This policy describes FF Drive, the private publishing tool operated by Ferrous Few. It covers the Google Drive connection used to distribute community design files and these public information pages.
Data the tool accesses
When the operator authorizes a Google account, FF Drive receives OAuth credentials that allow it to access Google Drive. The requested Drive scope permits broader access to that account’s Drive files. The publishing workflow is configured to operate on one designated staff folder; this folder setting is not a restriction on the OAuth token itself.
During publishing, the tool processes design files selected from the repository and destination file information, including names, folder paths, identifiers, sizes, modification times, and checksums. It checks destination file content when needed to verify a transfer. It does not request Gmail, Calendar, or Contacts access.
How data is used
Data is used to upload design files, update matching destination files, avoid unnecessary transfers, verify published copies, and diagnose publishing errors. GitHub Actions logs may contain filenames, paths, transfer statistics, errors, and source commit identifiers. Credentials are not intentionally written to logs or committed to the repository.
Google user data accessed through this connection is not sold, used for advertising, or used to train AI models. FF Drive’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
Storage and service providers
Source artwork and project history are stored in the private Ferrous Few GitHub repository. Published copies are stored in Google Drive. Publishing runs on GitHub Actions runners using rclone, which communicates with Google’s APIs.
The dedicated OAuth connection is stored in the operator’s local rclone configuration. Credentials used by the automated workflow are stored as GitHub Actions repository secrets and supplied to the publishing process at runtime. The operator is responsible for restricting access to the local configuration and repository settings.
Google and GitHub process data as part of providing their respective services. These public pages are initially hosted by Fastmail; the hosting provider may process standard web request information under its own policies. The pages contain no analytics scripts, advertising, tracking pixels, forms, or application-set cookies.
Who can access published files
Published design files follow the existing permissions of the designated staff folder. The workflow does not make them public or change sharing settings. Authorized staff and repository administrators may access data according to their assigned permissions.
Retention and deletion
Repository history and published Drive files are retained until the operator removes them. The publishing workflow does not automatically delete destination-only files, so a file removed from the repository can remain in Drive. Workflow logs follow the repository’s GitHub Actions retention settings.
OAuth credentials are retained until they are removed or replaced, or their authorization expires or is revoked. Contact the operator to request removal of published files or locally stored credentials.
Revoke Google access
You can revoke FF Drive’s access through your Google Account’s third-party connections. Revoking access prevents further use of that authorization but does not delete existing repository files, published Drive copies, or workflow logs. The operator can also disable the workflow and remove its GitHub secrets and local rclone connection.
Contact and changes
For access, privacy, or deletion questions, contact ferrous-few@cloudaspect.dev. If the tool’s data handling changes, this policy will be updated with a new effective date.