Privacy Policy
What we hold about you
| Data | Why | Kept |
|---|---|---|
| Name, email address, username, optional title, bio, website and photo | Your account and the profile applications receive when you sign in | Until you close the account |
| Password (as an Argon2id hash), passkeys (public keys only), two-factor secrets and recovery-code hashes | Authenticating you | Until you remove them or close the account |
| Organisation and group membership, roles | Telling applications what you may access | While the membership lasts |
| Active sessions: device type, IP address, last seen | Letting you see and end where you are signed in | Until sign-out, 14 days idle, or account closure |
| Sign-in, consent, grant and administrative events: time, IP address, browser, outcome | Security: detecting abuse, investigating incidents, proving who did what | Retained as a hash-chained security log, including after account closure, with the account reference anonymised |
| Credentials issued to you: SSH public keys, mail-application credentials (hashed), ID cards | The services you asked for | Until revoked or account closure |
| Enquiry-form messages | Answering you | In our support mailbox |
What applications receive
When you sign in to an application through AndroAccess it receives only the claims listed on the consent screen or, for applications operated by your own organisation, the standard profile: your identifier, name, email address, profile fields, and your organisation and group membership. It never receives your password or second factor. Each application is responsible for its own handling of that data.
Who processes data on our behalf
We use a small number of service providers to run AndroAccess: hosting and network security, delivery of account emails, and mailbox hosting for organisations that use the mail features. They process personal data only to provide those services to us, under contracts that limit them to that purpose. If you add an ID card to Google Wallet, Google holds that pass under its own terms. A current list of providers is available on request from [email protected].
We do not sell personal data and do not use it for advertising.
Your choices
- Export: download everything we hold about you from your account page, as JSON.
- Correct: edit your profile on your account page; your organisation's administrators can correct membership.
- Delete: close your account from your account page. If you are the only owner of an organisation that still has members, hand ownership to someone first.
- Sessions and credentials: revoke any session, passkey, key or credential from your account page; the change is immediate everywhere.
Security
Passwords are hashed with Argon2id and checked against known breach lists when set. Traffic is encrypted in transit. The service runs in multiple regions with replicated storage, and security-relevant actions are recorded in an audit log. AndroHost administrators must use two-factor authentication.
Contact
For anything about your data: [email protected]. If you are a member of an organisation, its administrators can act on most requests directly.