Legal
Privacy
What REAL AUTH collects, why, how long it is kept, and what it refuses to collect at all.
What this covers
This describes personal data processed by REAL AUTH for its own accounts and website. Where REAL AUTH verifies identities on behalf of a customer, that customer decides what is verified and why; this page covers our side of that arrangement.
What is never collected
No biometric data of any kind. No fingerprint images or templates, no face or iris templates, no Face ID, Touch ID or Windows Hello material. Biometric verification happens inside your device and never reaches this platform. Private keys likewise never leave your device.
What is collected for an account
An email address, an optional display name, a chosen language, and the public key and metadata for each passkey you register. Passwords, where used, are stored only as an Argon2id hash.
What is collected when you sign in
The time, the IP address, a coarse indication of the browser and platform, and the outcome. This is used for the security timeline you can see on your own account, for the risk engine, and for investigating abuse. It is not used to build an advertising profile, and REAL AUTH runs no advertising or third-party analytics.
Cookies
A single session cookie, set only once there is something to remember, and a language preference. No tracking cookies and no third-party cookies. The cookie page describes each one.
How long things are kept
Account data for as long as the account exists. Sessions until they expire, then marked revoked and deleted after ninety days. Security events for a bounded retention period per plan. Billing records for the statutory period, which is longer than we would otherwise keep them.
Your rights
You can export your data, correct it, or ask for the account to be deleted. Deletion removes account data but not records that must be retained: security logs relevant to an active fraud investigation, and billing records within their statutory period. We will tell you specifically what was kept and why.
Sub-processors and location
Data is stored on infrastructure located in the United Kingdom. Where an external service is used for outbound email or payment processing, it is listed in the developer and billing areas before it handles any of your data. No customer data is sold or shared for marketing.
Security of this data
Secrets are encrypted at rest with a key held outside the web root, credentials are stored as digests, and access is logged in an append-only audit trail. The security page describes the design in more detail, including its limits.
Changes and contact
Material changes will be announced before they take effect rather than applied quietly. Questions about data go to support@real-auth.com; security concerns to security@real-auth.com.