Privacy notice
This notice covers only the Aucta Store A Backup tool. It is not Aucta's general privacy policy and does not describe Aucta's customer services.
Last updated: 31 October 2026
Google data the tool uses
The operator connects the tool to the operator's own Google account. It requests one Google permission, https://www.googleapis.com/auth/drive.file. With it, the tool can create, read and delete only the folder and files it created. Other files in that Drive, including anything added to the folder by hand, are not visible to it.
During one-time setup, the operator's setup script reads the connected account's address and storage quota so the operator can confirm the right account. The tool's daily job does not use them.
The tool uses Google data only to store, verify and remove its own backup files. Aucta does not sell this data or use it for advertising. It is handled only by the service providers listed below, to run the backup, and by Aucta's operator, for authorized restore checks and recovery.
What is stored in Google Drive
Each backup set is two files, in a folder named "Aucta store A backups":
- An encrypted database export. It holds Store A's records: sequence numbers, codes for the type of record and reason, dates and times, a label for the Aucta service that wrote a checkpoint, and identifiers. Those identifiers can include the internal IDs of servers, workspaces and users, and keys built from them. They are not names or messages, but they relate to people and accounts, so this data is not anonymous.
- A summary file that is not encrypted. It holds the backup time, record counts, sequence positions, the encrypted file's name, size and checksum, the number of recovery keys, and tool versions. It holds no keys and no records.
Google also holds the information it normally keeps about stored files, such as file names, sizes, dates and account activity. Aucta does not control that information.
Encryption and keys
The export is encrypted with age before it is uploaded. It can be decrypted by the operator's offline recovery key, which the operator keeps separately from the tool. The scheduled job never receives that key, and does not upload or store it in GitHub or Drive. The operator uses it locally, on the operator's own machine, for the offline restore check.
Each run also creates a temporary key so it can test its own backup. That key is deleted before the run ends. If the offline recovery key is lost, the backups cannot be read.
Who processes the data
- GitHub runs the daily job on a temporary machine and stores the job's credentials as encrypted secrets. During a run, that machine reads Store A and briefly holds a test copy of the data in a temporary database, removed before the job finishes.
- Railway hosts Store A, and hosts this page.
- Google stores the backup files in the operator's Drive.
- Healthchecks.io receives a success or failure signal after each run, and raises an alarm if the signal stops.
- Discord delivers a fixed failure message, with a failure code and the time, to a private operations channel.
The signal and the failure message contain no records and no keys. These providers handle data under their own terms and privacy policies.
The operator may download a backup set to test, locally, that it can be restored. After the test, the operator's procedure is to delete the downloaded files and the temporary test database. The recovery key, the record of the test result and the backup set in Drive are kept.
How long backups are kept
The target is 180 days. The tool removes a backup set after that only when its daily run has succeeded, so 180 days is not a fixed limit. A set older than 180 days stays in Drive while any of these is true:
- the day's backup failed, or has not run;
- the tool cannot confirm the folder is its own;
- the folder holds a file the tool can see but does not recognise;
- there are fewer than seven complete recent backups, or the newest is more than 36 hours old.
It removes at most ten sets per run. Unfinished sets are never removed automatically; they are reported for the operator to review.
The tool removes files with Drive's permanent delete, not the trash. How and when Google then clears them from its own systems is decided by Google.
Stopping access
The operator can stop the tool at any time by turning off the daily job, or remove its access under Third-party connections in the Google account. Removing access does not delete files already in Drive. They stay in the operator's account until deleted there.
Contact
Aucta's operator: auctabot@gmail.com