Privacy Policy

Last updated: August 2, 2026

RREQUEST is a REST-client extension for Visual Studio Code, developed by Oleg Naumov (“we”, “us”). This policy explains what data the extension and its optional sync service handle, and how. Using the extension without signing in involves no data collection by us at all.

1. When this policy applies

RREQUEST works fully offline. Cloud sync — Google sign-in and Google Drive storage — is optional and inactive until you explicitly sign in with Google and enable sync for a workspace. The sections below apply only once you do.

2. Information we process

Google account basics (via the openid, email, profile scopes): your email address and Google account identifier, used to identify your account and to resolve workspace-sharing invitations sent to an email address.
Google Drive files created by the app (via the https://www.googleapis.com/auth/drive.file scope): each synced workspace is stored as a single JSON file that the app creates in your own Google Drive. This scope grants access only to files the app itself created — it cannot see or touch any other file in your Drive.
Workspace content you choose to sync: the requests, collections, folders and environment definitions in a workspace you enable sync on. Secret environment values are stripped out before syncing and are never uploaded.
A Google OAuth refresh token, needed to read/write your workspace file on your behalf. It is encrypted at rest (AES-256-GCM) before storage.

3. Where data is stored

Your workspace content lives in your own Google Drive, in files the app created.
Account metadata and the encrypted refresh token are stored in our backend on Amazon Web Services (Amazon DynamoDB, region eu-west-1, Ireland). We store your email, Google account id, the encrypted refresh token, and per-workspace metadata (id, name, Drive file id, revision, sharing memberships).
Your session token (a signed app token, valid ~30 days) is kept locally on your machine in the VS Code Secret Storage. It is never shared.

4. How we use it

Solely to provide the features you request: authenticating you, syncing your workspace file to/from your Google Drive, and letting you share a workspace with people you explicitly invite.
We do not sell your data, use it for advertising, or use it to build user profiles.
We do not use your Google user data for training generalized AI/ML models.

5. Sharing with others

A workspace is private to you until you invite someone. When you add a member (editor or viewer), we grant the corresponding Google Drive permission on that workspace's file and record the membership so the invited person can access it. You can remove a member at any time.

Google API Services — Limited Use disclosure. RREQUEST's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only access the Google user data needed to provide the sync features described here, only use it to provide and improve those features, do not transfer it to others except as needed to provide the service or as required by law, and do not use it for advertising or to train generalized AI/ML models.

6. Retention & deletion

Stop syncing / delete a workspace from within the extension: the workspace's Drive file is moved to your Drive trash and its server-side rows are removed.
Sign out to remove the local session token from your machine.
Revoke access entirely at myaccount.google.com/permissions — this invalidates the stored refresh token.
To request deletion of your account data from our backend, contact us at the address below.

7. Security

The refresh token is encrypted at rest; secret environment values are never uploaded; all traffic to the backend and to Google is over HTTPS. No method of storage or transmission is 100% secure, but we take reasonable measures to protect your data.

8. Children

RREQUEST is not directed to children under 13 and we do not knowingly collect their data.

9. Changes

We may update this policy; material changes will be reflected by the “Last updated” date above.

10. Contact

Questions or data-deletion requests: keeperoleg26@gmail.com.