The Google integration is a native installed-app OAuth client with PKCE and no ElseKept server handling authorization. Google’s issued Desktop app credential is packaged with the client registration because its token endpoint requires it. Installed-app credentials are extractable by design and are not used as a confidential security boundary.
Permission requested
ElseKept requests exactly https://www.googleapis.com/auth/drive.appdata. Google describes this as access to the application’s own hidden storage area. The scope lets ElseKept create, list, download and delete objects it stores there. It does not provide access to unrelated Google Drive content.
What is stored
The app uploads encrypted backup objects, encrypted recovery metadata and commit markers needed to identify complete recovery points. Filenames and file contents from the protected Mac remain inside the encrypted repository format. Google receives the encrypted bytes and normal service metadata such as object sizes and request timing.
How authorization works
ElseKept opens Google’s authorization page in the user’s browser, creates a fresh PKCE challenge and receives the result through a temporary loopback address bound to this Mac. The loopback listener accepts only the matching state and closes after authorization. The app requests offline access so scheduled backups can refresh an expired access token without opening the browser again.
Access tokens, refresh tokens and expiry information are unique to each user and stored as device-only macOS Keychain items. They are not packaged in the app or stored in the backup catalog, command-line arguments, environment variables or app logs.
Removing access and data
Removing the related backup plan from ElseKept removes its local provider credentials but leaves remote encrypted backup data intact for safety. Access can be revoked from the user’s Google Account under third-party connections. Revocation prevents future uploads, health checks and recovery until the user reconnects.
To erase the encrypted Google copy, open Google Drive settings, choose Manage apps, find ElseKept and use Google’s option to delete hidden app data. Revocation alone does not erase stored objects.
ElseKept does not send application telemetry, share Google user data with advertisers or use Google data for profiling.
Policy and support
Read the privacy policy and terms of use. For authorization, recovery or deletion questions, visit support or email [email protected].