Private & Non-Commercial Backup Automation

Automate and Verify Your Google Takeout Backups

A headless, self-hosted utility designed to detect Google Takeout exports delivered to Google Drive, stream them byte-for-byte to your private Synology NAS, and verify complete archive integrity before archival.

Read Privacy Policy Explore Architecture

Read-Only API Access

SHA-256 & CRC-32 Verified

On-Premises Synology NAS

Zero Third-Party Telemetry

Automated Architecture

The End-to-End Backup Workflow

Google Takeout delivers multi-gigabyte export batches directly to Google Drive. TakeoutBackup handles the rest on your private network.

Google Takeout Export

Google Takeout generates multi-part ZIP archives according to your scheduled schedule and delivers them to a designated Takeout folder in Google Drive.

Discovery & Readiness

TakeoutBackup identifies the export batch using unique Google Drive IDs and verifies readiness using the Report Summary trigger before any transfer begins.

Resumable Streaming

Direct chunked HTTPS streaming transfers raw archives to your local Synology NAS volume with byte-range resume support across network interruptions.

Cryptographic Verification

Archives undergo quad-layer verification: remote byte counts, Drive MD5 checksums, non-extracting ZIP member CRC checks, and streaming SHA-256 fingerprinting.

Fundamental Safety Invariant: Byte-for-Byte Fidelity

TakeoutBackup never extracts, re-encodes, modifies, or reorganizes your archive files. Google Takeout archives are stored in their authentic binary state to guarantee long-term archival integrity.

Capabilities

Built for Reliability & Privacy

Engineered from first principles for unattended home and small office NAS deployments.

🔍

Drive ID Tracking

Folders and files are identified strictly by immutable Google Drive IDs rather than path names, preventing accidental duplicate downloads or ambiguous matching.

⚡

Resumable Chunked Transfers

Streams multi-gigabyte files in managed chunks. If a network blip occurs, downloads resume from the exact byte offset using HTTP Range headers without restarting.

🛡️

Non-Extracting Integrity Checks

Verifies ZIP structural integrity by testing member CRCs (zipfile.testzip()) and calculating streaming SHA-256 hashes without unpacking archives to disk.

👥

Strict Multi-Account Isolation

Independently manages multiple Google accounts with isolated OAuth credentials, tokens, download target volumes, SQLite state databases, and logging contexts.

💾

Transactional SQLite State

Maintains atomic state tracking with SQLite Write-Ahead Logging (WAL mode), recording export readiness, download progress, and verification results across restarts.

🔒

On-Premises Confidentiality

Zero third-party telemetry, tracking, or intermediary proxy servers. Execution occurs exclusively between your private NAS and official Google API endpoints.

Architecture Roadmap

Implemented vs. Planned Functionality

TakeoutBackup operates under strict safety invariants. We explicitly distinguish live-verified production capabilities from future planned milestones.

Live-Verified on Synology DS224+

Implemented Capabilities

Fully built, tested, and validated against live Google Drive accounts and physical NAS hardware.

✓
Multi-Account OAuth 2.0 PKCE: Secure local token storage with restricted permissions (0600) and automatic token refresh.
✓
Read-Only Drive API v3: Strict least-privilege scope (drive.readonly) with zero write or delete capability.
✓
Drive ID Discovery: Querying and tracking Takeout export batches by immutable resource IDs.
✓
Report Summary Rule: Reliable detection of batch completion before download initiation.
✓
Resumable Chunked Downloader: Streaming large archive downloads with temporary .part file promotion.
✓
Quadruple Integrity Verification: Remote size matching, Drive MD5 check, non-extracting ZIP CRC-32 testing, and SHA-256 hashing.
✓
Transactional SQLite State: Atomic state management in WAL mode with idempotent resumption.
✓
Docker & Portainer Integration: Containerized deployment with non-root UID/GID security on Synology DS224+.

Upcoming Milestones

Planned Functionality

Features designed in the roadmap but not yet implemented in the live deployment.

○
Automated Polling Daemon: Continuous background polling service with signal-aware scheduling (Development Packet 004).
○
Guarded Remote Cleanup: Optional, multi-phase deletion of verified Google Drive export folders under strict safety rules and explicit confirmation.
○
Full Drive Scope Requirement: Requesting drive scope only if remote deletion is explicitly configured and enabled.
○
Operational Notification Webhooks: Push notifications (e.g. Synology Chat, Discord, Telegram) for completed transfers and error alerts.

Notice Regarding Remote Deletion

Remote Google Drive deletion is NOT currently implemented. The active application uses strictly read-only Google Drive access (https://www.googleapis.com/auth/drive.readonly) and contains zero code to delete or modify remote files. When remote cleanup is introduced in future releases, it will require full Drive permissions, remain disabled by default, and execute only after SHA-256 and CRC integrity verification have passed.

Operating Model

Privately Operated & Non-Commercial

TakeoutBackup is privately developed, self-hosted software built for personal and household backup.

TakeoutBackup is a privately developed, non-commercial backup utility operated exclusively for personal and household data preservation. It is not offered as a commercial service, a public software-as-a-service (SaaS) platform, or a multi-tenant cloud application.

The application operates entirely on private on-premises hardware (such as a local Synology NAS). OAuth tokens, file metadata, and Google Takeout archives remain exclusively within the operator's private network and local storage media.

For detailed information on how Google Drive API access is requested, scoped, and protected, please review our comprehensive Privacy Policy.