How Ceptor Labs handles your data.

What we collect

• Ceptor ID account: your name, email address, whether your email is verified, and your password, which is stored only as a one-way hash.
• Sign-in sessions: when you sign in we keep a session record with the time, your IP address and your browser's user agent, so you stay signed in and suspicious sign-ins can be investigated.
• Product authorizations: which Ceptor Labs products you have authorized, which permissions you granted and when, plus the tokens issued to those products.
• Sign in with Google: if you choose it, we receive your Google account ID, name, email address, email verification status and profile picture from Google.
• Contact form: the name, email address, organization and message you submit. For rate limiting we keep a one-way hash of your IP address, never the address itself.

How we use it

We do not sell your personal data, use it for advertising, or use it to train AI models. This website does not use advertising or analytics cookies.

• To create your Ceptor ID, sign you in, keep your account secure and send the one-time codes that verify your email or reset your password.
• To let the Ceptor Labs products you choose sign you in, sharing only the permissions you approve.
• To answer the inquiries you send us.

What products receive

When you sign in to a Ceptor Labs product with Ceptor ID, the consent screen lists what the product requires and what is optional. The product receives a stable ID for your account plus only the permissions you tick, such as your email address or name. Other products' data is never included.

You can revoke a product's access at any time from your Ceptor ID account page. Revoking stops future sign-ins through Ceptor ID; data the product already holds is covered by that product's own policy.

Google user data

Ceptor ID requests only the basic Google profile, email and OpenID permissions. We use the Google data listed above solely to create your Ceptor ID and sign you in. We do not use Google user data for advertising, do not sell it, and do not transfer it to others except the Ceptor Labs products you authorize, as described above, or where required by law.

Ceptor Labs' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies and storage

Ceptor ID sets only the cookies needed to keep you signed in and to complete a sign-in safely. On product websites, the Ceptor SDK keeps the product's sign-in in the browser's session storage, which is cleared when you sign out or close the tab, unless the product chooses to remember you.

Where your data is stored

We use these service providers to run the website and Ceptor ID. They process data on our behalf:

• Vercel: hosts the website and passes requests to our sign-in service.
• Railway: runs the Ceptor ID sign-in service, in Singapore.
• MongoDB Atlas: stores Ceptor ID accounts, sessions, authorizations and contact inquiries, on AWS in Singapore.
• Google: provides Sign in with Google, if you choose to use it.
• An email delivery provider: sends verification and password reset codes.

How long we keep it

We keep your account for as long as it exists. Expired sessions, codes and tokens can no longer be used. Contact inquiries are kept as long as needed to respond and follow up.

Your choices

• See and revoke the products you have authorized on your Ceptor ID account page.
• Ask us for a copy of your data, to correct it, or to delete your Ceptor ID and everything linked to it, through the contact page. We will confirm the request comes from the account owner before acting.
• If you signed in with Google, you can also remove Ceptor ID's access from your Google Account settings.

Security

Passwords are hashed, all traffic uses HTTPS, products sign in with PKCE and never receive your password, and access tokens expire. No system is perfectly secure; if you find a vulnerability, please report it as described on our security page.

Children

Ceptor ID is not intended for children under 13, and we do not knowingly collect their data.

Changes and contact

If we change how we handle data, we will update this page and its date. For anything about privacy, reach us through the contact page.