Privacy policy
Effective 2026-10-17
Who we are
Zautha is an authentication service operated by Hasan Talha Yalmanbas, an individual based in Türkiye ("we"). For anything about this policy or your data, write to privacy@zautha.com.
Two kinds of users, two roles
- Developers who sign in to the Zautha dashboard to build applications. For their accounts we decide how data is used, so we are the controller.
- End users who sign in to an application that uses Zautha. That application's owner decides how their data is used and is the controller; we process the data on the owner's behalf and only to provide the service. If you are an end user, contact the application you signed in to first; we will help them answer you.
What we process
- Account data: email addresses, name, username and anything an application stores in its user metadata.
- Credentials: passwords only as Argon2id hashes; authenticator-app secrets encrypted; passkeys as public keys; backup codes only as hashes.
- Sign-in with Google, GitHub, Microsoft, Discord, GitLab or Apple: the provider's account identifier, the email address and whether the provider verified it, and your name. We do not keep the provider's access or refresh tokens and ask only for the permissions needed to sign you in.
- Sessions and devices: IP address, browser and operating system, and when a session was last active, so you can see and end your sessions.
- Security data: sign-in attempts, rate limits and lockouts, to protect accounts from abuse.
- Emails we send for you: verification codes, sign-in links and security notices.
Why
- To provide the service you or the application owner asked for (performance of a contract).
- To keep accounts secure and prevent fraud and abuse (legitimate interest).
- To meet legal obligations.
We do not sell personal data, show advertising or use it to profile you.
Cookies
We only use cookies that sign-in needs: they keep you signed in and protect the sign-in flow. There are no analytics or advertising cookies.
Where the data is and who helps us
- Hetzner Online GmbH hosts our servers in Germany (EU). All account data is stored there.
- zSender delivers the emails we send.
- Google Drive stores our nightly backups. They are encrypted before they leave our server; Google cannot read them.
- Cloudflare provides our DNS.
- Zoho Mail receives and stores the mail sent to our addresses, in its EU data centre.
- Cloudflare Turnstile checks that a sign-up on a live application, or a sign-in after repeated failed attempts, comes from a person and not a bot. For that check your browser sends Cloudflare your IP address and information about your browser and device, and our server sends Cloudflare your IP address to confirm the result.
- The sign-in provider you choose (Google, GitHub, Microsoft, Discord, GitLab or Apple) receives your sign-in request under its own privacy policy.
We operate the service from Türkiye, so personal data is accessed from outside the EU for operating it.
How long we keep it
- Account data stays until the account is deleted, by you, by the application owner or by us when the application is deleted.
- Backups are kept for 14 days and then deleted.
Your rights
You can ask to access, correct, delete or receive a copy of your data, and object to or restrict its use. Write to privacy@zautha.com. You may also complain to a data protection authority: in Türkiye the Personal Data Protection Authority (KVKK), or in the EU the authority in your country.
Security
Data travels over TLS, secrets are encrypted at rest, and each application's data is isolated from every other application's at the database level.
Changes
If this policy changes, we will update this page and its effective date.