Your accounts stay between your devices and your storage.

In short

• You sign in with Google. CloudPool never sees your Google password, and gets only your name and email address.
• The database stores ciphertext. Your list of accounts is encrypted with AES-256-GCM, and the database never holds the key that opens it.
• The CloudPool website can open it. It keeps your login's keys under a master key of its own, which is what lets a new device, the MCP server and the API reach your drives. Nothing else can.
• Files go straight to your storage. Uploads and downloads run between your computer and each service, with no CloudPool server in the middle.
• Private folders are encrypted before upload, names included, with a key that travels only inside your encrypted login.
• No ads, no analytics, no tracking in the apps or on this website.

Your login

You sign in with your Google account, on this website. Google tells CloudPool your name, your email address and a number that stays the same for your account; CloudPool never sees your Google password and asks for nothing else. The sign-in is Google's standard redirect flow, checked with a one-time state, a nonce and PKCE, and CloudPool checks Google's signature on the answer itself.

Every CloudPool login has two random keys:

The website keeps both keys encrypted (AES-256-GCM) with a master key that exists only in its own settings, never in the database. When you sign in on a new computer or phone, the website hands that device the two keys over an encrypted connection, and from then on the device encrypts and decrypts the account list itself. The desktop and Android apps get them through a one-time code that is useless without a secret only that app holds.

The account list holds what CloudPool needs to reach your accounts, such as sign-in tokens, passwords and access keys. So be clear about the trade: whoever runs the CloudPool website could open it, the same as with most online services. What that buys is sign-in with nothing to remember, and drives your AI apps and scripts can reach while your computers are off. Someone who copies the database alone gets only ciphertext.

Logins made before Sign in with Google used a username and password that made the two keys on your device. Bringing such a login over to Google, on your account page, gives it new keys and stops its password from working.

What the server keeps

The sync server is a small database on Supabase. For each login it keeps:

It never sees file contents or your file list. Deleting your login (in Settings or on your account page) erases the login, the encrypted account list, every share link and every API key from it.

MCP server and API keys

The MCP server and REST API run on this website. Each call carries an API key, either one you made or one made for an app when you pressed Allow on CloudPool's approval page (the OAuth sign-in Claude's connectors use, with PKCE, so a code caught on the way is useless); the website checks its fingerprint, opens your account list in memory to reach your storage, and writes nothing from it down. A key only does what its permissions allow, and only a key you give the secrets permission can read your account tokens. Deleting a key stops it at once.

Calls for accounts only a computer can open are passed to CloudPool on one of your computers through a queue on the sync server. Each computer makes its own random key for this; the database keeps only a hash of it, the website keeps it wrapped with its master key, and every call and answer in the queue is sealed with AES-256-GCM under it, so the database sees only ciphertext. A computer answers only while CloudPool is open there and Answer MCP and API calls is on in its Settings.

Keys on your devices

• On your computer, keys and account details are encrypted by the system's own key store: the Keychain on a Mac, DPAPI on Windows, the keyring on Linux.
• The transfer engine's configuration is encrypted with a random password that only that key store knows.
• Logs stay on your computer, with passwords and tokens hidden. They only go anywhere if you attach them to a bug report yourself.
• You stay signed in until you choose Sign out, which removes the accounts from that computer.

Your files

Uploads and downloads go directly between your computer and each storage service, over the service's own encrypted connection. CloudPool has no file servers and keeps no copies.

The phone web app reaches your services from the phone too, with one exception: TeraBox does not let websites talk to it from a browser, so TeraBox calls go through a small relay on this website. The relay only serves signed-in CloudPool users, passes each request on and returns the answer, and stores no sessions, files or file names. If a phone cannot reach Google's sign-in service, it renews its Google access through the same relay, which again keeps nothing; the files themselves still go directly between the phone and Google.

Private folders

A private folder is encrypted on your computer before anything is uploaded, using rclone crypt:

Each drive has its own private folder and its own random key, made on your computer. The service can still see how many files there are, roughly how big they are, how the folders nest, and when files change. Your other computers open the folder as usual once they are signed in. Private files cannot get share links, and the phone app cannot open them.

The key lives only in your encrypted login, so any device you sign in to opens the folder; the storage service never gets it.

App lock

With App lock on, CloudPool asks for a passcode you choose for that computer, or Touch ID on a Mac, before it shows your files, and can lock again when the computer sleeps or after you have been away. Only a scrypt hash of the passcode is kept, in the system key store, and it never leaves the computer. While it is locked, the window shows only the lock screen; syncing and transfers carry on.

Command line

The cloudpool command talks to the app through a private socket (a named pipe on Windows) that only your user account can open, and every request must carry a random key that CloudPool makes anew each time it starts. Other users on the same computer cannot drive your CloudPool.

Nearby

Nearby works only on your local network. Devices find each other with a multicast message and talk over HTTPS. Each device has its own certificate, and CloudPool checks every connection against the fingerprint the other device announced, so another machine on the network cannot pretend to be your phone. Nothing is received without your yes, except from computers signed in to your own login, and you can turn that off.

Share links

A CloudPool link points at a share link the storage service made for that one file. The link page shows the file's name, size and date and sends visitors on to the service; it sets no cookies and runs no trackers. A MEGA share address contains the file's key, so anyone with the link can open that file. Stop sharing turns the CloudPool link off for everyone.

Alerts and remote control

Alerts are sent from your computer, directly to the services you set up: your own mail server for email, a webhook for Slack or Discord, your own bot for Telegram. No CloudPool server is involved, and the messages then fall under those services' own privacy terms.

Remote control runs on your computer too, through your own bot. It answers only chats paired with a six-digit code shown in CloudPool; other chats are told the bot is private. Each chat can send at most 20 commands a minute, commands sent while CloudPool was off are not run late, replies are scrubbed of tokens and passwords, and anything that touches files on the computer is left to the command line.

The transfer engine

Transfers run on rclone, a widely used open-source tool for cloud storage (MIT license). CloudPool bundles the official rclone build for each system, checked against rclone's published SHA-256 sums, and runs it as a private process with its own password, reached only by CloudPool.

Installers

The installers are not yet signed with a paid Apple or Microsoft certificate, so your computer asks once whether to trust them. Every release lists SHA-256 checksums on the download page, so you can check that a file is exactly the one published before you open it.

Limits worth knowing

• Your Google account opens everything. Anyone who can sign in to it can reach your connected accounts, so protect it with 2-Step Verification.
• The website can open your account list. That is what makes signing in on a new device and the MCP server and API possible; it also means you trust whoever runs this website with it.
• Pieces are not encrypted by default. Files over 3.5 GB are kept as pieces of the original bytes, readable by anyone with access to those accounts. Put them in a private folder if that matters.
• The phone keeps its keys in the browser until you sign out. Use the web app on phones you trust, and sign out on borrowed ones.
• An API key is as good as the permissions on it. Give each app its own key with only what it needs, and delete keys you no longer use.
• TeraBox has no public API. CloudPool uses the same private API as the TeraBox website, which TeraBox can change at any time.

Reporting a problem

Found a security problem? Open an issue on GitHub without the details and ask for a way to share them privately. For how your data is handled more broadly, read the privacy page.