Security and IT: Google Slides sync

Our software integrates with Google Slides using a Google-verified OAuth application, which confirms our identity as a trusted publisher. We utilize the Google Slides API for all interactions, ensuring we only access data that the user has explicitly permitted.

The user is prompted to log in to Google and select a file or presentation to be accessed and imported by Kahoot.  

• Permissions (Scopes)
  • drive.file
    See, edit, create, and delete only the specific Google Drive files you use with this app.  Google categorizes this permission as ‘non-sensitive’.  Be advised that we never update or delete your presentation and only read the presentation you specify (and no other file types on your drive).
  • email profile
    We use these permissions in the authentication process. They give us access to your Google profile (e.g. your name) and email address.

All operations occur under the user’s own Google credentials, meaning our software does not gain access to any content beyond what the user can already view.  Furthermore, our software will only read the file(s) the user has explicitly selected to import in the picker UI.  

Data We Store and Where It Is Stored

1. Metadata

• When a user syncs a document, we store select information:
  • Google-specific User ID
  • Google-specific Document ID
  • Document name and type
  • Last synced timestamp
  • A slide-by-slide hash for the presentation (to detect changes)
• This metadata is hosted in European data centers on Google Cloud.

2. Slide Images

• Our software converts each slide (or page) into an image using the Google Slides API.
• These images are stored in a secure Amazon S3 bucket located in Europe and delivered through a Content Delivery Network (CDN).

3. Data Retention

• When a user removes a document from our software, the associated metadata and any generated images remain unless the user—or their organization—requests complete deletion.
• All data transfers (e.g., to Google or to CloudConvert) occur over encrypted (HTTPS) connections.