Privacy

We store granted scopes, generation times and, when user:read was granted and identity lookup succeeds, the Kick user ID for aggregate statistics. Credentials, PKCE verifiers and requester emails are encrypted. Authorization attempts and browser results expire after ten minutes; workflows and queued emails expire after 24 hours. Used credential payloads are removed; expired payloads are cleared each minute. Aggregate generation records have no automatic deletion schedule. Backups have their own retention.

Token requests send the generated tokens directly by email through Resend. Only authorize requesters you trust. Cookies support OAuth and language selection; local storage stores only the theme. Application secrets and tokens are not saved in browser storage. Cloudflare handles traffic; your chosen AI provider has its own data policy.

Operational events are sent to the maintainer’s private ntfy inbox. Token-request alerts include the requester’s name, email, selected permissions, and network metadata. Tokens, application secrets, and private retrieval links are excluded.