Privacy

What we store

• Your verified email, used to identify the account
• Optional display name, if you set one
• Passkeys (public credentials only — biometrics stay on your device)
• Hashed recovery codes
• Which apps you connected, which data you allowed, when, and when you revoked
• Security audit of those events (that an app received email and/or name; that you revoked on a date)

We do not store passwords (there are none). We do not store phone numbers. We do not keep a copy of what a connected site stores after login.

What we do not do

We do not sell your data. We do not share it across apps except the OpenID Connect claims you granted to that app.

What revoke does

Revoke stops access: that app cannot refresh a login or treat you as a current user through SafeLogin. It does not automatically erase records the app already copied (for example an email on an invoice). Accountable apps tell us what they still hold and why. Unverified apps do not; their privacy policy applies and we cannot check.

Email sign-in risk

Whoever can read your email inbox can request a login code and open a SafeLogin session. That is the same class of risk as a typical “reset password” email. We rate-limit codes. Passkeys on your devices are the daily path.

Our audit retention

We keep grant and revoke records so you (and we) can see what happened. We will publish the exact retention period on this page when operations start. We do not keep the contents of other sites’ databases.