Privacy Policy

This is the privacy policy for Aryuki Auth Center, the account and single sign-on service at accounts.aryuki.com. The service administrator operates it. For privacy questions or requests, contact yysy.rhy@gmail.com. This address is also the contact for requests to access, correct, export, unlink, or delete account information.

Account and profile information. Depending on how you register or sign in, we process a username, display name, email address and its verification status, account identifier, optional birthday, profile image you upload, account status, and the identity provider you use. We also process password and password-verification information when password sign-in is used. Authorized administrators can reset passwords and may access password records for some legacy or manually managed accounts; do not reuse a password from another service.

Google sign-in information. When you choose Google sign-in and grant consent, Auth Center receives your Google account identifier, verified email address, and basic profile information such as your name. For a new account, we may copy your Google profile image to Auth Center storage as its initial avatar. The provider image URL is not saved as an account field. You can replace or remove this avatar from your profile. If the optional birthday permission is enabled for the service and you grant it, Auth Center may also request your complete date of birth from Google People API and save it in your account profile. Auth Center does not request Gmail, Drive, Calendar, or other Google content.

Other sign-in providers. If you choose GitHub sign-in, we receive the GitHub account identifier, verified primary email, username, name, and profile-photo URL needed to authenticate or link your account. For a new account, we may copy that image to Auth Center storage as its initial avatar; you may replace or remove it later. Provider access tokens are used to complete sign-in and are not retained for ongoing access.

Authentication and security information. We process passkey credential identifiers and public keys, authentication counters, session and refresh-token records, sign-in timestamps, the app you signed in to, and security or verification events. We do not receive your passkey's private key or biometric data; those remain with your device or authenticator.

Device and request information. Requests may include an IP address, browser or device user-agent, approximate country or region, and request time. Session records may store an IP address and browser/device details. Security and registration controls may instead store a keyed hash of an IP address. We use this information for session management, abuse prevention, troubleshooting, and security auditing.

Usage, permissions, and test-access information. We record the app identifier, account identifier, event type (for example, sign-in or page access), country, browser/device category, duration, and quota usage. Administrators may configure app permissions and limits. If an administrator creates a temporary test identity, we process its label, permitted apps, expiry, session activity, API path and method, response status, and usage records.

Support and email information. We process the email address and the content needed to deliver account verification, sign-in codes, password resets, email-change confirmations, and security notices. We also process your privacy or support request and the information you choose to include.

Google sign-in requests the openid, email, and profile scopes. The optional birthday scope is requested only when enabled by the service and shown in Google's consent flow. We use the resulting account identifier and verified email to authenticate you, create or link your Auth Center account, and prevent duplicate or unauthorized account access. Name and profile information are used to identify and populate your Auth Center account. A birthday, if requested and returned, is saved as profile information.

We store the Google account identifier, verified email, name, and optional birthday in the Auth Center account database for account operation. For newly created accounts, a copy of the Google profile image may be stored in Cloudflare R2 as the initial avatar; an already registered account's avatar is not changed. You may replace the avatar or restore the default name-based avatar. The authorization code and Google access token are used by the server only to complete sign-in and, when enabled, retrieve a birthday; we do not retain Google access or refresh tokens for ongoing access.

Google user data is used only to provide or maintain the user-facing account, authentication, account-linking, and single sign-on features you request. If you choose to sign in to a connected application, the relevant identity claims described below may be sent to that application's approved callback. Otherwise, Google profile data is not disclosed to other recipients except Cloudflare as our hosting and database infrastructure provider. We do not sell Google user data, use it for advertising, credit decisions, or train generalized AI or machine-learning models.

For more details about Google's handling of your Google Account information, read the Google Privacy Policy and the Google API Services User Data Policy.

• Create and maintain accounts; verify email; authenticate password, Google, GitHub, and passkey sign-ins; and provide account recovery.
• Provide single sign-on to the application you choose, enforce its access permissions, and return the identity claims needed for that sign-in.
• Show and manage profile information, sessions, passkeys, app access, security settings, and quotas.
• Send transactional account and security messages, respond to support and privacy requests, and operate the service.
• Protect accounts and applications, detect abuse, enforce rate limits, troubleshoot errors, and maintain audit and usage statistics.
• Meet legal obligations and establish, exercise, or defend legal claims where necessary.

Where applicable law requires a legal basis, processing is based on providing the service you request, our legitimate interests in operating and securing Auth Center, your consent for optional provider permissions, or compliance with a legal obligation.

Cloudflare. Auth Center uses Cloudflare Workers and related infrastructure for hosting, database and image storage, request security, Turnstile abuse prevention, service analytics, and transactional email. Cloudflare may process request, account, and Google-derived profile data as needed to host and operate the service. See Cloudflare's Privacy Policy.

