In short
- Your files never pass through CloudPool. They travel between your device and your storage services. (One exception, TeraBox on the phone, is explained below.)
- You sign in with Google. CloudPool gets your name and email address from Google, nothing else, and never sees your Google password.
- Your account list is stored encrypted. The database cannot read it; the CloudPool website holds the key, so it can open the list to sign in your devices and to run the MCP server and API for you.
- Alerts and chat commands go straight from your computer to the services you set up.
- No ads, no analytics, no tracking in the apps or on this website.
Your login
You sign in with your Google account. Google tells CloudPool your email address, your name, your profile picture's address and a number that identifies your Google account. CloudPool uses them to know which login is yours and to show who is signed in; it sends you no email and shares them with no one.
Your login has two random keys: a login key that proves to the sync server it is you (the server keeps only a bcrypt hash of it), and a vault key that encrypts your list of connected accounts with AES-256-GCM. The website keeps both, encrypted with a master key of its own that the database never sees, and gives them to the devices you sign in to.
The account list holds what CloudPool needs to reach your accounts: sign-in tokens, passwords, app passwords and access keys, your Google key, the keys of your private folders, and TeraBox session cookies. The website opens it only to sign in your devices and to answer the MCP server and API calls you make with your API keys, and keeps nothing from it.
What the server keeps
The sync server is a small database run on Supabase. For each login it keeps:
| What | Readable by the server? |
|---|---|
| Your Google account | Yes: email address, name and account number. |
| Login check | A bcrypt hash of your login key, plus a count of recent wrong tries. |
| Your login's keys | No. Encrypted with the website's master key, which the database never sees. |
| Account list | No. Only the encrypted form. |
| API keys | Their names, permissions, dates and a fingerprint; never the keys themselves. |
| Share links you create | Yes: the short code, file name, size, whether it is a folder, the service's share address, when you made it, and how often it was opened. This is what the link page shows visitors. |
The database holds no phone number or device list, and never sees file contents or your file list. Like any hosted service, Supabase keeps short-lived request logs to run the database.
On your computer
- Keys and account details are stored encrypted by the system's own key store: the Keychain on Mac, Windows data protection on Windows, the keyring on Linux.
- The transfer engine (rclone) keeps its configuration encrypted with a random password that only that key store knows.
- Logs stay on your computer, with passwords and tokens hidden. They only go anywhere if you attach them to a bug report yourself.
- Besides your storage services, the sync server and any alert services you set up, the app contacts GitHub once a day to see whether a new version is out.
Your files
Uploads and downloads go directly between your computer and your storage services, using their own connections and encryption. CloudPool has no file servers and keeps no copies.
Files in a private folder are encrypted on your computer before upload, names included, so the service cannot read them. Other files are stored as they are, under each service's own terms; MEGA, for one, encrypts every file on your device as it always does. Files kept in pieces are pieces of the original bytes: anyone with access to those accounts could put them back together, just as they could open any other file there.
Share links
A CloudPool link points at a share link the storage service made for that one file or folder. The link page on this website shows the file's name, size and date and sends visitors on to the service. It sets no cookies and runs no trackers; the only thing counted is how often the link was opened.
A MEGA share address contains the file's decryption key, so anyone with the link can open that file. Stop sharing turns the CloudPool link off for everyone.
Nearby
Nearby runs only on your local network. Devices find each other with a multicast message and talk over HTTPS. Each device has its own certificate, and CloudPool checks every connection against the fingerprint the other device announced, so another machine on the network cannot pretend to be your phone. Nothing is sent through the internet, and nothing is received without your yes, except from computers signed in to your own login (you can turn that off in Settings).
Alerts and remote control
Desktop alerts stay on your computer. Email and chat alerts are sent from your computer to the services you set up: email through your own mail account's server, Slack and Discord messages through a webhook, Telegram messages through your own bot. Messages say what happened, for example which job failed or which account needs signing in again. The mail password, webhooks and bot tokens you enter stay on that computer, encrypted, and are not synced with your login.
Remote control works the same way in the other direction: CloudPool on your computer receives commands from the chats you paired with your bot and answers there, with tokens and passwords scrubbed from every reply. No CloudPool server is involved in either; those services handle the messages under their own privacy terms.
The phone app
The phone app signs in with Google too: the website hands the browser your login's two keys, and the account list is decrypted on the phone. It stays signed in by keeping those keys in the browser's storage on that phone until you sign out, so use it only on a phone you trust, and sign out on a borrowed one.
Most services are reached directly from the phone. TeraBox does not allow websites to talk to it from a browser, so the phone sends TeraBox requests through a relay on this website. The relay only accepts signed-in CloudPool users, receives the TeraBox session with each request, passes the request on, and returns the answer. It does not store sessions, files or file names, and it does not log them. Uploads to TeraBox from the phone pass through it on their way, and so do downloads from TeraBox when its storage servers refuse to talk to a phone directly.
One more case uses the relay: if a phone cannot reach Google's sign-in service at all, it renews its Google access through the relay instead. The relay passes that request to Google the same way and keeps nothing. Your Google files still go directly between the phone and Google.
TeraBox may treat requests from the relay's data centre differently from requests from your home. If it ever signs an account out, reconnect it on your computer.
This website
This site is hosted on Vercel, which keeps short-lived request logs to run the service. The site uses no cookies and no analytics. Its fonts come from Google Fonts, so your browser asks Google for them.
Installers are published as GitHub releases, and each release lists SHA-256 checksums on the download page so you can check a file before you open it.
Deleting everything
- From one computer: Settings, then Sign out. The accounts are removed from that computer and stay in your login.
- From the server: Settings, then Delete login. This erases your login, the encrypted account list and all your share links from the server. It cannot be undone.
- Your files are in your own storage accounts, and deleting CloudPool never touches them.
Questions about privacy? Ask on GitHub.