What Mastrly does with your data.

at a glance

In one paragraph

When you sign in with Dropbox or Google, Mastrly receives a per-folder OAuth token from the chosen provider — on Google this is the drive.file + drive.appdata pair; on Dropbox it’s the App-folder scope set described below. Either way Mastrly is granted access only to a single workspace folder (/mastrly on Google, or /Apps/mastrly/ on Dropbox) plus a small per-app configuration store. Tokens stay in your browser’s localStorage. Mastrly does not run servers that store your masters, your tokens, or your activity. It does not use analytics, advertising, or third-party trackers. The only third parties involved are Dropbox or Google (where your data lives) and your chosen static web host (which serves the Mastrly bundle).

data accessed

What Dropbox or Google data Mastrly accesses

The exact OAuth scopes Mastrly requests depend on which storage provider you sign in with. Both providers’ scope sets are deliberately scoped to a single workspace + a hidden per-app sandbox; neither triggers a sensitive-scope security review.

Google Drive scopes

• https://www.googleapis.com/auth/drive.file — per-file access to a single workspace folder.
• https://www.googleapis.com/auth/drive.appdata — access to a hidden per-app sandbox that only Mastrly can see.

Dropbox scopes

Mastrly is registered as a Dropbox App folder app, which automatically sandboxes every read/write to a single folder named /Apps/mastrly/ inside your Dropbox. On top of that scoping, Mastrly requests:

• files.metadata.read — list folders.
• files.metadata.write — create / rename / move folders & files.
• files.content.read — download audio masters for playback & preview.
• files.content.write — upload audio masters into the workspace.
• sharing.read — read existing public share links.
• sharing.write — create and revoke public share links for listener manifests.
• account_info.read — basic profile (display name + email) for the “signed in as” label.

Together these grant Mastrly access only to:

• A single workspace folder — /mastrly at the top of your Google Drive, or /Apps/mastrly/ inside your Dropbox. Mastrly creates this folder during first-time setup; if you already have one from a previous install, Mastrly attaches to it instead. Mastrly can read, list, and modify the files and sub-folders inside that workspace.
• A hidden per-app sandbox where Mastrly stores a pointer to your workspace folder and a small JSON file describing your clients and projects. On Google Drive this is the appDataFolder (invisible in your Drive UI). On Dropbox there is no equivalent sandbox, so Mastrly puts the same JSON inside a conventionally-hidden subfolder named /.mastrly-private/ inside the App folder; it is visible to you but is scoped to Mastrly.

Mastrly cannot see, list, read, or modify any other file in your Dropbox or Google Drive. It cannot access your email, contacts, calendar, profile photo, or any other service the provider offers.

During sign-in, Dropbox or Google also returns your basic profile identifier and refresh-token metadata. These stay in your browser’s localStorage and are never transmitted to any Mastrly-controlled server.

how it’s used

How that data is used

Mastrly uses the Dropbox or Google Drive access for exactly the following:

• Reading masters you have placed in the workspace folder, so they can be played in the in-browser audition player.
• Listing folders and files in the workspace so the app can show your clients and projects.
• Writing metadata into the per-app sandbox (Google’s appDataFolder, or Dropbox’s /.mastrly-private/ subfolder) — small JSON files describing your clients and projects, plus a pointer to your workspace folder so Mastrly can find it again on another device.
• Writing share manifests into a _shares/ folder inside your workspace — small JSON files that public listener links resolve against. (These have to live in the workspace, not the hidden sandbox, because listener browsers fetch them by public URL.)
• Polling the provider’s change feed (Drive’s changes.list or Dropbox’s list_folder/continue cursor) so renames or deletes you make directly in your storage show up in Mastrly within ~30 seconds.
• Playing audio directly from your storage to your client’s browser when they open a share link.

