Privacy Policy

Effective 2026-09-26

This Privacy Policy describes how apiaryID LLC ("apiaryID", "we", "us") collects, uses, and shares information about you when you use our identity and access management platform (the "Service"). The Service includes account registration, authentication, single sign-on for connected apps, and the workspaces and subscriptions that run on top of those primitives.

1. Who is responsible for your data

Your apiaryID account is yours, and it works across every app that uses apiaryID. For that account (your email address, your credentials, your sign-in methods and devices, and the security records that protect them), we are the controller, and this policy applies.

Each app you sign in to is operated by a workspace customer, not by us. What an app knows about you (your membership, roles, and subscription in that app, and anything the app itself collects) is controlled by that workspace customer, and we process it on their behalf. Their privacy notice, not this one, governs it. Questions or requests about an app's data should go to the app; if you can't reach them, contact us and we'll help.

2. Information we collect

• Account information. Email address, name, phone number if you add one, and locale.
• Authentication credentials. Password hashes (never the password itself), passkey public keys, hashed recovery codes, and encrypted authenticator secrets. Plaintext passwords are not retained.
• Devices and security data. Sign-in events, IP address, browser user agent, and timestamps, plus a record of the devices you've signed in from so we can recognize them and alert you to new ones.
• Workspace and subscription data. Membership, role assignments, and plan selections for the workspaces and apps you belong to, and records of the permissions and terms you accept.
• Billing information. When you subscribe to a paid plan, payment is processed by Stripe. We receive subscription status and identifiers but never full card numbers or bank-account details.
• Information from third-party sign-in. If you sign in with Google, we receive the attributes Google releases: your email address, whether it is verified, your name, and a stable user id.

3. How we use information

• To provide, operate, and maintain the Service, including authentication, token issuance, and authorization decisions.
• To secure accounts and infrastructure: recognizing your devices, detecting credential abuse, rate-limiting suspicious traffic, and alerting you to sign-ins from new devices.
• To bill and collect fees through Stripe.
• To send service-related messages: account confirmations, sign-in codes, security alerts, and workspace invitations. We do not send marketing without separate, explicit consent.
• To monitor performance and diagnose errors, and to analyze usage in aggregate so we can improve the Service.
• To comply with applicable law, enforce our Terms of Service, and respond to lawful requests.

Where the law requires a legal basis, we rely on performing our contract with you, our legitimate interest in keeping the Service secure, your consent where we ask for it, and our legal obligations.

4. Sharing and disclosure

We share information only as needed to operate the Service or as required by law.

• The apps you sign in to. When you sign in to an app, we share the information you approve on the consent screen (for example your email address, name, and your roles in that app) with the workspace customer that operates it. Its administrators can also see your membership and sign-in activity in their workspace.
• Service providers. These process data on our behalf under contractual confidentiality and security obligations: Microsoft Azure (hosting, storage, encryption keys, and monitoring); Stripe (payments); Resend (email delivery); Twilio (text-message codes, only where an app has enabled them); and Cloudflare Turnstile (bot protection on sign-in and registration forms).
• Sign-in providers. If you choose to sign in with Google, Google learns that you signed in to apiaryID, under Google's own privacy policy.
• Legal compliance. We may disclose information when we have a good-faith belief it is necessary to comply with law or valid legal process, or to protect the rights, property, or safety of users or the public.
• Corporate transactions. If apiaryID is involved in a merger, acquisition, or asset sale, user information may transfer with the business; you'll be notified before any such transfer materially changes how your data is handled.

We do not sell or share personal information for advertising.

5. Cookies

We use only cookies the Service needs to work: keeping you signed in, protecting forms against forgery, remembering a device where you asked us to, and recognizing devices you've signed in from before. We don't use advertising or third-party analytics cookies. Cloudflare Turnstile may set its own cookies when it checks that a form is being submitted by a person.

6. Data retention

• Account information is kept while your account is active. When you delete your account it is removed, apart from the records below.
• Security records about your account (such as credential changes and a record of the deletion itself, which include your email address) are kept after deletion so we can investigate abuse.
• An account whose email address is never confirmed is deleted after 30 days.
• A record of a device you've signed in from is deleted after 90 days without use.
• Workspace activity logs are kept for the period set by the workspace's plan.
• Records of the permissions you grant apps and the terms you accept are kept as long as we need them to show what was agreed, which may be longer than the account itself.
• We also keep information where the law requires it or to resolve disputes and enforce our agreements. Backups roll off on standard cycles.

7. Security

We protect information in transit with TLS and at rest with encryption, with keys managed in Microsoft Azure Key Vault. Passwords are hashed, sign-in attempts are rate-limited, and access to production systems is limited to authorized personnel using multi-factor authentication.

No system is completely secure, and we cannot guarantee that information will never be accessed, disclosed, or altered without authorization. You help protect your account by using a strong, unique password and adding a passkey or authenticator app. If we learn of unauthorized access to your personal information, we will notify you and the affected workspace customers without undue delay and as required by law.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information; to object to or restrict certain processing; and to withdraw consent where processing relies on it. You can update your profile, review and remove connected apps, remove devices, and delete your account from your account-management page. For anything else, contact us at the address below. For data an app controls, contact the app (see Section 1). You may also complain to your local data-protection authority.

9. Children

The Service is not directed to children under 13. We do not knowingly collect information from children under 13; if you believe a child has provided us information, contact us and we will delete it.

10. International transfers

We may process your information in countries other than your own, including the United States. Where the law requires, we use appropriate safeguards for those transfers, such as the European Commission's Standard Contractual Clauses.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced via the Service or by email before they take effect.

12. Contact

For privacy questions or to exercise your rights, contact privacy@apiaryid.com.