Photo Vault is a personal photo and video archive at photo.dwaynekoh.com. The full archive is restricted to its owner. A shared collection requires its specific link and password.
The owner authorizes Google Drive access so the gallery can list files, show photos and videos, download originals, and permanently delete originals when the owner explicitly confirms deletion. Google grants an account-wide Drive permission; the application checks that each original is within the configured Photo Vault Test folder. Other Google accounts cannot enter the owner archive.
Original files stay in Google Drive. Cloudflare hosts the application and small derived viewing previews. Owner authorization credentials and shared collection records are encrypted in server-side storage. Secure, HttpOnly cookies keep owner and password-protected guest sessions separate. Browser-local labels and favorites stay in that browser. The application does not sell Google user data, use it for advertising, or use it to train AI models.
Only items explicitly selected by the owner enter a shared collection. Guests need both the link and password. The owner can set an expiry, disable download buttons, or revoke the link. Revocation blocks future requests; copies already downloaded or captured cannot be recalled. Original downloads include embedded metadata such as camera details and any location information present in the file.
Disconnect direct Drive in the owner gallery to revoke its Google authorization and remove the stored connection credentials. Access can also be revoked in Google Account settings. Revoked shared collection records can remain encrypted in the owner's Cloudflare storage. The owner controls removal of server records and cached previews through the hosting account. Deleting a Drive original is permanent when confirmed; it bypasses Drive Trash.
For questions about a shared collection, contact the person who gave you the link. The archive owner controls the Google Drive and Cloudflare accounts.
Photo Vault's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.