Derova Privacy Policy

Effective date: 2026-10-02

Last updated: 2026-10-03

This Privacy Policy explains how Derova — Music Migrator, provided by Benoit Derchain — Entrepreneur individuel, accesses, uses, stores, shares, retains, and deletes information when a user operates the Music Migrator Windows desktop application.

Public website: https://derova.fr

Privacy contact: privacy@derova.fr

Support contact: support@derova.fr

1. Product scope

Music Migrator transfers supported YouTube and YouTube Music playlists between a SOURCE Google account and a DESTINATION Google account. The public V1 product supports private, unlisted, and public playlists. It does not offer migration of a YouTube Music library, listening activity, subscriptions, followed artists, or liked tracks.

Music Migrator is local-first. The current product has no Music Migrator backend for migration data, no analytics, no advertising, no remote crash reporting, and no telemetry.

2. Google user data accessed

SOURCE account through Google Data Portability

Music Migrator requests only the Google Data Portability resources for private, unlisted, and public playlists. The resulting export may contain:

• playlist metadata, such as playlist title and description;
• playlist visibility;
• video identifiers for playlist items; and
• playlist item order needed to reconstruct the playlist.

The corresponding V1 OAuth scopes are:

• https://www.googleapis.com/auth/dataportability.youtube.private_playlists;
• https://www.googleapis.com/auth/dataportability.youtube.unlisted_playlists; and
• https://www.googleapis.com/auth/dataportability.youtube.public_playlists.

New archive jobs request the matching youtube.private_playlists, youtube.unlisted_playlists, and youtube.public_playlists resource groups.

This data is used to prepare a migration review and, after the user confirms, to reconstruct supported playlists in the DESTINATION account.

DESTINATION account through Google OIDC and YouTube Data API

Music Migrator uses the verified stable Google account identifier from OIDC to bind a prepared migration to the intended DESTINATION account. The new authorization flow does not request email access for this purpose.

The YouTube Data API is used only for supported playlist migration functions, including necessary destination inspection, playlist creation, playlist item insertion, and read-only reconciliation used for safe recovery. Music Migrator does not use these permissions to delete remote playlists or playlist items.

3. How Google user data is used

Google user data is used only to provide user-visible playlist export, review, migration, recovery, reconciliation, and local history functions. It is not used for advertising, user profiling, or sale of data.

The user reviews the prepared migration before destination writes begin and explicitly starts the migration.

4. Token handling and local storage

SOURCE and DESTINATION OAuth refresh credentials are stored in separate entries in Windows Credential Manager. Access tokens are used temporarily in application memory for authorized Google API calls. OAuth access tokens and refresh tokens are not stored in the application's SQLite databases and are not sent to the React frontend.

The following operational information may be stored locally on the user's device:

• migration jobs, plans, operations, status, attempts, and safe error categories;
• Data Portability archive job metadata;
• playlist data needed for active or recoverable migrations;
• read-only reconciliation observations and provider results needed for safe recovery;
• compacted migration history; and
• application-managed Data Portability download and extraction files.

No Music Migrator remote server receives OAuth tokens, Google export contents, or migration databases. Network communication required for the product is with Google services for OAuth, Data Portability, signed archive delivery through Google Cloud Storage, and YouTube Data API operations.

5. Sharing and disclosure

Music Migrator does not sell Google user data. The current product does not share migration data with advertising, analytics, telemetry, or remote crash-reporting providers.

Data and requests necessarily pass through Google services when the user authorizes an account, requests or downloads an export, or performs destination playlist operations. Google processes those requests under the user's relationship with Google and Google's applicable terms and policies.

Information may also be disclosed if required by applicable law.

6. Retention

Music Migrator applies the following local retention rules:

• Active or recoverable migration state is retained while needed for safe execution or recovery.
• Durable YouTube API-derived operation results and reconciliation observations are deleted or compacted when they reach the implemented 30-day boundary.
• Terminal Data Portability operational metadata is deleted after 90 days. This is a Music Migrator product policy, not a Google-mandated retention period.
• Application-owned raw Data Portability download and extraction workspaces are cleaned after durable ingestion when they are no longer needed for recovery.
• Compacted internal migration history may remain until the user invokes local erasure.
• OAuth credentials remain in Windows Credential Manager until the user disconnects the corresponding role, erases local Music Migrator data, or the credential becomes unusable.
• A Google Takeout archive selected from outside the application-managed workspace remains under the user's control and is not deleted automatically by Music Migrator.

7. Deletion and user control

The in-app action Effacer mes données Music Migrator removes application-owned local data, including SOURCE and DESTINATION credentials, execution and Data Portability SQLite databases and their WAL/SHM files, managed Data Portability workspace files, jobs, operations, reconciliation observations, and migration history.

Local erasure does not delete playlists or playlist items already created on YouTube, revoke Google authorization, reset Data Portability authorization, delete the user's Google account, or delete external Takeout files.

Users may also:

• disconnect SOURCE or DESTINATION, which removes that local credential from the device without revoking Google access;
• reset Data Portability authorization through the separate SOURCE control when the application's safety checks allow it; or
• manage Google account access separately through Google account controls.

Music Migrator does not expose a generic Google OAuth revoke action.

See the standalone deletion instructions at https://derova.fr/en/data-deletion/.

8. Security

Music Migrator minimizes the data it persists, keeps credentials outside SQLite, validates provider responses, redacts provider error details before persistence or display, restricts signed archive downloads to validated Google Cloud Storage endpoints, and uses local recovery controls designed to avoid unsafe write replay.

No security control can eliminate every risk. Users should keep Windows and Music Migrator up to date and protect access to their Windows account.

9. Google Data Portability Limited Use

Music Migrator's use of information received from the Google Data Portability API complies with the Google Data Portability API User Data and Developer Policy, including its Limited Use requirements. This statement describes the application's intended and implemented data use; it does not state or imply that Google has certified or approved Music Migrator.

10. Changes to this policy

Material changes to this policy must be reflected by updating the last-updated date and the published policy. Changes to the supported Google data or its use must also be reflected in the product disclosure and consent flow before they take effect.

11. Contact

Privacy questions: privacy@derova.fr

Product support: support@derova.fr

Publisher: Benoit Derchain — Entrepreneur individuel

Publisher and hosting details: Legal notice