Media Download privacy notice

Effective September 12, 2026. This notice covers Media Download's Google Drive integration and the WP Luna connection service, operated by Calculabs LLC doing business as WP Luna. For the WP Luna website and purchases, see the website privacy notice. This notice governs the Google integration where their descriptions differ.

Information used to connect your account

Your WordPress site sends its Freemius installation ID, registered site URL, an identifier derived from your WordPress user ID, and signed connection requests. We verify the installation and its Pro entitlement with Freemius. The identifier is used to keep each WordPress user's connection separate; it does not contain your WordPress password.

When you authorize Google, the service receives an authorization code and exchanges it for access and refresh tokens. It stores the authorization encrypted so your WordPress site can continue making the transfers you request. We do not request permission to read your Google profile, email, contacts or your entire Drive.

Files you select

Google Picker displays your Drive in a Google-hosted window. When you confirm a selection, the connection service receives the selected file or folder IDs and names and returns them to your WordPress site. It does not copy your complete Drive listing.

WordPress uses a short-lived Google access token to read metadata and download the files you choose, create uploads in the selected folder, or move an uploaded copy to Drive trash when you ask. File contents travel directly between your WordPress host and Google. The connection service does not receive or store file contents. Importing a file into WordPress can make it available under your site's normal media URLs; choose files you are entitled to publish.

Purpose, sharing and access

We use this information only to provide the connection and file-selection features, verify entitlement, prevent abuse and maintain the service. We do not sell Google user data, use it for advertising, or use it to train generalized AI models. Google user data is not provided to Freemius; Freemius supplies installation and license information for entitlement checks.

Hetzner hosts the connection service. Google provides authorization, Picker and Drive. Your WordPress hosting provider processes the files and tokens held on your site. Those providers' own privacy terms apply to their services: Google, Freemius and Hetzner.

Authorized operators may access connection information when needed to investigate security or service faults, respond to a request you authorize, or comply with law. We do not give operators routine access to the contents of your Google files. Media Download's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Storage and retention

Connection and selection requests expire after 10 minutes. Installation verification is cached for up to 5 minutes. Unused Google connections expire after 90 days; expired records are removed by hourly cleanup. The service uses an essential, secure browser cookie for each connection window, lasting up to 10 minutes. It uses no advertising or analytics cookies.

Authorization and selection records are encrypted in the service database. WordPress stores its connection handle and cached access token encrypted using that site's authentication salts, plus the chosen folder and up to 50 recent transfer records. Transfer-recovery records expire after one hour. Your WordPress host controls its own storage and backup retention.

We disable request logging that could capture OAuth callback URLs, tokens or selected file information. The service briefly processes your IP address for abuse protection and stores a hashed rate-limit identifier in expiring counters. Operational checks record service availability and certificate status, without file names, tokens or request contents.

We do not make scheduled backups of Google connection or selection records. If the connection database is lost, we recreate it without restoring older authorizations. Users must reconnect their Google accounts; files already in WordPress and Google Drive remain there.

Disconnecting and requesting deletion

Click Disconnect in Media Download to remove this WordPress user's saved service connection, chosen folder and transfer history. Existing files stay in WordPress and Drive. A Google access token already issued may continue to work until its expiry. To revoke Google's app-wide permission, remove Media Download in Google Account connections; that can affect other sites using the same Google account.

To request access, correction or deletion of information we hold, or ask a privacy question, contact apps@calculabs.com with the relevant WordPress site address. Do not send passwords or access tokens. We may ask for information needed to confirm that you control the affected site or account. Your statutory privacy rights are unaffected by this notice.