Arthur ID

Privacy Policy

Last updated: September 2025

Arthur ID is a single sign-on (SSO) and identity provider service. This policy describes what information we collect, how we use it, and the choices you have.

Information we collect

Account information — email address, phone number, username, display name (given name and family name), locale, and timezone.
Authentication data — password hashes (stored as Argon2id digests, never in plaintext), email verification codes, and one-time sign-in codes.
Session data — browser user agent, IP address, and session timestamps when you sign in.
OAuth client associations — which third-party applications you have authorized and the scopes granted to each.

How we use your information

To authenticate your identity when you sign in or register.
To create and maintain your login session.
To send you verification codes, password reset links, and security notifications by email or SMS.
To display your active sessions so you can review and revoke them.
To issue identity tokens (ID tokens) to applications you authorize, containing only the claims those applications have requested and you have approved.

What we share with applications

When you sign in to a third-party application through Arthur ID, that application receives only the information it requests via OAuth scopes — typically your email address, name, and a stable user identifier. Applications do not receive your password, password hash, verification codes, or session data. You can review which applications have access from your session list after signing in.

Cookies

Arthur ID uses a single first-party cookie to maintain your login session. The cookie is:

HttpOnly — not accessible to JavaScript.
Secure — transmitted only over HTTPS.
SameSite=Strict — not sent on cross-site requests.
Removed when you log out or when it expires.

We do not use tracking cookies, advertising cookies, or third-party analytics.

Data retention

Sessions are retained until you log out, revoke them, or they expire.
Verification challenges (sign-in codes and reset links) are deleted after they are used or after a short expiry period.
Account information is retained for as long as your account is active. An administrator can revoke your account, which prevents further authentication.
Audit events (records of sign-ins, registrations, and challenge attempts) are retained for operational and security purposes.

Data sources

Your account information may be provisioned from an approved data source such as a Google Sheet or CSV/TSV file maintained by your organization's administrator. Changes made in those source files are synchronized to Arthur ID. Arthur ID does not write back to those sources.

Security

Passwords are hashed with Argon2id and never stored or transmitted in plaintext.
All network traffic is encrypted with TLS.
Signing keys are Ed25519 and stored as JWK files on the server.
Passwords are checked against known breach databases (HIBP) at registration and reset.

Your rights

Access — you can view your account email and active sessions after signing in.
Revocation — you can revoke individual sessions from the session list.
Account changes — contact your administrator to update your email, name, or other profile fields, or to deactivate your account.

Contact

Questions about this policy or your data should be directed to your organization's administrator.

← Back to sign in