Safety & privacy
By Pedro Albaladejo · ClearCopies
Updated August 12, 2026 · 7 min read
Is It Safe to Connect a Duplicate File Finder to OneDrive?
Evaluate scopes, data handling, token security, retention, and cleanup controls before connecting your drive.
A duplicate finder needs enough visibility to inventory files, but “connect OneDrive” can conceal very different permission and data-handling models. The Microsoft consent screen is necessary evidence, not the whole review.
Check the exact OAuth scopes, publisher identity, privacy policy, security page, deletion process, and whether file bodies leave OneDrive. Ask how tokens are encrypted, how long scan metadata remains, and whether plan export works before anything moves.
A practical checklist
- 1Read the Microsoft consent screen and exact scopes.
- 2Confirm whether file bodies or only metadata are processed.
- 3Review token storage, retention, deletion, and operator-access statements.
- 4Require a read-only scan and a reviewable export.
- 5Revoke the app when finished or if behavior differs from its claims.
Understand the situation
A permission label describes technical access, not the provider’s entire security posture. Review the exact scope, token handling, retention, operator access, and purpose of every data field before connecting an account.
Use a controlled workflow
Check what access an app requests and why. The scan should only read, nothing should move without your explicit approval, and a report-only workflow should remain possible.
Make the final decision
Connect only when you understand why each permission is requested. The scan should only read, and files should move only after you approve a cleanup, to the recoverable trash. Revoke access and request data deletion when the service is no longer needed.
Metadata is not harmless just because it excludes file bodies. Names, paths, sizes, account IDs, and sharing state can reveal sensitive business or personal context and need deliberate protection.
Limits and risks to check
- — OAuth removes password sharing but does not eliminate provider risk.
- — Metadata can reveal sensitive projects and people.
- — Write access raises the impact of any misuse.
- — A vague privacy policy leaves retention and subprocessors unclear.
Official references
Frequently asked questions
Should I give a scanner my Microsoft password?
No. A legitimate integration should redirect to Microsoft OAuth and never ask the tool to collect your Microsoft password.
Is a read scope risk-free?
No. It limits modification but can still expose sensitive metadata or content depending on scope and implementation.
What does ClearCopies read?
The MVP uses OneDrive metadata for exact matching and does not download file bodies during the scan.
Scan first. Decide with evidence.
ClearCopies reads supported cloud-drive metadata and groups exact copies by byte size plus a provider-supplied content fingerprint. Original file bodies are not downloaded for the scan. You review the result and export a plan before any file moves.