Linger is a personal diary web app. Your Google Drive is the primary store for diary entries. Linger's Cloudflare backend handles sign-in and requests to Google Drive. It processes diary text while carrying out those requests, but does not use Cloudflare databases as a diary store. If you enable the optional S3 backup, Linger also sends diary files to the S3 bucket you configure in your own AWS account.
This policy describes information Linger processes, the service providers involved, and the choices available to you. Google, Cloudflare, AWS, and other providers may also process information under their own privacy terms.
linger_diary/. Google Drive may also keep file revisions.
Linger requests the Google OAuth scopes openid, email, and
https://www.googleapis.com/auth/drive.file. The first two identify your Google
account. The Drive scope lets Linger create and manage the specific files you use with the app;
it does not grant general access to your entire Drive. Linger uses this access to read, create,
update, search, restore, and move its diary files to Google Drive Trash.
Google provides sign-in and stores your diary files, milestones, and any S3 configuration files. Your entries are plain-text files. Google controls its own storage, revision history, and deletion practices. See Google's Privacy Policy.
Linger runs on Cloudflare Pages and Workers. When you read or save an entry, its contents pass through Cloudflare's network so the backend can make the authorized Google Drive request. The backend does not use its authentication database or sync index to store diary text.
Linger's application is designed to process diary text, Google OAuth access, refresh and identity tokens, and AWS temporary credentials only in memory for the operation that needs them, including its short-lived asynchronous work. It does not intentionally save these values to its databases, KV, Durable Object storage, Workflow state, application logs, or server-side caches. Google Drive and your optional S3 bucket store the diary files you choose to save. OAuth state and the PKCE verifier are temporarily stored separately to complete sign-in, as described below.
Cloudflare D1 stores session metadata, including your session ID and Google account
identifier, expiry, and Drive file identifiers. Your email is read from the verified identity token
for display and is not stored in session records. OAuth access, refresh, and identity tokens and
AWS temporary credentials are not persisted in session records. Short-lived Google tokens are
held in browser memory and sent with authorized requests; the backend uses them transiently.
Reloading or closing the page discards those tokens, and expiry requires authorization again.
Session records expire 30 days after creation or renewal; sign-out invalidates the session.
The browser's opaque linger_session cookie identifies the metadata record and
cannot authorize Drive access by itself. On HTTPS it is HttpOnly,
Secure, and SameSite=Strict.
Sign-in also uses a five-minute OAuth state record and a temporary
linger_oauth_state cookie to bind the callback to your browser.
On HTTPS that cookie is HttpOnly, Secure, and
SameSite=Lax. The state record does not contain Google access,
refresh, or identity tokens.
Cloudflare's coordination services store operational metadata such as Drive file IDs, entry dates and versions, S3 sync status, and backfill progress so writes and backups can be coordinated and retried. This metadata does not include diary entry text. Cloudflare may also process request logs, error diagnostics, and workflow state under the retention rules for the services and account plan in use. The application avoids deliberately logging sensitive values, but provider-side diagnostics and account settings require separate operational review; a fault or misconfiguration could expose data. Cloudflare documents Workers Logs retention of up to seven days and Workflow instance-state retention of up to 30 days, depending on plan and settings. See Workers Logs retention, Workflow retention limits, and Cloudflare's Privacy Policy.
When a session is invalidated, Linger removes its stored account identifiers and keeps an opaque revoked-session record until it expires to prevent reuse. Completed or failed S3 backfill job history older than 30 days is removed when a new backfill starts; inactive accounts may retain this history longer. Other sync metadata may remain to support synchronization and retries.
Earlier versions stored credentials server-side. Removing live session records does not revoke Google authorization or erase historical backups. Previously stored credentials must be revoked separately; users can remove Linger's access in their Google Account permissions and authorize again. This policy does not claim that deleting a database row removes every historical copy.
Here, "host administrator" means the operator who controls Linger's Cloudflare project and deployed code. Linger has no admin screen for browsing users' diary entries, and its database and sync index are not used to store diary text. However, Linger does not use end-to-end encryption: diary text and request-scoped OAuth tokens pass through its backend.
