Optimum's Key

Dropbox Data Use

How Optimum's Key uses the Dropbox API.

Plain English Summary

We only access a dedicated folder inside your Dropbox that belongs to this app. We never read your personal files, photos, or anything outside that folder. You can disconnect at any time and your Dropbox files will remain exactly as they were.

What We Access

Optimum's Key uses the Dropbox API with App Folder access type. This means we can only see and modify files inside a single, dedicated folder: /Apps/Optimum's Key/ in your Dropbox account.

We cannot see your other Dropbox folders, shared files, photos, or any content outside that App Folder. This is enforced at the Dropbox API level — it is not simply a policy commitment.

What We Do With Dropbox Data

  • Mirror project documents: When you upload a document to the Optimum's Key Document Vault, we optionally copy it into the App Folder at a path like /Projects/{project_code}/{category}/{filename}. This gives you an offline copy in your Dropbox and allows collaboration with colleagues who don't have platform access.
  • Retrieve documents: If a document's primary storage is unavailable, we may retrieve the file from the App Folder as a fallback. We only retrieve files we previously uploaded.
  • Generate shared links: If you request a shareable link to a document, we use Dropbox's sharing API to create a link. This link points only to files inside the App Folder.

What We Do NOT Do

  • We do not read, index, or analyze files outside the App Folder.
  • We do not share your Dropbox files with third parties.
  • We do not use Dropbox data for advertising or analytics.
  • We do not store your Dropbox access tokens in the browser. Tokens are held encrypted on the server.
  • We do not request team or organizational Dropbox scopes — only App Folder access.

Token Security

Your Dropbox OAuth access and refresh tokens are stored encrypted server-side using AES-256-GCM. They are never transmitted to the browser or logged in plaintext. Token refresh is handled automatically server-side when a token expires. If token refresh fails, the integration is disconnected gracefully and you will be prompted to reconnect from Settings.

Scopes We Request

ScopeWhy We Need It
files.metadata.writeCreate folder structure inside the App Folder; rename/move files when projects are reorganized.
files.content.writeUpload project documents from the Vault into the App Folder.
files.content.readDownload files from the App Folder when users request a document retrieval.
sharing.writeGenerate Dropbox shared links when a user wants to share a document with an external party.
account_info.readDisplay the connected account's email address in the Integrations settings panel so you know which account is connected.

Disconnecting

You can disconnect the Dropbox integration at any time from Settings → Integrations → Dropbox. Disconnecting revokes our access tokens and removes them from our servers. Files already mirrored to your Dropbox App Folder are not deleted — they remain in your Dropbox under /Apps/Optimum's Key/ until you choose to delete them.

Questions

Contact privacy@energyoptimum.com with any questions about our Dropbox integration.

TermsPrivacySecurityDropbox Data Use