Terms of Service

By downloading, installing or using the OakAuth app, or using oakauth.app, you agree to these Terms of Service ("Terms") and our Privacy Policy. If you don't agree, don't use OakAuth.

These Terms are a legally binding agreement between you and Oakinkin Labs LLC ("we," "us," "our"), a Delaware limited liability company.

OakAuth is an authentication app that lets enrolled users approve or deny sign-in requests from connected services by push notification, and generate one-time codes (TOTP, RFC 6238) as an offline fallback.

OakAuth is used inside Oakinkin Labs products and, where offered, in services we run for managed clients. Access is granted by the administrator of the service you are trying to protect.

Your OakAuth account is created by the administrator of the service you enroll with. You don't register directly with us; you receive an enrollment QR code or token from your service administrator.

You are responsible for:

• keeping your enrolled device secure and not sharing access to it;
• telling your service administrator at once if your device is lost, stolen or compromised;
• keeping your device's operating system up to date;
• adding a recovery email if you want to recover access without your administrator's help.

You agree not to use OakAuth to:

• approve sign-in requests you didn't start — if you get an unexpected request, deny it and contact your administrator;
• reverse-engineer, decompile or tamper with the OakAuth app;
• get around the signing of approvals or any other security measure;
• break any applicable local, state, national or international law;
• automate or script approvals without a person reviewing each request.

We aim to keep OakAuth running, but we don't guarantee uninterrupted service. OakAuth depends on our server and on a push notification service, either of which can be down. The one-time codes work entirely offline and don't depend on our server or on push notifications.

We may suspend or discontinue OakAuth at any time, with or without notice, for maintenance, security or any other reason.

• Device lock screen: use a PIN, password, fingerprint or face to lock your device. An unlocked device with OakAuth installed can approve sign-in requests for anyone who picks it up.
• Lost or stolen device: contact your service administrator at once to remove it.
• Fingerprint or face check: OakAuth can ask for your fingerprint or face before each approval. Keep this setting on; turning it off increases risk.
• Recovery email: add one so you can regain access if your device is lost.

We are not responsible for unauthorized sign-in approvals resulting from your failure to secure your enrolled device.

You can remove your device at any time with "Remove this device" in the app's settings. It stops the device from approving sign-ins at once and ends its session. Its record stays on our server until you ask us to delete it, as the Privacy Policy explains.

We may remove your device. Your service administrator may remove your device at any time without notice. We may also stop a device whose push notification token is no longer valid.

Ending use. Your access to OakAuth is controlled by the administrator of the service you are enrolled with. You can ask us to delete your personal data as the Privacy Policy explains.

OakAuth, its logo, design, code and all related materials belong to Oakinkin Labs LLC. "OakAuth," "Oakinkin," "Oakinkin Labs" and the circuit-tree-fingerprint mark are trademarks of Oakinkin Labs LLC.

You get a limited, non-exclusive, non-transferable license to use the OakAuth app on your enrolled device for authentication. This license doesn't include the right to reproduce, distribute, modify or create derivative works of OakAuth.

OAKAUTH IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED. TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, OAKINKIN LABS LLC DISCLAIMS ALL WARRANTIES, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT.

No authentication system provides absolute security. OakAuth raises the bar for unauthorized sign-ins, but it does not remove all risk.

TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL OAKINKIN LABS LLC, ITS OWNER, OFFICERS, AGENTS OR AFFILIATES BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, DATA, USE, GOODWILL OR OTHER INTANGIBLE LOSSES, RESULTING FROM YOUR USE OF OR INABILITY TO USE OAKAUTH.

OUR TOTAL LIABILITY TO YOU FOR ANY CLAIM ARISING OUT OF OR RELATED TO THESE TERMS SHALL NOT EXCEED FIFTY US DOLLARS ($50).

You agree to indemnify, defend and hold harmless Oakinkin Labs LLC and its owner from and against any claims, damages, obligations, losses, liabilities, costs and expenses arising from: (a) your use of OakAuth; (b) your violation of these Terms; (c) your violation of any third-party right; or (d) any claim that your use of OakAuth caused damage to a third party.

These Terms are governed by the laws of the State of Delaware, United States, without regard to its conflict of law provisions.

Any dispute that cannot be resolved informally shall be resolved by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, with arbitration held in Delaware. You waive any right to a jury trial or to take part in a class action.

You may opt out of this arbitration clause within 30 days of first using OakAuth by emailing hello@oakauth.app with the subject "Arbitration Opt-Out." If you opt out, disputes will be resolved in the state or federal courts located in Delaware.

We may update these Terms from time to time. We'll give at least 14 days' notice of important changes by email, where we have your address, and on this page. If you keep using OakAuth after the new Terms take effect, you accept them.

Questions about these Terms? Write to hello@oakauth.app. We aim to reply to legal questions within 5 business days.