Applications you choose to access. Only when you continue from Auth Center to a registered application, we send a signed, time-limited authentication token to that application's approved callback. Depending on the account and sign-in flow, it can contain your Auth Center account identifier, username, name, email and verification status, role, authentication provider, avatar URL, and session identifier, including Google-derived name or email used to identify you. The receiving application then handles that information under its own privacy policy.

Identity providers. Google or GitHub processes your sign-in request under its own terms and privacy notice. Auth Center sends the provider the information required to complete the authorization request and receives only the profile data described above.

Legal and safety reasons. We may disclose information when required by law or valid legal process, or when reasonably necessary to protect users, the service, or another person's rights and safety.

These service providers and the application you explicitly choose are the only routine recipients of the information described above. We do not sell or rent personal information, disclose Google user data to data brokers or advertisers, or use it for targeted, personalized, or interest-based advertising. We may also disclose information for the legal and safety reasons described above.

Auth Center uses essential, first-party storage to keep you signed in and complete secure sign-in flows. This includes HTTP-only session and refresh cookies, short-lived OAuth state cookies, and temporary browser storage used by administrator authentication, passkey setup, and your theme preference. Clearing browser storage may sign you out or make account features unavailable.

Google Analytics 4. The Google tag with measurement ID G-9NV66HSM65 loads whenever this website is opened and records page-view analytics. This website does not show an in-product analytics consent or choice prompt. You can block analytics through browser settings or Google's Google Analytics opt-out browser add-on.

For navigation within this single-page app, we send page-view events containing a generalized route, generic page label, and a sanitized referrer. Query strings, URL fragments, account identifiers in dynamic routes, account profile data, sign-in tokens, passwords, and form contents are not included in these manually sent page-view events. We do not set an Analytics user ID. Google Signals and advertising personalization signals are disabled in the tag configuration. Other automatic interaction events may depend on the measurement settings in the Google Analytics property.

Google Analytics may process event timestamps, session statistics, browser and device information, and approximate location. It may use first-party _ga cookies or related identifiers to distinguish pseudonymous browsers and sessions. For GA4, Google says it uses an IP address at collection to derive approximate location and discards the IP address before logging the data. Google processes analytics data under its own terms and privacy information; see what Google Analytics collects and Google's Privacy Policy. We do not use advertising cookies or cross-site ad tracking.

We keep account and profile information while the account remains active and for as long as needed to provide the service, resolve disputes, meet legal duties, and protect account security. If you request account deletion, we delete or de-identify account information that no longer needs to be kept, subject to legal, security, and operational records that must be retained.

Session access expires according to the account's configured lifetime and can be revoked earlier. Unverified pending registrations are automatically removed after 24 hours. Email verification links expire after 24 hours, password-reset links after 30 minutes, one-time login codes after 10 minutes, and OAuth sign-in transactions after 10 minutes. Temporary test identities and sessions end at their configured expiry; related audit or usage records may be retained for security and service reporting.

We retain analytics and security records only as needed for service operation, fraud prevention, and reporting. Google Analytics event retention follows the retention period configured for the Analytics property; the service administrator can adjust that setting. Google Analytics events are not joined to your Auth Center account by email or a user ID. Backups and provider-held copies may take additional time to expire. You can request access to or deletion of information by contacting us as described above.

You can update supported profile details, manage passkeys, sign out, and review or revoke active sessions through Auth Center account settings. You can also ask us to provide a copy of your data, correct it, delete your account, restrict or object to processing, or unlink a sign-in provider, subject to applicable law and verification of your request.

To delete Google-derived information or unlink Google sign-in, revoke Auth Center's access in your Google Account settings and email us at yysy.rhy@gmail.com. Revoking provider access prevents future authorization but does not by itself delete information already stored in your Auth Center account. Account deletion requests are handled by the service administrator; include the account email or username, and do not send your password or a sign-in code.

Your rights depend on where you live. Where available, you may also complain to your local data-protection authority. We may ask for information needed to verify your identity before acting on a request.

Connections to the website and its services use HTTPS/TLS to protect information in transit. We apply access controls and the security features available in our hosting and identity infrastructure; Google authorization codes and access tokens are used only for the short-lived sign-in flow. Some legacy or manually managed accounts may have password records accessible to an authorized administrator, as disclosed above, so use a unique password. No online service can guarantee absolute security. Cloudflare and identity providers may process information in locations outside your country; where required, appropriate safeguards apply to international transfers.

We may update this policy when the service or its data practices change. We will update the date at the top of this page. If a change materially affects how we use Google user data or other sensitive account information, we will provide notice through the service or an account communication where required.