Mastrly does not use your data for advertising, analytics, machine-learning training, or to build a profile of you. It does not sell, rent, or otherwise transfer your data to any third party. It does not aggregate data across users — there is no “across users” because there is no central database.

storage & retention

Where data is stored, and for how long

• Your masters and project files live in your own Dropbox or Google Drive — in the /mastrly workspace folder on Google, or /Apps/mastrly/ on Dropbox — that Mastrly created during setup. They are subject to your storage provider’s storage and retention policy, not Mastrly’s. You can move, copy, rename, or delete any of them in the provider’s own UI at any time.
• OAuth tokens (access + refresh) are stored in your browser’s localStorage on the origin where Mastrly runs (e.g. masters.yourstudio.com or mastrly.cloud). They are never transmitted to any Mastrly-operated server. Clearing your browser data removes them.
• Local app state (your last-viewed project, theme choice, prefetch cache for fast playback) is stored in localStorage and IndexedDB on the origin where Mastrly runs. It is local-only and can be cleared from your browser at any time.
• Share links point at items in your Dropbox or Google Drive that you have explicitly shared through the provider. To revoke, delete the corresponding share record inside Mastrly — the link stops working immediately.

Mastrly itself retains nothing about you on any server it controls. There is no “Mastrly account” to delete.

sign-in flow

The auth.mastrly.cloud redirect

When you sign in with Dropbox or Google, the OAuth flow redirects through a static page at https://auth.mastrly.cloud/. This is a stateless callback — it has no server-side logic, no database, and runs entirely in your browser. Its only job is to forward the OAuth response back to whichever licensed Mastrly origin started the flow.

The callback verifies the originating origin against a public allow-list of licensed deployments. It does not see, store, or transmit your tokens; the OAuth code travels through the URL fragment and is consumed by your originating Mastrly instance, not by auth.mastrly.cloud.

third parties

Who else is involved

• Google — OAuth provider and storage host when you sign in with a Google account. Subject to Google’s privacy policy.
• Dropbox — OAuth provider and storage host when you sign in with a Dropbox account. Subject to Dropbox’s privacy policy.
• Your chosen static web host (Cloudflare Pages, Netlify, your own server, etc.) — serves the Mastrly bundle and may keep request logs. Subject to that host’s privacy policy.

Mastrly does not embed Google Analytics, Meta Pixel, Hotjar, Segment, Mixpanel, Sentry, or any other analytics, advertising, or telemetry SDK.

cookies

Cookies

Mastrly does not set cookies. State is held in localStorage and IndexedDB in your browser. Dropbox or Google may set its own cookies on its own domains during sign-in; those are governed by Dropbox or Google’s privacy policy.

children

Use by children

Mastrly is a professional tool for mix and mastering studios. It is not directed at children under 13 (or 16 in jurisdictions that apply that threshold), and it does not knowingly collect data from them.

your rights

Your rights

Because Mastrly does not hold your data on a server it controls, most data-subject rights resolve in your own Dropbox or Google Drive and in your browser:

• Access / portability: your masters are already in your Dropbox or Google Drive in their original formats — nothing to export.
• Erasure: delete the files in your Dropbox or Google Drive, or delete the workspace folder (/mastrly on Google, /Apps/mastrly/ on Dropbox); Mastrly stops being able to see them. Revoking Mastrly’s access at the provider also clears the hidden per-app sandbox. Clearing browser data on the Mastrly origin removes the token and local cache.
• Revoke access: for Google Drive, visit myaccount.google.com/permissions and remove Mastrly; for Dropbox, visit dropbox.com/account/connected_apps and unlink Mastrly. The OAuth token is invalidated immediately.
• Complaint: UK residents can complain to the Information Commissioner’s Office (ico.org.uk).

changes

Changes to this policy

When this policy changes materially, the effective date at the top will be updated and a note will appear on the Mastrly home page for at least thirty days.

contact

Contact

Mastrly is operated by Mark Hammond, a sole trader based in the United Kingdom. Privacy questions, data requests, and policy questions: hello@mastrly.cloud.