Privacy
Short answers about what identity stores, who receives it, and how to export or erase it, with links to the privacy notice.
On this page
These answers summarise the privacy notice, which is the authority. If an answer here and the notice differ, follow the notice and tell us.
What identity holds#
What data does identity store about me?#
Your email addresses and profile details, the credentials you set up (a password hash, public keys of passkeys, encrypted authenticator secrets and keyed hashes of recovery codes), your sessions and devices, your consents, your organization memberships, and an audit record of security events. The notice lists every category with its purpose and retention. See Privacy notice.
Does identity see my password or my fingerprint?#
No. Only a hash of a password is stored. A passkey check with your fingerprint or face happens on your device and is never sent. See the "Data we do not collect" section of the privacy notice.
Does it track me for advertising?#
No. The platform sets no advertising or analytics cookies and loads no third-party scripts, and it has no profiling feature. See Cookies.
Does it use my location?#
It keeps the country and city of the place a session started, to show you where you are signed in, and only coarse values. See Sessions and devices and the privacy notice.
Who receives it#
Which applications see my data?#
An application you sign in to receives the identifier and the claims in the scopes it asked for. An application registered for pairwise identifiers sees an identifier that is different from the one every other application sees. A third-party application also needs your consent, which you can review and revoke on Connected apps. See Connected applications and Scopes.
Who else is involved?#
Infrastructure vendors process data to run the service. The subprocessor list is the single place to check them. Organizations you belong to see your membership, role and status.
Is my data sold?#
No. The notice states that the platform has no mechanism for selling data.
Your rights#
How do I get a copy of my data?#
Open Your data, then the Export tab, and select Request a data export. You are emailed when it is ready and can download a signed JSON file and a CSV for a limited time. The request needs a recent second factor. See Export and delete your data.
How do I correct my data?#
Edit your profile and email addresses in your account. See Your account.
How do I delete my data?#
Close your account under Your data, then Close account. The account is deactivated at once. Your personal data is erased after a waiting period, and some records, such as the audit record, are kept as the notice explains. See Export and delete your data and Retention and deletion.
What if I cannot sign in and want my data?#
The notice gives a contact address for requests that the account pages cannot do. See Privacy notice.
How long is data kept?#
Each category has its own schedule. A session record loses its network address after a period, a sign-in in progress lasts minutes, and the audit record is kept for years by default. See Retention and deletion.