Privacy policy
This policy explains what MyLogin.world handles when an app owner uses the dashboard and when a person signs in to an app through it.
Signing in to an app
When you sign in to someone’s app through MyLogin.world, the page shows the provider buttons that app chose. If you use Google or another provider, the provider sends an authorization code or token to our page; we pass it to the app over a connection the app opened and delete it once delivered, usually within seconds. If you use a passkey, our page runs the browser ceremony and passes the signed response to the app. We do not read, store, or verify any of it, and we never learn who you are. The app that receives it is responsible for how it is used; read that app’s own policy.
What we keep about sign-ins
For each sign-in request: which app it belonged to, when it started and finished, which method was used, and the requesting IP address, for abuse prevention and audit. We never receive anything that identifies the person who signed in, and we count only sign-ins per app.
App owners
Your dashboard account is your email address and name as released by the provider you sign in with, plus any passkeys and authenticator-app secret you add for the dashboard itself, encrypted at rest. We keep your services, their addresses on our domain, an audit log of changes with timestamps and IP addresses, and subscription status reported by your payment provider. We never hold card or bank details.
Managed provider clients
If an app uses our managed provider client, the provider’s token passes through our server once so it can be delivered to the app, then it is discarded. If the app uses its own client, no token ever reaches us.
Sharing
Identity providers receive the request you initiate. The app you sign in to receives the provider response. Payment providers receive what they need to process a subscription. No one else, unless the law requires it. We do not sell data and we do not profile anyone.
Retention
Sign-in requests and their payloads are deleted within 24 hours of completion or expiry. Audit history is kept for the period of the account plan. Dashboard accounts and services are kept until deleted by their owner.
Your controls
App owners can export and delete their account from the dashboard. Because we hold nothing about people who sign in to apps, there is nothing for them to delete here; the app they use holds their account.
Cookies
A short-lived cookie on our login pages ties a sign-in request to your browser. The dashboard uses a session cookie on its own domain. No third-party or advertising cookies.
Changes and contact
The date above changes when this policy changes; material changes are announced on the status page. Questions: support@mylogin.world.compas.cs.stonybrook.edu.