Privacy Policy
Speedle Cloud is operated by the Speedle Cloud team. Contact: [email protected].
This policy explains how Speedle Cloud uses information to provide hosted Speedle+ authorization, protect accounts and operate the service.
Google sign-in: data and purpose
Speedle Cloud is an access-control service for developers. You create policies in SPDL and call its authorization API to check whether a subject may perform an action on a resource. Google sign-in identifies the person who owns and manages your Speedle Cloud account; it does not import policy content or authorization subjects from Google.
When you choose Google sign-in, we request only the openid and email permissions. We receive your Google account's stable identifier and verified email address to create or identify your account, link the sign-in method you choose and verify sensitive account actions. We do not request access to Gmail, Google Drive, contacts, calendars or photos, and do not use or store a Google profile name or photograph.
We store the linked Google identifier and verified email with your application account in our Cloudflare-hosted database. Short-lived sign-in and confirmation records and essential cookies support authentication. Provider credentials received during sign-in are processed transiently, not saved in the application database or application logs. These identity records are separate from the service, policy and API-token data you create.
Information we collect
- Account and sign-in information: your GitHub or Google user ID, your GitHub login name where available, and your provider-verified email address. Google sign-in does not request a profile or login name.
- Policies, service configuration and other service data you create. Avoid placing secrets or unnecessary personal information in policies.
- API token metadata and hashes used to verify tokens. API token secrets are shown only when created and stored only as keyed hashes.
- Session records and audit logs of account, sign-in, identity, policy and token activity, used for security and troubleshooting.
- IP addresses processed for rate limiting and abuse prevention. We retain only keyed hashes of IP addresses in application records and logs, not raw IP addresses. Cloudflare processes network information to deliver and protect the service.
We use this information to sign you in, associate your identities with your account, manage your policies, make authorization decisions and enforce service limits. Authorization request contents are not written to application logs. GitHub and Google tokens are used during sign-in and are not stored or logged by Speedle Cloud.
Cookies
We use only essential session cookies and short-lived sign-in cookies for sign-in security and account creation. We do not use analytics or tracking cookies. We may remember your selected language in your browser's local storage. Session cookies expire after inactivity and have an absolute lifetime limit; signing out ends the relevant session.
For security and reliability, we record account audit events and limited request metadata, such as request identifier, route category, status, duration and sign-in outcome, and produce aggregate service metrics. Application logs do not record authorization request bodies, Google account identifiers, email addresses or provider tokens. Cloudflare also processes network and security information to deliver and protect the service.
Service providers
Cloudflare hosts the service. Data is processed on Cloudflare’s global network and may be stored or processed outside your country. GitHub and Google provide sign-in and process the information needed for their respective authentication flows under their own privacy policies. Speedle Cloud requests only the sign-in and verified email information needed for your account. We do not sell your personal data.
Use and sharing of Google data
We use Google sign-in information for account authentication, identity linking, account security and operating these account features. Cloudflare processes application data to host, store, deliver and secure the service. Google independently processes its sign-in flow under its own privacy policy. We do not sell your personal data. Speedle Cloud provides access-control software and has no image or video generation features; its Google integration is used for account identity and security.
How we protect information
We use HTTPS for transport, server-side account authorization, Secure and HttpOnly session cookies, and keyed hashes for session and API-token verification. Account-management actions are checked against the signed-in account, and sensitive actions require recent authentication. These measures protect the service while it processes your data; no system can guarantee absolute security.
Retention and account deletion
We keep the account and linked-identity information needed to operate your account until you delete your account. Our account-deletion policy covers the active application-database account and its dependent identities, service, policies, API tokens and sessions, as well as published policy copies in the application cache. Database records are removed as part of account deletion; cached policy copies are covered by background cleanup. Security audit records have a 180-day retention period, including after account deletion, and are subject to periodic deletion. Expired authentication and session records are removed by scheduled retention jobs. Cache propagation and periodic cleanup are not instantaneous. Cloudflare's network and service records and Google's own records follow their respective policies. Contact us with questions or requests concerning retained information.
Your choices and rights
You can export your policies and delete your account. Export any policies you want to keep before deletion. You can manage connected sign-in identities and revoke sessions. To request access to or correction of personal information, or to raise a privacy question, contact [email protected].
In Settings, you can review connected identities and disconnect Google after connecting another sign-in method. Disconnecting Google does not delete your account or its primary email address. You can also remove the connection in your Google Account; that does not itself erase information already stored by Speedle Cloud. Use account deletion or contact us to request deletion or correction of that information.
Manage connections in your Google Account
Changes to this policy
We may update this policy as the service changes. We will publish the revised policy on this page with an updated effective date. Review it periodically to understand how your information is handled.