Privacy Policy

Plain English Summary

We collect the minimum information needed to operate SingleSign securely. Apps only receive what you approve via scopes, and you can revoke access at any time.

1. Overview

This Privacy Policy explains how SingleSign ("we," "us," or "our") collects, uses, stores, shares, and protects your personal information when you use the SingleSign identity platform and related services (the "Service").

This policy applies to all Users of SingleSign, including individuals who create accounts, Developers who integrate SingleSign into their applications, and visitors to our website. By using the Service, you agree to the collection and use of information in accordance with this policy.

2. What We Collect

We collect the following categories of information:

Information you provide

Email address: Required for account creation and authentication.
Password: Stored only as a cryptographic hash using industry-standard algorithms (bcrypt/argon2). We never store your plaintext password.
Profile information: Optional information you choose to provide, such as your display name, phone number, or address.
Multi-factor authentication data: If you enable MFA, we store the associated device or authenticator information required to verify your identity.

Information collected automatically

Device metadata: Device type, operating system, browser type and version.
IP address: Collected for security purposes, fraud detection, and abuse prevention.
Activity logs: Authentication events (sign-ins, sign-outs, consent grants, consent revocations), timestamps, and associated metadata.
Cookies and similar technologies: Session identifiers, authentication tokens, and optional analytics data. See our Cookie Policy for details.

Information we do not collect

We do not collect financial information (credit card numbers, bank accounts) unless you subscribe to a paid plan, in which case payment processing is handled by our third-party payment processor.
We do not collect biometric data.

3. What Apps Receive

When you sign in to a third-party application using SingleSign, the application only receives data that corresponds to the scopes you have explicitly approved:

Scope	Data shared
`openid`	A unique user identifier (subject claim)
`email`	Your email address and email verification status
`profile`	Your display name and profile picture URL (if provided)
`phone`	Your phone number (if provided)
`address`	Your mailing address (if provided)

Important protections:

Applications never receive your password.
Applications never receive more data than the scopes you approved.
You can review and revoke application access at any time from your SingleSign dashboard.
We display a clear consent screen before sharing any data with an application for the first time.

4. How We Use Your Data

We use the information we collect for the following purposes:

Authentication: To verify your identity and enable secure sign-in to SingleSign and connected applications.
Security: To detect and prevent unauthorized access, fraud, credential stuffing, and other malicious activity. This includes analyzing sign-in patterns, IP addresses, and device information.
Service improvement: To understand how the Service is used and to improve its functionality, performance, and user experience. We use aggregated and anonymized data for this purpose whenever possible.
Abuse prevention: To enforce our Terms of Service and Acceptable Use Policy, including detecting and blocking automated attacks, fake accounts, and policy violations.
Communication: To send you essential service-related notifications (security alerts, account changes, policy updates). We do not send marketing emails without your explicit opt-in consent.

We do not sell your personal data. We share your data only in the following limited circumstances:

When you authorize a third-party application to access your data through the consent flow, as described in Section 3.

Service providers

We may share data with trusted third-party service providers who assist us in operating the Service, such as cloud hosting providers, email delivery services, and payment processors. These providers are contractually obligated to protect your data and may only use it to provide services to us.

Law enforcement

We may disclose your data when required to do so by law, court order, or governmental regulation, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

Business transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction. We will notify you of any such transfer and any changes to this Privacy Policy.

Aggregated data

We may share aggregated, de-identified data that cannot reasonably be used to identify you for analytics, research, or business purposes.

6. Cookies

Our use of cookies and similar technologies is governed by our Cookie Policy.

In summary:

Essential cookies: Required for authentication and security. These cannot be disabled without breaking core functionality.
Functional cookies: Used to remember your preferences (such as theme or language settings).
Analytics cookies: Optional cookies used to understand how the Service is used. These are only enabled if you opt in or if we provide an analytics feature in the future.

You can manage cookie preferences through your browser settings.

7. Data Retention

We retain your data according to the following schedule:

Account data: Retained for as long as your account is active. If you delete your account, we will delete your personal data within 90 days, except as required by law.
Audit logs: Authentication and security event logs are retained for up to 24 months for security, compliance, and abuse prevention purposes.
Backup data: Encrypted backups may retain deleted data for up to 30 days before being purged.
Legal holds: If we are required by law to retain data for a longer period (e.g., in connection with legal proceedings), we will retain only the data required for as long as necessary.
Deleted data: When you delete your account or specific data, we initiate a deletion process. Data is purged from our active systems within 90 days and from backups within 120 days.

8. Security

We take the security of your data seriously and implement industry-standard measures to protect it:

Encryption in transit: All data transmitted between your device and SingleSign is encrypted using TLS 1.2 or higher.
Encryption at rest: Sensitive data, including password hashes and authentication tokens, is encrypted at rest using AES-256 encryption.
Access controls: Access to production systems and user data is restricted to authorized personnel on a need-to-know basis, protected by MFA and audit logging.
Multi-factor authentication: MFA is available for all user accounts and is strongly recommended. It is required for all SingleSign team members with system access.
Regular security reviews: We conduct regular security assessments, including code reviews, dependency audits, and infrastructure testing.
Incident response: We maintain an incident response plan and will notify affected users promptly in the event of a data breach, in accordance with applicable law.

9. Your Controls

You have the following rights and controls over your data:

View and edit: You can view and update your profile information at any time from your SingleSign dashboard.
Download your data: You can request a copy of your personal data by contacting privacy@singlesign.com. We will provide your data in a portable, machine-readable format.
Manage consents: You can view all applications you have authorized and revoke access to any application at any time from your dashboard.
Delete your account: You can delete your account from your settings. Account deletion is permanent and will result in the removal of your personal data as described in Section 7.
Communication preferences: You can manage your notification preferences from your settings. Note that you cannot opt out of essential security-related notifications.

If you are located in the European Economic Area (EEA), United Kingdom, or California, you may have additional rights under GDPR, UK GDPR, or CCPA respectively. Contact privacy@singlesign.com to exercise these rights.

10. Children

SingleSign is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13.

If we learn that we have collected personal information from a child under 13, we will take steps to delete that information as promptly as possible.
If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@singlesign.com.
We comply with the Children's Online Privacy Protection Act (COPPA) and similar regulations in other jurisdictions.

11. International

SingleSign is operated from the United States. If you access the Service from outside the United States, please be aware that:

Your data may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.
By using the Service, you acknowledge and consent to the transfer of your data to the United States.
We take appropriate measures to ensure that international data transfers comply with applicable data protection laws, including the use of Standard Contractual Clauses where required.

12. Changes

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors:

Material changes: We will provide at least 30 days' notice before material changes take effect. Notice will be provided via email to your registered email address and/or a prominent notice on the Service.
Non-material changes: Minor changes (such as formatting or clarification) may be made without advance notice.
Continued use: Your continued use of the Service after the effective date of an updated Privacy Policy constitutes your acceptance of the changes.

We encourage you to review this policy periodically to stay informed about how we protect your data.

13. Contact

If you have questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us:

Email: privacy@singlesign.com
Subject line: Privacy Policy Inquiry
Response time: We will make every effort to respond to inquiries within five (5) business days.

For security-related concerns, please contact security@singlesign.com.