed up daily; a backup is kept for at most 30 days and then overwritten. The object storage with file contents has no separate backup (no soft delete, no versioning, locally redundant storage in West Europe). Data deleted from the database therefore remains in backups for up to 30 days after deletion; file content deleted from storage is not restored from any backup.

7. Who we share data with (recipients and processors)

We share data only with parties without which the service cannot run:

We disclose data to public authorities only under a legal obligation (for example a court or police order).

8. Transfers outside the European Economic Area

Our servers and object storage run in the European Union (region West Europe). Part of the supporting processing at Microsoft and GitHub may take place in the USA. Transfers rely on European Commission Decision (EU) 2023/1795 on the EU-US Data Privacy Framework for providers certified under it (Microsoft, GitHub). For Microsoft as our processor, transfers always also rely on the Commission's standard contractual clauses (Decision (EU) 2021/914) contained in the Products and Services Data Protection Addendum. GitHub is an independent controller for the IP address and request (section 7), so we do not transfer data to it as a processor and rely only on its DPF certification. If the DPF ceased to apply, transfers to Microsoft would continue on the basis of the clauses. We provide a copy of the safeguards on request.

Apps you connect yourself (section 9) and recipients of your links may be anywhere in the world; there you transfer the data yourself, by your own decision.

9. Connected AI assistants and apps (MCP, API tokens)

zDrive lets you connect external apps, including AI assistants (e.g. Claude, ChatGPT), through the MCP (Model Context Protocol) interface and OAuth 2.1, or through a personal API token.

• What a connected app can see: you grant it either "read" (listing files and folders, search, reading file content, listing trash and versions, creating a short-lived download link) or "write" (additionally uploading, creating folders, renaming, moving, deleting to trash, restoring, restoring a version, creating and revoking share links). You see and approve the scope on the consent page before connecting.
• What a connected app cannot do: manage other connected apps and tokens, change your password or two-factor authentication; through the offered MCP tools it also cannot empty the trash. A personal API token with write scope can, however, do through the API everything your own account can, including emptying the trash.
• Where the data goes: file content the app reads is transmitted to that app's operator (for example Anthropic for Claude). That operator's terms, not this policy, govern what happens to the data there. Connect only apps you trust.
• Connected apps (OAuth): a grant expires after 180 days at the latest; an access token is valid for 1 hour. Only apps on our allow-list of clients can connect (today claude.ai and chatgpt.com).
• Personal API tokens: you create them yourself in account settings (your password is required), with a read or write scope (write is the default) and an optional expiry date; without one the token is valid until revoked. Anyone who knows the token can use it. You see the full value exactly once, when it is created.
• How to revoke access: in the zDrive app, account settings, section Connected apps, or Personal API tokens. Revocation takes effect within 15 minutes at the latest (a valid access token may still be held in the gateway's cache for that long).
• What revocation does not end: share links the app created keep working until you revoke them in the app (sharing overview) or with the revoke_share_link tool. Copies of data the app has already read remain with its operator.
• How we store tokens: personal API tokens and the access tokens, refresh tokens and authorization codes of connected apps (OAuth) are stored only as hashes (SHA-256). The download link for connected apps is a short-lived secret URL (valid for at most 15 minutes, possibly less depending on how much longer your sign-in remains valid).

10. Share links

• A link contains a random token. Anyone with the link can view and download the file or folder and, if you allowed it, also upload or delete. You can protect a link with a password and set an expiry date.
• A link recipient can also give their own AI assistant access to the content through the MCP interface; that assistant's terms apply there.
• We do not publish or index links and keep no public catalogue.
• We store no personal data about link visitors in the application database; their IP address is used only in server memory for rate limiting.
• If someone else uploads a file into your shared folder, it becomes part of your storage and you are responsible for it.

11. Cookies and local storage

The web app uses no tracking cookies and sets no cookies of its own. It stores in the browser only what the app needs to run:

• session tokens (browser local storage),
• app settings: language, theme (light/dark),
• temporary state during sign-in with a ZCLOUD account (session storage, removed when sign-in completes).

When you sign in with a ZCLOUD account we redirect you to the Microsoft Entra sign-in page (domain zcloudcz.ciamlogin.com), which uses its own essential cookies under Microsoft's rules.

The desktop and mobile apps store session tokens and the device identifier in the operating system's secure storage (Windows: a local store encrypted with Windows DPAPI, macOS Keychain, Android Keystore, iOS Keychain), plus app settings and a local index of the synced folder (an SQLite database in the app's data folder).

All of this data is necessary to run the app you requested (s. 89(3) of Act No. 127/2005 Coll.), so we need no consent for it and show no cookie banner. Language and theme are stored only because you set them yourself.

12. Security

We describe only the measures we actually use:

• Data in transit between the app and the servers is encrypted (HTTPS/TLS).
• Data in Azure object storage is encrypted by the provider at the storage level (Azure Storage encryption at rest).
• Passwords are stored as Argon2 hashes. Personal API tokens, the tokens and codes of connected apps, and password-reset links are stored only as SHA-256 hashes. The 2FA secret is stored encrypted.
• Optional two-factor authentication (TOTP) with recovery codes. Creating an API token and changing 2FA settings require your password.
• Sign-in refresh tokens rotate on every use; ZCLOUD-account sign-in expires after 24 hours at the latest.
• Rate limiting on sign-in, password reset (at most 3 e-mails per hour per account) and public share links.
• Share links use random tokens with 256 bits of entropy; when downloading through a share link in the web app the access grant travels in a header, not in the URL.
• Connected apps have separate, limited, revocable permissions; a code or refresh token used twice invalidates the whole grant; a password change invalidates all grants.

What we do not offer: zDrive is not end-to-end encrypted storage. We technically have access to your file content. We use it only at your request, when handling a notice of illegal content, or under a legal obligation. We hold no security certification (e.g. ISO 27001).

If a security breach is likely to put you at high risk, we will notify you without undue delay by e-mail to the account's address.

13. Your rights

You have the right to:

• access the data we process about you and obtain a copy,
• rectification (name and profile picture you change in the app; e-mail on request),
• erasure (account deletion, section 6),
• restriction of processing,
• data portability: you can download your files at any time in the app, via the API or with zdrive-backup; we send an export of your account data in a machine-readable format on request,
• object to processing based on legitimate interest (operational logs, rate limiting, support communication, GPS coordinates from photos),
• withdraw consent should any processing rest on consent (none does today).

Send requests to martin@zcloud.cz from your account's e-mail address; we handle them without undue delay and at the latest within one month. In complex cases we may extend this by up to two months and will let you know. If we cannot verify that the request comes from you, we may ask for additional verification.

You have the right to lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, https://www.uoou.gov.cz. We would appreciate it if you contacted us first.

14. Children

The service may be used by persons who have reached the age of 15. Processing does not rest on consent; if we add a feature requiring consent in future, for persons under 15 it will have to be given by a legal guardian (s. 7 of Act No. 110/2019 Coll.). We do not knowingly collect data of younger persons; if we learn of such an account we close it.

15. Changes to this policy

We may change this policy, for example when we add a feature or a processor. We publish the new version on this page with its effective date and, for a material change, notify you in the app or by e-mail. The policy does not require your consent; you acknowledge it. Earlier versions: sent by e-mail on request (martin@zcloud.cz).

16. Contact

Martin Zahálka, Havlíčkova 1550/54, 680 01 Boskovice, ID no. 07783809 E-mail: martin@zcloud.cz Notices of illegal content and single point of contact under the Digital Services Act: martin@zcloud.cz. We communicate in Czech and English.