Privacy Policy
Version 2026-10-10, in effect from 2026-10-10. 中文
Who we are
Owwsolution runs Owwsolution Accounts (accounts.owwsolution.com), the sign-in service for its apps. This policy explains what the sign-in service keeps about you, why, and for how long. Each app has its own privacy policy for the data it keeps.
What we keep
We keep only what the service needs to work and to stay secure:
- your email address, the display name you choose, your language, and which version of the terms you accepted and when;
- if you link Google: the identifier Google gives your Google account (never your Google password);
- for each device you are signed in on: a short description of the browser and system (for example Firefox on Windows), when it was first and last used, and a keyed hash of its IP address;
- your last 10 activity records (sign-ins, sign-ins to an app, and changes on your account page), each with its time, the device description, the IP address shortened to its network (for example 203.0.113.x) and the country it comes from;
- how many times you signed in on each of the last 7 days, by sign-in method;
- which apps you have signed in to, and when you first and last used each;
- a security log of events such as sign-ins, wrong codes and account changes, which shows email addresses only masked (for example a***@example.com) and IP addresses only as keyed hashes;
- if you change your email address: the old and the new address, encrypted, so that support can give the account back to you if someone else took it over.
We never keep a full IP address in readable form, and we never keep sign-in codes or session tokens in a usable form.
Why we keep it
We use your data to sign you in and keep you signed in; to tell the apps you sign in to who you are; to send you sign-in codes and security notices; to protect your account and the service against misuse, for example with limits on codes and attempts; and to help you when you contact support.
Owwsolution's administrators can see your account data to support you and to protect the service; each time they open your activity or your past email addresses, that is recorded.
We do not sell your data, show advertising or build profiles about you.
Who receives it
These service providers handle data for us, only for the purposes listed:
- Google Cloud, in the United States: hosts the service and its database;
- Cloudflare: carries the traffic to the service and runs the human check (Turnstile) on the sign-in page;
- Resend: sends our emails (sign-in codes and notices);
- Google: only if you choose to sign in with Google.
The apps you sign in to receive your account identifier, email address, display name and language, and are told when your account changes or is deleted.
Your data is stored and processed outside Hong Kong, including in the United States.
How long we keep it
- A sign-in on a device lasts at most 60 days, and ends after 14 days without use; its record is deleted 90 days after it ends, so that we can recognise a new device.
- Activity records: only the last 10; each new record replaces the oldest. Daily sign-in counts: 7 days.
- Sign-in codes: valid for 10 minutes at most and deleted soon after. Records of wrong codes for an address: up to 30 days after the last one, kept only as a keyed hash of the address.
- Your account: until you delete it. A deletion takes effect after 7 days, during which you can restore the account; then your email address, name, sign-in methods, sessions, activity records and the encrypted addresses are erased.
- The security log keeps the account identifier and the masked addresses already written to it, also after an erasure.
Your choices and rights
On your account page (/account) you can see and change your display name and language, change your email address, see your devices and sign them out, see the apps you have used, link or unlink Google, and delete your account.
You can also ask for a copy of your data, or for it to be corrected or deleted: write to [email protected] from the address of your account. We reply to an access or correction request within 40 days.
Cookies
We use only the cookies the service needs to work, none for advertising or analytics:
- __Host-accounts_session keeps you signed in on this device (at most 60 days);
- __Host-accounts_device recognises this browser, so that we can tell you about sign-ins from new devices (400 days);
- __Host-accounts_flow ties a sign-in code to the browser that asked for it (30 minutes);
- __Host-accounts_csrf protects our forms against requests sent from other sites (until you close the browser);
- __Host-accounts_lang remembers your language (1 year).
Cloudflare, which carries our traffic and runs the human check, may set cookies of its own that are needed for security.
Security
Sign-in codes, session tokens and keys are stored only as hashes or encrypted. Our emails never contain sign-in links.
Changes to this policy
When this policy changes, we publish the new version on this page with its date, and we tell you before an important change takes effect.
Contact
Questions or requests about your data: [email protected].