Security & Privacy

This section is a work in progress.

• Sign-in is done via WebAuthn passkeys or federated login (Google, Microsoft) through OAuth2/OIDC.
• No passwords are stored by this service.
• Authorization codes are single-use and require PKCE.
• Access tokens are opaque and expire after 60 seconds.
• Relying parties (client applications) do not need to pre-register; client_id must match the redirect_uri domain.

See the Privacy Policy for data retention details.