Privacy Policy

This policy explains how ASharp Development processes personal information when you use Identity Server to sign in to an application. The application you are signing in to is a separate service and may have its own privacy policy.

Information we process

• Account information: your email address, name, email-verification status, and, if provided, profile picture and sign-in provider. For local accounts, we store a password hash rather than your password in plain text.
• Federated sign-in information: if you choose Google, GitHub, Facebook, LinkedIn, or Microsoft sign-in, we receive account identifiers and profile information made available by that provider, which may include your email address, name, picture, and verification status.
• Authentication records: account, application, session, authorization, and token records needed to sign you in, maintain or end sessions, and protect the service.
• Technical and security information: IP address, browser and request information, request identifiers, and sign-in or security events. This information supports rate limiting, abuse prevention, troubleshooting, and service security.
• Essential cookies: signed session, interaction, and authentication cookies needed to complete sign-in and keep your session secure.

How we use information

We use this information to create and manage accounts, authenticate users, deliver verification and account-recovery messages, issue and revoke sign-in tokens, prevent abuse, troubleshoot failures, respond to support requests, and meet legal obligations. We do not sell personal information or use it for targeted advertising.

Information shared with applications and providers

When you sign in to a connected application, Identity Server sends that application the account claims and tokens allowed by its configuration and requested permissions. These may include a stable account identifier, name, email address, email-verification status, profile picture, or sign-in provider. The connected application controls its own use and retention of information it receives.

If you choose a federated sign-in provider, your browser communicates with that provider to authenticate you. The provider handles information under its own privacy policy, and sends Identity Server the information needed to complete sign-in.

We use service providers for hosting, database storage, and email delivery. Verification, recovery, and deletion messages are sent through the email provider configured for the service. These providers process information as needed to provide their services to us.

We may also disclose information when required by law, to protect users or the service, or to establish or defend legal claims.

Retention and account deletion

We retain account information while the account is active and as needed for the purposes described here. Authentication records expire according to their purpose: for example, access tokens generally expire after 10 minutes, refresh tokens after up to 30 days, email-verification links after 24 hours, and password-reset or deletion-confirmation links after one hour.

You can request deletion of your account through the data-deletion page. After you confirm the request by email, we delete the account and stored authentication records associated with your user ID or email address, including linked identity records, sessions, and tokens. Some information may remain temporarily in backups, security logs, or service-provider systems under their applicable retention schedules, or where retention is required by law.

Your choices and rights

You may request access to, correction of, or deletion of personal information by contacting us. Depending on where you live, you may have additional rights, such as requesting a copy of your information, restricting or objecting to certain processing, or withdrawing consent where processing is based on consent. You can also stop using a federated provider by choosing another available sign-in method.

Security and international processing

We use technical and organizational safeguards designed to protect information, including password hashing, protected authentication records, access controls, and security monitoring. No method of storage or transmission is completely secure. Our service providers may process information in countries other than your own; where required, appropriate legal safeguards apply.

Children

Identity Server is not intended for children under 13. If you believe a child has provided personal information, contact us so we can review the request.

Changes and contact

We may update this policy as the service changes. The current version and its effective date will be available on this page. For privacy questions or requests, contact help@adammajor.com.