Privacy Policy

1. What Information We Collect

MU Auth collects only the data required to operate a secure identity platform for Mega Utilities and connected applications.

1.1 Account Information You Provide

• Email address (optional for passwordless accounts)
• Username
• Randomly generated user ID (assigned automatically at account creation)
• Nostr identity: npub and nprofile (when logging in via Nostr)
• OAuth2/OIDC profile data (only when you authorize an app and approve scopes)

1.2 Authentication Credentials

We never store plaintext passwords or private keys.

• Password verifiers: Zero‑knowledge password proofs (PBKDF2 → Argon2) or PAKE envelopes (OPAQUE).
• Passkeys: WebAuthn public keys only. Private keys never leave your device.
• Nostr login: We receive your npub and nprofile. Your nsec never touches our servers.
• TOTP 2FA: Encrypted TOTP secret metadata and hashed backup codes.
• Backup codes: One‑time use codes stored only as salted hashes.
• Recovery ID: A randomly generated identifier used for passwordless account recovery.
• Support ID: A non‑sensitive identifier used by support staff to assist with account recovery.
• Device tokens: Public portions of device‑bound keys.
• Recovery keys: Encrypted client‑side; we store only ciphertext.

1.3 Technical & Security Data

• Hashed IP addresses: Raw IPs are never stored; they are salted and hashed immediately.
• Session metadata: Session IDs, token issuance timestamps, expiration times.
• Audit logs: Login attempts, OAuth approvals, security events. Logs are retained for up to 12 months.
• User-Agent & device information: Used for security and fraud prevention.

2. Cookies & Local Storage

MU Auth uses only essential cookies required for authentication and account functionality.

• access_token — HTTP‑Only, Secure; used to authenticate your session.
• refresh_token — HTTP‑Only, Secure; used to obtain new access tokens.
• sid — Session identifier used to maintain login state and correlate browser sessions.
• csrf_token — Used to protect against cross‑site request forgery (CSRF) attacks.
• mu_session — Internal session cookie used for login flows.
• recent_accounts — Optional convenience cookie used to display accounts you recently logged into.

No advertising cookies, no tracking cookies, no third‑party analytics cookies.

3. How We Use Your Data

We use your data only to operate MU Auth and provide secure login across Mega Utilities services.

• Authenticate your identity using your chosen login method.
• Maintain secure sessions.
• Provide OAuth2/OIDC access to apps you authorize.
• Prevent fraud, abuse, and unauthorized access.
• Support account recovery (email changes, password resets, recovery ID workflows).
• Moderate MU Auth accounts and respond to abuse reports.

4. Third‑Party Services

MU Auth uses limited third‑party infrastructure:

• Sentry.io: Error reporting. We do not send personally identifiable information.
• OAuth2/OIDC apps: Only receive data you explicitly approve via scopes.

We do not sell, rent, trade, or monetize your data.

5. Law Enforcement Requests

If legally required, we may place a temporary law hold on your account. This prevents deletion or modification while a lawful request is processed. We do not provide data unless required by applicable law.

6. Data Retention & Deletion

• Audit logs: Retained for up to 12 months.
• Account deletion: A 30‑day grace period applies. After that, all personal data, credentials, sessions, and identifiers are permanently removed.
• Recovery keys: Deleted immediately upon account deletion.
• Backup codes: Deleted immediately upon account deletion.

7. Your Rights

• Data Export: You may export your account data in JSON format.
• Account Deletion: You may delete your account at any time.
• Scope Control: OAuth2/OIDC apps only receive data you explicitly approve.

8. Contact Us

For privacy questions or support, visit our Help & Support Center.