Privacy Policy
Applies to: This personal Google OAuth client used with the open-source Obsidian GSync plugin.
Last updated: November 13, 2026
Purpose of access
The OAuth client permits GSync to connect to Google Drive for two-way synchronization of files in a personally selected Google Drive folder and an Obsidian vault. This may include Markdown notes, PDF documents, images, and other files selected for synchronization.
Google account information and permissions
GSync requests the Google Drive scope (https://www.googleapis.com/auth/drive). This permission grants broad Google Drive access, potentially including the ability to view, upload, change, and delete files across the account. The GSync plugin documentation says that the plugin uses this authorization to read and write files only inside the configured sync folder. The requested permission is broader than that usage restriction.
How data is used and stored
The OAuth client is intended exclusively for the account owner's personal synchronization. According to the project's documentation, GSync transfers file content directly between the user's device and Google's APIs, with no separate intermediary synchronization server. Sync metadata and the OAuth refresh token are stored in the local plugin configuration on each authorized device. Google stores the cloud copies of synchronized files.
By default, the OAuth authorization flow uses the GSync developer's static GitHub Pages callback to redirect the browser into Obsidian. That page receives the temporary authorization code in the user's browser and hands it back to Obsidian; the project's documentation says it has no server-side code and stores nothing. The callback can be self-hosted if desired.
Data sharing
This personal OAuth client does not operate a separate data-collection or analytics backend, and the site owner does not intentionally sell or disclose Google Drive content to third parties. File transfers rely on Google's services; the default OAuth callback is hosted on GitHub Pages. The policies of those service providers also apply to their services.
Retention and deletion
Synced files remain in Google Drive and on authorized devices until the account owner deletes them or removes them through the sync workflow. The account owner may revoke OAuth access at any time through their Google account's third-party access settings. Local copies of files and credentials may require separate removal from each device. Revoking access does not automatically delete files stored in Google Drive.
Security
Google sign-in uses OAuth 2.0. The plugin implements PKCE according to its published documentation. Users should secure their devices, avoid sharing refresh tokens and client secrets, and maintain independent backups. No synchronization method is a replacement for backups.
Contact and changes
For inquiries about this personal OAuth configuration, use the support email shown on the Google OAuth consent screen. This policy may be updated if the scope or data handling of this setup changes.