This Privacy Policy explains how ONLYauth ("we", "us", "our") handles your personal data when you use our authentication service. We have designed ONLYauth to collect and retain as little personal data as technically possible.
The data controller for ONLYauth is the ONLYauth project. Contact: privacy@getonly.co.
Your email address (processed, not stored in readable form)
When you sign in, your email address is immediately transformed using a one-way cryptographic hash (HMAC-SHA256). We never store your email address in readable form. The hash is used solely to identify your account. We cannot reverse it to obtain your email.
Per-service anonymous identifiers
For each application you sign in to via ONLYauth, we compute a separate pseudonymous identifier derived from your email hash and the application's client ID. This means different applications receive different identifiers — they cannot link your activity across services.
Session data
We store short-lived authentication sessions (authorization codes, access tokens, ID tokens) to complete the sign-in flow. These expire within one hour and are stored in our database in encrypted form.
Invite records
If you receive or send an invite, we store a record of the email hash of the invited address and the identifier of the inviter. No plaintext email addresses are stored in invite records.
Server logs
Our hosting provider (Railway) may retain standard server logs (IP addresses, request paths, timestamps) for up to 30 days for operational purposes.
We process your data on the basis of:
We do not sell your data. We do not share your data with third parties for marketing. We use the following sub-processors:
You have the right to:
To exercise any of these rights, contact us at privacy@getonly.co. Because we store your data by email hash (not plaintext email), we will ask you to verify your identity before processing a request.
We use HMAC-SHA256 with a server-side secret for all email hashing. Database connections are encrypted. Access tokens are short-lived and single-use. We follow security best practices for authentication systems (PKCE, signed JWTs, timing-safe comparisons).
We may update this Privacy Policy as the service evolves. Material changes will be communicated by updating the "Last updated" date above. We encourage you to review this page periodically.
Privacy questions: privacy@getonly.co