Linger's source code is public on
GitHub
so users can inspect how the current implementation handles data. The production GitHub Actions
workflow deploys from main after its validation jobs and associates the deployment
with the triggering commit hash. This makes the normal deployment traceable to public source;
it does not remove the host administrator's technical access described below or prevent an
administrator with Cloudflare deployment access from changing the running code.
drive.file authorization.The last list describes what the current backend receives in normal operation; it is not a technical barrier against someone who controls the deployed code. A host administrator could change the app to collect information from browsers when they load it. Do not treat Linger as an end-to-end encrypted diary service.
S3 backup is off unless you configure and enable it in Settings. You provide an AWS IAM role, bucket, and region. Linger stores those settings in your Google Drive and uses your Google sign-in identity to request temporary AWS credentials from AWS Security Token Service. When backup is enabled, Linger backfills existing Drive entries and mirrors later saves and deletions to the configured bucket. Diary text and entry dates are sent to that bucket; AWS also receives the identity token used to assume the role and the requests needed to write the objects. Linger does not ask you for long-term AWS access keys. Backup work advances while the app is open and authorized; credentials are not saved in durable background jobs.
The bucket is in your AWS account and its permissions, region, versioning, lifecycle, and other retention settings are controlled by you and AWS. Turning backup off stops future syncing but does not remove objects already in the bucket. A delete request may leave older object versions or retained copies according to your bucket configuration. See AWS's Privacy Notice.
Linger uses browser localStorage and IndexedDB for preferences and for local copies
of entries, cached content, unsaved drafts, and pending offline saves or deletions. Milestones
and a few account and interface hints may also be stored there. In local or offline use, an entry
may remain in browser storage until it can be synced. This browser data is not separately
encrypted by Linger and may be accessible to someone who can use your browser profile or device.
Linger clears shared diary caches and pending changes when you sign out or switch accounts. Owned
unsynced drafts remain in this browser and are restored only after the matching account signs in;
display preferences can also remain. You can remove local data by clearing this site's data in your browser.
If you export a ZIP or portable HTML file, the resulting file is downloaded to a location chosen by your browser. If you use the entry-sharing control, the selected text is passed to your device's share sheet or clipboard. What happens after that depends on the destination app or service you choose.
If you select a holiday calendar, Linger sends the selected country and year through its backend to Nager.Date to retrieve public holiday data. Linger caches those results in Cloudflare KV for up to 90 days. Diary entries are not included in that request. The app also requests fonts from Google Fonts; those browser requests may disclose connection and browser information to Google. See Google Fonts' FAQ.
The website includes Cloudflare Web Analytics for aggregate page-visit and performance measurements, such as page views, referrer, country, browser/device category, and Core Web Vitals. Cloudflare says Web Analytics does not track individual users across websites and does not collect visitors' personal data. It does not use an analytics cookie. Cloudflare keeps unsampled beacon data for seven days, then aggregates it; analytics are available for up to six months. See Cloudflare Web Analytics and its retention details.
Linger does not use advertising or behavioral ad tracking.
Your diary files and milestones remain in Google Drive until you delete them there. Deleting an entry in Linger moves its Drive file to Google Drive Trash; permanently remove it from Trash if you want it deleted from Drive. Google controls the retention of revisions and trashed files. You can also remove the Linger diary folder from Drive.
When S3 backup is enabled, Linger sends a delete request for the corresponding current object when you delete an entry. You are responsible for removing any remaining S3 object versions and for deleting backups when you no longer want them. Turning off backup alone does not delete them.
Sign out to invalidate your Linger session and clear locally cached entries. Account-scoped unsynced drafts remain in this browser so they can be restored after the same account is verified again; clear this site's browser data to remove them. To revoke Linger's Google authorization, visit Google Account → Apps & services. Revoking access does not delete files already stored in Drive or S3. For questions about personal information held by Linger's services, contact us below.
The app uses HTTPS for communication between your browser, Cloudflare, Google, and AWS. OAuth tokens are kept in browser memory and used transiently by the backend. No method of online storage or transmission is completely secure, and the security of your Google account, device, browser, and optional AWS account is also important.
We may update this policy when the app or its data practices change. The date at the top shows when it was last updated. Continued use after a change means you have seen the updated policy.
For privacy-related questions, please contact:
europeanplaice@gmail.com