At OneSync, privacy is not a marketing promise — it is an architectural guarantee. OneSync is 100% local, does not collect analytics or telemetry, does not operate intermediate servers, and stores all synchronization data on your own hardware.
1. Zero Telemetry, Tracking, or Advertising
OneSync does not contain any third-party tracking scripts, analytics SDKs (such as Google Analytics, Mixpanel, or Amplitude), crash reporting services (such as Sentry or Bugsnag), or advertising frameworks.
- We do not record how many files you sync.
- We do not log your filenames, paths, or file contents.
- We do not track your IP address, device serial numbers, or location.
- This static website uses no tracking cookies or advertising pixels.
2. Direct Client-to-Microsoft Communication
When you authenticate and sync files with Microsoft OneDrive:
- All network requests occur directly between your local Mac workstation and Microsoft's official Graph API servers (
https://graph.microsoft.comand Microsoft Entra ID endpoints). - There is no intermediate proxy, cloud relay, or relay server operated by OneSync or sibansal.dev. Your traffic never passes through any third-party infrastructure.
3. Keychain Credential Security
Authentication is conducted via standard OAuth 2.0 with PKCE (Proof Key for Code Exchange). Session tokens received from Microsoft Entra ID are encrypted using Electron’s native safeStorage module, which integrates directly with the macOS Keychain on Apple Silicon.
- Plaintext tokens are never persisted in unencrypted files or console logs.
- Sensitive identifiers and authorization headers are automatically redacted by the application’s internal logger.
4. Local Storage and SQLite Database
All sync state, file indexes, cryptographic hashes (SHA-256 and QuickXorHash), and audit history are written into a local SQLite database (state.db) located inside the .onesync/ hidden directory on your designated external drive.
This database belongs exclusively to you and remains on your external volume. It is never uploaded or transmitted across the network.
5. Minimal Read-Only Permissions
OneSync strictly limits its permission requests to read-only capabilities:
User.Read: Displays your account email and profile name in the local status header.Files.Read: Reads cloud file metadata and downloads file contents to your target drive.offline_access: Allows token refresh without requiring constant re-login.
OneSync deliberately avoids requesting write permissions (Files.ReadWrite) so that accidental file changes or cloud overwrites are mathematically impossible.
6. Data Retention and Deletion
Because OneSync retains no server-side user data, deleting the application or clearing the .onesync/ folder and your macOS Keychain credentials completely purges all local traces of the application.
7. Contact
If you have questions about privacy in OneSync, please visit the developer portal at sibansal.dev or open an issue on the OneSync GitHub repository.