Privacy Policy

Own Auth Cloud provides operational dashboards, analytics, advisory security analysis, audit-log storage, and authentication email and SMS delivery for apps using Own Auth. This policy explains the data Cloud handles.

The Own Auth package runs in your app, and your database remains the source of truth. Cloud does not receive passwords, raw session tokens, one-time codes, or token hashes. Cloud does receive an app-scoped read replica of selected user, session, organisation, audit, security, and delivery metadata.

We collect the data needed to run the service:

• dashboard account email address
• the account's setup email preference
• app names and app settings
• allowed app URLs
• hashed Cloud API keys and safe key prefixes
• user IDs, email addresses, names, account status, and authentication-method flags
• organisation membership and session metadata
• audit events and analytics timestamps
• recipient digests, message type, delivery status, timestamp, and safe error code
• IP, user-agent, location, and reputation data needed for security and abuse prevention

Cloud events, security records, and delivery logs are designed to exclude authentication secrets.

• raw Cloud API keys
• passwords
• raw auth tokens
• magic-link URLs
• password-reset URLs
• email-verification URLs

We use service data to:

• authenticate Cloud requests
• build app-scoped operational views and analytics
• evaluate advisory security signals
• send requested authentication email and SMS
• enforce app URL rules
• rate-limit abusive or accidental spikes
• show safe audit and delivery logs in the dashboard
• debug Cloud delivery failures
• protect the service and its users

We send two kinds of email to your dashboard account address.

• Account notices: email verification, password resets, team invitations, usage and billing alerts, security notices, and data deletion notices. These are part of the service and are always sent.
• Setup emails: a small number of messages after you verify your address that help you connect your first app. They stop once your app is connected.

Every setup email includes an unsubscribe link, and replies reach a person at Own Auth. We store only your setup email choice and when it changed.

The dashboard uses secure cookies to keep dashboard users signed in. These cookies are used for authentication and account security.

The public site may use privacy-conscious analytics to understand page usage. Analytics events must not include auth URLs, tokens, Cloud API keys, passwords, or email contents.

We may use infrastructure providers for hosting, databases, queues, analytics, and outbound email delivery. These providers process data only as needed to run Own Auth Cloud.

We keep dashboard account records, app settings, Cloud key metadata, replicas, analytics, audit logs, security telemetry, rate-limit records, and delivery logs according to the selected plan and documented deletion windows. Disconnecting an app starts hard deletion of its retained Cloud data.

We use security controls designed for auth infrastructure, including hashed Cloud API keys, server-only secrets, rate limits, URL validation, and safe delivery logs.

You can update app settings, rotate or revoke Cloud API keys, export Cloud data, erase user data, and disconnect an app from the dashboard.

You can stop setup emails from the unsubscribe link in any setup email, and resubscribe from the same link.

Requests about account or service data should go through the official Own Auth support channel.

We may update this policy as the service changes. The updated date on this page shows when it last changed.