1. We never see your files
The scan runs on your computer. What it sends us is a catalogue: file names, paths, sizes, dates, types, and a fingerprint of each file's contents. Not the contents.
A fingerprint is a one-way hash. It lets us tell that two files are identical without holding either one, and it cannot be turned back into a file. There is no feature that uploads, stores or backs up your files, and no code path that reads a file's bytes to the network.
Honest caveat, because it matters: file names and folder paths can themselves be revealing. If that is a problem for a particular drive, scan it without linking the agent to an account — the local report works exactly the same.
2. Nothing is ever deleted
A cleanup does not delete. It moves duplicates into a folder called _SiftDrive_Quarantine on the same drive, keeping their original paths inside it. Your disk still holds every byte it held before; it is just arranged so you can look at what would go.
Emptying that folder is your own separate act, whenever you are satisfied. And if you are not: siftdrive undo puts everything back where it was.
3. An interrupted cleanup is still reversible
Before each file moves, the agent writes down what it is about to do and flushes that record to disk. So a cleanup interrupted by a crash, a power cut or an unplugged cable is still a cleanup that can be undone — the journal knows what had happened and what had not.
Each file is also re-checked immediately before it moves, and skipped if anything about it changed since the plan was made. And there are places a cleanup refuses to touch at all: inside application bundles and system directories, duplication is how software is built rather than waste, and reclaiming a few megabytes by breaking an installed program is not a trade anyone asked for.
4. We do not promise numbers we cannot verify
Duplicates are matched by comparing contents, not names. Hard links are counted as the single file they are — an early version counted them as separate copies and overstated one test drive's reclaimable space by a factor of forty.
On filesystems that support copy-on-write clones, including APFS on modern Macs, two identical files may already share the same storage, so removing one frees nothing — and no software can reliably tell after the fact. Where that applies the report says space is recoverable at most. Where it does not — most external drives, memory cards and USB sticks — the figure is exact.
A managed migration is different, on purpose
Everything above describes Drives, which runs on your computer. A managed migration is the opposite arrangement by design: you authorize us to reach into a service on your behalf, and moving the data is the product. We hold a working copy while the job runs, and it is destroyed within 30 days of handover, or sooner if you ask.
What that means depends on the job. An Airtable migration exports every record and every attachment, uploads the attachments into your Google Drive, and — only if you asked for it — loads the records into your BigQuery or Postgres. A Dropbox migration moves the files into your Google Shared Drive, and every image is sent to Anthropic to be described so that it can be tagged; those images are not used to train anything. That is a third party seeing your pictures, and it is the reason this paragraph exists rather than a footnote.
Offboard goes further than either, and it is said here in full. It reads a departing person's mailbox, calendar, contacts, Drive file list and groups from your Google Workspace, through a delegation you grant in your own Admin console — and a delegation can act as any user in your domain for the permissions granted, which is why every one of them is read-only, apart from the two the optional mail copy needs to add messages, and why you should delete it the day the brief is delivered. The text of each business thread is sent to Anthropic to find commitments, dates and contacts; threads that look privileged or personal are withheld before any model reads anything, and nothing sent is used to train anything. If you ask for the mail copy, messages are added to your successor's mailbox under one new label and nothing already there is touched. The working copy of the mailbox is destroyed within 30 days of handover, like every other job's.
So the promise at the top of this page does not cover it, and we would rather say that here than leave it to the small print. What governs a migration is the Data Processing Addendum: what we may do with the data, how long we keep it, and what happens to it when the job is done. Nothing starts until you have seen the quote and accepted it, and the access you grant is yours to revoke.
Still: keep backups
Everything above is real and none of it replaces a backup. Storage fails, filesystems corrupt, and software has bugs, including ours. Do not run a cleanup on the only copy of something you cannot lose.
The rest
Sign-in is by emailed link, so control of your inbox is control of your account. Card details are handled by Stripe and never reach our servers. Delete your account and your catalogues go with it.
The full detail is in the Privacy Policy and the Terms of Service.