Legal
Last updated August 2026
When you create a Firekid Auth account, we collect the email address and username you provide, and a securely hashed version of your password. We never store your password in plain text. If you enable two-factor authentication, we store an encrypted copy of your authenticator secret and backup codes.
We also record technical information needed to operate the service securely: the IP address, device, and browser used to sign in, timestamps of sign-ins and account changes, and a log of security-relevant events such as failed sign-in attempts and password resets.
We use this information to operate your account, authenticate your sign-ins, detect and prevent unauthorized access, send account-related emails such as verification links and security alerts, and provide the developer console if you register applications.
When you sign in to a third-party application using Firekid Auth, that application only receives the specific information you approve on the consent screen, such as your email address or username. It does not receive your password, and it cannot see your activity in other connected applications. You can review and revoke any application's access at any time from your account settings.
We do not sell your personal information. We do not share your data with advertisers. We do not use your account information to build advertising profiles.
We retain your account information for as long as your account is active. Security and audit logs are retained for a limited period to support fraud detection and are periodically purged. If you delete your account, your identifying information is removed from active systems; some records may be retained where required for security investigations or legal obligations.
Passwords are hashed using argon2id and never stored in reversible form. Two-factor secrets and backup codes are encrypted at rest. Sessions and tokens are stored as hashed values. We use industry-standard practices including PKCE, token rotation, and rate limiting to protect your account.
You can update your profile information, enable or disable two-factor authentication, review and revoke connected applications, manage active sessions across your devices, and delete your account entirely, all from your account settings.
Firekid Auth uses a single essential cookie to keep you signed in across Firekid applications. This cookie is required for the service to function and is not used for advertising or tracking purposes.
We may update this policy from time to time. Material changes will be reflected by updating the date at the top of this page.
Questions about this policy or your data can be sent to the contact address listed in the footer of this site.