Data and access

Who handles the data

Lnk2Drv is the Telegram bot @lnk2drv_bot and the site lnk2drv.com; the service is run by the owner of the lnk2drv.com domain. Questions about data, requests to erase your history and requests for the source code — by message to the bot.

What the bot receives and why

Telegram identifier and username

To tell your uploads apart from other people’s and to answer in the same chat. Nothing else.

Access token (OAuth) for your cloud

To put files into your Google Drive or Yandex Disk on your behalf. The bot never sees your account password: you type it on Google’s or Yandex’s page. The token is stored encrypted, and the encryption key is kept apart from the database.

Upload history

File name, size, date, the file’s Telegram identifier (that is how the bot spots a repeat send), the link and the file’s identifier in your cloud. These are needed for the /my command, the “Delete” button, and to keep the same file from being uploaded twice. File contents are not stored along with them.

The files themselves

They pass through in transit: Telegram → the bot’s server → your cloud. The copy on the server is deleted as soon as the upload finishes. The bot does not read file contents, does not index them and does not pass them to anyone.

What the bot will not do, on principle

• It does not keep your files and has no file storage of its own.
• It does not read or change anything that was already in your cloud. In Google Drive this is enforced by the drive.file scope: an app can reach only the files it created itself. On Yandex Disk the bot works strictly inside the /Lnk2Drv folder.
• It does not sell data and shows no advertising. The only place your files ever go is the cloud you connected yourself: Google or Yandex, using your access token.
• It does not use your files to train models of any kind.

How long all of this is kept

The access token — until you disconnect the cloud: /accounts → “Disconnect” erases the token from the database and sends the provider a request to revoke it. History rows live longer: deleting a file through /my marks the row as deleted, and disconnecting an account does not erase the history — to have it removed entirely, write to the bot and we will delete it on request. The files themselves stay with you: they are your files in your cloud.

How to revoke access

1. In the bot: /accounts → “Disconnect”. The token is deleted here and revoked at the provider.
2. From Google’s side: the “Third-party apps with account access” page in your Google security settings.
3. From Yandex’s side: the “Apps” section in Yandex ID.

Any one of the three is enough. Once access is revoked, the bot can neither add a file nor delete one — managing the files is left entirely to you.

How public the links are

The link the bot returns is ordinary link sharing in your cloud: anyone who has the link can open the file. Links have no password and no expiry date yet. To stop access, delete the file through /my or in the cloud itself.

Cookies and analytics

The site sets no cookies and loads no third-party trackers: fonts, styles, scripts and video all sit on lnk2drv.com itself. The “turn off motion” setting is kept in your browser’s localStorage and is never sent anywhere.

Your own instance

If you would rather not trust someone else’s server, run your own copy: then the tokens, the database and the files in transit all stay entirely with you. You will need a server with a domain and your own OAuth apps at Google and Yandex. We hand over the source code on request — write to the bot.