Software KC OAuth Privacy Policy

Last Updated: 10/29/2026

This policy adds to our Product Privacy Policy for Software KC OAuth, our hosted sign-in service. The Product Privacy Policy covers your own account as a subscriber. This supplement covers the information we handle for your end users: the people who register and sign in through your applications. If the two disagree, this supplement applies for Software KC OAuth.

It's written for the developers and companies that integrate Software KC OAuth. Your end users should learn how sign-in works from your privacy policy. They manage their accounts on the account website, described in the Software KC Account Privacy Policy.

1. Our Role

  • We handle your end users' sign-in information on your behalf, as your service provider, and only to provide sign-in for your applications.
  • End-user accounts belong to your subscription. We don't share them with other subscribers, sell them, or use them for advertising.
  • Your privacy policy should explain to your end users that sign-in is provided by a service provider and what your applications do with the information they receive.

2. What We Store About End Users

  • The account details needed to sign them in, such as their name, email address, and the identifiers from the login methods they use.
  • For user name and password sign-in, a hashed password. We never store passwords in readable form.
  • Their two-step verification setup, if they turn it on.
  • Temporary sign-in records: the records behind sign-in cookies, sign-ins that were started but not finished, and records of access tokens issued to your applications.

End-user information, including those temporary records, is encrypted so that only the end user can read it when they sign in. Our staff can't read it.

3. What Each Login Method Shares With Us

  • Google and Microsoft: basic profile details, typically name, email address, and account identifier, through the provider configuration you supply.
  • Custom OAuth providers (for example Apple or Meta): whatever that provider returns under the configuration you choose. Check what each provider shares before you enable it.
  • User name and password: the details the end user enters when they register.

Providers may use their own security features, such as biometric sign-in. That happens with the provider, under its privacy policy, and isn't shared with us.

4. What Your Application Receives

When an end user signs in, your application receives the standard OAuth response. It can also request the end user's name, user secret, and client user secret. Once your application receives this information, your privacy policy and your security practices apply to it.

5. Cookies

Our sign-in pages use essential cookies to keep one or several accounts signed in at the same time and to protect the sign-in process. Sign-in can't work without them, so they can't be turned off.

6. Who We Share It With

  • Your applications, as described above.
  • The login provider an end user chooses, as part of signing in.
  • Service providers that host and run the platform, only as needed to provide the service.
  • When the law requires it, such as in response to a valid legal request. Where the law allows, we'll tell you first.

7. End-User Requests

If your end users want to see, correct, or delete their information, they should contact you. If they contact us, we'll refer them to you, and we'll help you answer requests about the sign-in information we handle for you. End users can also disconnect linked accounts, revoke an application's access, or delete their account themselves on the account website.

8. How Long We Keep It

  • We keep your end users' accounts while your subscription is active.
  • Temporary sign-in records are deleted within 90 days. The records behind sign-in cookies are replaced regularly, and any that go unused for more than a month are deleted sooner.
  • After your subscription ends, we delete your applications' configuration and your end users' accounts within a reasonable period, except where the law requires us to keep something longer.

9. Children

Software KC OAuth isn't designed for applications directed to children under 13. If yours is, contact us before you use it.

10. Contact Us

Questions about this policy? Reach us at: