Privacy Policy
This policy explains how LotusIR handles information on lotusir.net, including the public OurNest application information page, and describes the intended data practices for its planned private Google Drive album. The live website currently serves static pages only: the OurNest application and Google Drive connection are not deployed here. These public pages do not offer account registration, payments, file uploads or forms for submitting personal information.
1. Information we process
When you visit the website, the server automatically generates access or error logs. These may include IP addresses, access times, requested URLs and query parameters, HTTP status codes, referring pages, and User-Agent information sent by your browser or device. We use this information to deliver pages, troubleshoot problems and maintain website security. Please do not include passwords, tokens or other sensitive information in URLs or query parameters.
If you contact us by email, we receive your email address, message and any other information you choose to provide. We use that information to handle your inquiry and related communications. Please provide only the information necessary to address your question.
OurNest and Google user data
OurNest is a private virtual home designed for two designated participants. Its prototype includes character activities, nicknames, digital gifts and postcards. A Google Drive photo album is planned, but has not yet been implemented or enabled on this website. No Google authorization or Google account data collection occurs simply by visiting these public pages.
Planned access and purpose
With explicit authorization from one participant's Google account, the album would read photos from a configured Drive album folder and its photo-collection subfolders. Relevant data includes photo contents, file and folder IDs and names, descriptions, image dimensions, capture or creation dates, and modification information. It would use these data to organize collections, generate thumbnails and display photos to the two participants.
OAuth permissions and their limits
The intended initial album release requests https://www.googleapis.com/auth/drive.readonly. This permission can read and download files throughout the authorizing account's Drive; Google does not limit it to a single folder. The planned implementation would restrict album queries and media access to the configured root folder and its photo collections. This would be an application-level restriction. The initial album release would not create, edit or delete Drive files.
The narrower https://www.googleapis.com/auth/drive.file permission can allow access to files created by the app or explicitly selected for it, including writing those files. It does not grant read access to all existing Drive photos. A future upload feature could use this permission for app-created or explicitly selected files. Uploading and creating collections are not currently enabled. This policy and the authorization notice will be updated before changes to data access or functionality are enabled. Neither described scope authorizes access to Gmail, Calendar or Contacts.
Planned storage and retention
The design keeps Google access and refresh tokens in restricted server-side storage, outside browser code and public assets. Folder and photo metadata would be cached on the server, together with processed thumbnails and display images. Original photos would remain in Google Drive. The design calls for removing embedded metadata, including GPS information, from re-encoded display images; capture dates used for album organization may still be retained separately. Original photos would not be publicly published by OurNest. A temporary download may be needed to generate display images.
Connection credentials would be retained while the connection is in use. Album indexes and processed media would be retained only to support the album and subject to cache limits. The planned media cache limit is 2 GB, with least-recently-used eviction. Exact live retention and deletion behavior must be disclosed before the integration launches; the website's 14-file log rotation schedule does not apply to these app data or to Google Drive originals.
Sharing and permitted use
Album photos and their descriptions would be visible to both designated OurNest participants. Authorizing the shared album therefore means permitting those participants to view its contents. The server hosting and network providers may process data necessary to deliver the service. Google data will not be sold, used for advertising, credit or lending decisions, or used to train generalized AI or machine-learning models. Human access will be limited to the permitted circumstances in Google's policy, such as your affirmative agreement for specific content, necessary security investigation, legal obligations or appropriately aggregated internal operations.
OurNest's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
Revocation and deletion
You can revoke an authorized connection through Google Account connections. Revocation stops future authorized access but does not by itself erase previously cached copies. Contact [email protected] to request disconnection and deletion of stored tokens, album metadata and cached images. Deleting app-side copies does not delete your original Drive files. You can manage or delete originals directly in Google Drive.
Private application data
When deployed, the private app would also store participant nicknames, character activity states, gift and postcard messages, gift-opening information, and related timestamps on the server. Intended sharing is between the two designated participants, with access controlled by private entry links and session credentials. Private links must not be published or included in support messages. Application content would be retained to provide the private home until it is removed or a deletion request is fulfilled, subject to applicable legal obligations. The app uses a necessary nest_session cookie with a maximum lifetime of 30 days; this cookie is not set by the current static information pages.
2. How we use information
- To deliver website content and keep the website working;
- To identify unusual traffic, prevent abuse and troubleshoot technical issues;
- To respond to inquiries and privacy requests you initiate;
- To meet obligations where required by applicable law.
Where applicable law requires a legal basis for processing, we rely, as appropriate, on our legitimate interests in operating and securing the website, applicable legal obligations, or your consent where required. We do not use the current website's access logs for advertising profiles or automated decisions with significant effects.
4. Service providers and disclosure
The website is hosted by OVHcloud. Cloudflare provides domain registration, DNS, website proxy and related security services. Cloudflare receives website requests and may process IP addresses, requested URLs, device and browser information, and security event data. Our contact email is provided by Gmail. These providers may process technical or communication data as necessary to provide their services. Their own processing is also governed by their respective privacy policies.
We do not sell or rent personal information received through the current website. We disclose information only as necessary to provide services, handle your requests, protect the website and others, or comply with applicable law.
External websites and services have their own privacy policies. This policy does not cover services those third parties provide independently. Relevant infrastructure may be located outside your country or region.
5. How long we retain information
The website server logs are configured to rotate daily and retain 14 historical log files plus the current log. Actual retention may vary depending on whether logs are generated and when rotation runs. Where a security incident or applicable law requires particular records to be preserved, retention will be based on the time needed to address that incident or obligation.
This rotation schedule applies only to our website server logs. It does not mean that information independently processed by Cloudflare, OVHcloud or Gmail has the same retention period; their retention depends on the relevant service policies and actual configuration.
Emails you send are retained for the time needed to address your inquiry, necessary follow-up communications or applicable legal obligations. You may request deletion using the email address below.
6. Security
The website uses HTTPS to encrypt information in transit and server access controls to protect its systems. No internet transmission or information storage can be guaranteed completely secure. Please avoid sending unnecessary sensitive information by email.
7. Your choices and rights
Depending on the laws that apply where you live, you may have rights to request access to, correction or deletion of your personal information; restrict or object to certain processing; and, where applicable, request data portability or withdraw consent. Withdrawing consent does not affect processing based on consent before withdrawal. You may also have the right to complain to your local data protection authority.
To make a request, email [email protected] with details of your request and the approximate time of a relevant visit or the context of your email exchange. We may need to take proportionate steps to verify your identity. Please do not send identity documents or passwords in your initial message. Some access logs cannot be reliably associated with a particular person; we will handle requests based on the information we can actually identify.
8. Children
The current website does not provide accounts or information-collection forms directed at children. If you believe a child has emailed us information that should not be retained, please contact us so we can address it.
9. Scope and updates
This policy covers the current public website and the explicitly described intended OurNest practices. Planned features are identified as planned and do not imply that Google data is already being collected. Before deploying the app or enabling its Google integration, we will update this policy to reflect verified live behavior, including actual permissions, retention, security and deletion arrangements. Other services are not automatically covered. Updated versions and dates will appear here, with further notice of material changes as required by applicable rules.
10. Contact us
Website name: LotusIR
Website: lotusir.net
Privacy contact: [email protected]