This Privacy Policy explains how idintiti ApS ("we", "us", "our") handles your personal data when you use Alloba Auth. We have designed the authentication service to collect and retain as little personal data as technically possible.
The data controller for Alloba Auth is idintiti ApS. Contact: privacy@alloba.co.
Your email address (processed, not stored in readable form)
When you sign in, your email address is immediately transformed using a one-way cryptographic hash (HMAC-SHA256). We never store your email address in readable form. The hash is used solely to identify your account. We cannot reverse it to obtain your email.
Pseudonymous identifiers
Participating applications receive a pseudonymous subject identifier to complete authentication. We derive that identifier from your account and the one application receiving it, so every application receives a different identifier and no application can match its identifier against another application's. The identifier is never your email address, and we do not include your readable email address in the authentication tokens.
Session data
We store the authorization, token, and session records needed to complete and maintain sign-in. Authorization codes expire after one minute. Access and ID tokens expire within one hour, and browser sessions may last up to 24 hours.
Invite records
If you receive or send an invite, we store a record of the email hash of the invited address and the identifier of the inviter. No plaintext email addresses are stored in invite records.
Server logs
Our hosting provider (Railway) may retain standard server logs (IP addresses, request paths, timestamps) for up to 30 days for operational purposes.
We process your data on the basis of:
We do not sell your data. We do not share your data with third parties for marketing. We use the following sub-processors:
You have the right to:
To exercise any of these rights, contact us at privacy@alloba.co. Because we store your data by email hash (not plaintext email), we will ask you to verify your identity before processing a request.
We use HMAC-SHA256 with a server-side secret for all email hashing. Database connections are encrypted. Authorization codes are short-lived and single-use, and access and ID tokens expire within one hour. We use S256 PKCE, signed JWTs, and timing-safe comparisons.
We may update this Privacy Policy as the service evolves. Material changes will be communicated by updating the "Last updated" date above. We encourage you to review this page periodically.
Privacy questions: privacy@alloba.co