Derova Public Data Matrix
This matrix summarizes the public V1 data boundary. All Music Migrator storage listed below is local to the user's device unless the row explicitly identifies a Google service.
| Data category | Source | Purpose | Stored where | Retention | User control |
|---|---|---|---|---|---|
| OAuth refresh credentials | Google OAuth authorization for SOURCE or DESTINATION | Obtain authorized Google access without requiring consent at every restart | Separate role-scoped entries in Windows Credential Manager | Until local disconnect, full local erasure, replacement, or unusable credential handling | Disconnect the role; erase all local Music Migrator data; manage access separately in the Google account |
| OAuth runtime access tokens | Google OAuth refresh | Make the specific authorized Google API request | Temporary process memory only; not SQLite and not React | For the active runtime need and provider expiry; not durably persisted by Music Migrator | Stop the application; disconnect or erase the local credential that enables future refresh |
| Destination stable account identifier | Verified Google OIDC sub claim | Bind a prepared job to the intended destination and prevent wrong-account execution | Credential metadata in Windows Credential Manager; active/recoverable execution binding in local SQLite | Credential copy until disconnect/erasure; raw execution binding removed during terminal compaction | Disconnect DESTINATION or erase all local data |
| Data Portability playlist metadata | SOURCE private, unlisted, and public playlist export | Build the review and reconstruct supported playlists | Application-managed workspace during ingestion; local execution state while active/recoverable | Raw workspace cleaned after ingestion when safe; active/recoverable state kept until safe completion; terminal details removed by compaction | Clean managed download data; erase all local data; reset Data Portability when safe |
| Data Portability raw app-owned workspace | Signed Google archive download | Download, extract, validate, and ingest the export locally | Application data directory managed by Music Migrator | Cleaned after durable ingestion when no longer needed for recovery | Use local Data Portability cleanup or full local erasure |
| Execution plans and operations | Prepared local migration | Deterministic writes, restart, resume, reporting, and safe dependency handling | Execution SQLite database | Active/recoverable records remain while needed; terminal detail is compacted under the implemented retention policy | Stop work, review status, or erase all local data |
| YouTube observations and operation results | YouTube Data API reads and writes | Dependency resolution, safe reconciliation, and write outcome tracking | Execution SQLite database | Deleted or compacted from the implemented 30-day boundary | Erase all local data immediately |
| Data Portability terminal operational metadata | Google Data Portability archive lifecycle | Status tracking and durable handoff audit | Data Portability SQLite database | 90 days under Music Migrator product policy, not a Google requirement | Full local erasure removes it immediately |
| Compacted migration history | Music Migrator operational summaries | Show local migration dates, final status, and aggregate counts after sensitive detail is removed | Execution SQLite database | May remain until user erasure | Erase all local data |
| External Google Takeout archive | User-selected file outside the app-managed workspace | Optional local source import for supported data | Location selected and controlled by the user | Never deleted automatically by Music Migrator | User deletes or moves the external file directly |
Music Migrator has no migration-data backend, analytics, advertising, remote crash reporting, or telemetry in the current product.