Privacy Policy

Oakinkin Labs LLC, a Delaware limited liability company ("we"), runs OakAuth: the OakAuth app and the oakauth.app website. This page explains what we collect, why, and what you can ask us to do. oakinkin.com and OakVPN have their own privacy pages.

In the app

• Your account: a username set up by your service administrator, an email address if one is given, and a recovery email if you add one. Where the service uses a password, we keep only a one-way hash of it and of earlier ones, never the password itself.
• Your device: an id we assign, the name you give it, platform and app version details, a push notification token, and the device's public key. The device's private key is created on the device and is never sent to us.
• Your one-time codes: the secret that generates them, so we can check a code when push approval isn't available.
• Sign-in records: each approval request and what happened to it — approved, denied or expired — with its time, and the IP address and browser or device type of the sign-in attempt.
• Security records: events such as sign-ins and devices added or removed, with the IP address and browser or device type involved.

On oakauth.app

• When you visit: the pages you open and where you came from; basic browser and device settings, such as language, screen size and time zone; how you use the page, such as scrolling and clicks; and your IP address. From your IP address we work out your approximate location — your country, and a point to about your city — using a database on our own server, so your IP isn't sent anywhere for this. We don't collect your exact location.
• A cookie: one cookie with a random id, kept for one year, so we can recognize a returning browser. You can block or delete it in your browser settings.

When you contact us: what you send by email.

• Your location in the app. The app never asks for it, and sign-in requests show none.
• Your contacts, photos, files or microphone. The camera is used only to scan the enrollment QR code.
• Advertising ids. The app carries no advertising or analytics code.
• Your fingerprint or face. Those checks are done by your phone's system, and we never receive them.

To deliver sign-in requests to your device, check your approvals and codes, keep the service secure, recover access when you ask, understand how the website is used, and reply to you. We don't sell your data or use it for advertising.

Only the services we need to run OakAuth: our hosting provider; a push notification service, which carries each sign-in request to your device; an email service for recovery messages; and our backup provider, which receives only encrypted copies. On oakauth.app, your browser also loads fonts from a web font service, which sees your IP address. These services may be in countries other than yours. We will name any of them on request. We share data when the law requires it.

• Account, device and code records: until you ask us to delete them. Removing a device in the app stops it from approving sign-ins at once; its record stays until you ask us to delete it.
• Sign-in and security records, with their IP addresses: as long as we need them to keep the service secure. You can ask us to delete yours.
• Visit records: up to 12 months.
• Messages: as long as we need them to reply and for any work that follows.
• Backup copies may remain for a while after deletion.

Write to hello@oakauth.app to ask what we hold about you, for a copy, or to correct or delete it. We reply within 30 days. If you live in the EU or the UK, you can also complain to your data protection authority.

The app talks to our server over encrypted connections, and each approval is signed on your device with a key that stays there. No system is perfectly secure, so keep your phone locked and up to date.

OakAuth isn't meant for children under 13, and we don't knowingly collect their data.

When this page changes, its version and date change.