auth.mss.io Privacy Policy

auth.mss.io (the "Service") is the sign-in service operated by Mario Stefano Suharja, doing business as MSS, in Calgary, Alberta, Canada ("MSS", "we", "us"). This policy explains what personal information the Service collects when you create an account or sign in, why, and what choices you have.

We handle personal information in line with Alberta's Personal Information Protection Act (PIPA) and, where it applies, the federal Personal Information Protection and Electronic Documents Act (PIPEDA). Our privacy contact is reachable at auth-contact.epilogue605@passinbox.com.

This policy covers the Service only. Each application you sign in to (a "Connected Application") handles the information it receives under its own privacy policy.

We use your information only to run the Service: creating and securing your account, signing you in, sending verification and security emails, detecting abuse, and meeting legal obligations. By creating an account you consent to these uses. We do not sell your personal information, use it for advertising, or use it to train AI models.

We share information only in these cases:

• Connected Applications you sign in to: They receive the details shown on the consent screen (typically a unique ID, email and name). You can revoke access later.
• Service providers that help us operate the Service, under contracts that limit their use of the data:
  • Cloudflare, Inc.: Network security and secure tunnelling; your connection to the Service passes through its global network, including the United States.
  • Resend: Delivering verification and security emails.
• Legal reasons: When required by law, a court order or a valid legal request, or to protect the safety of users or the Service.
• Business transfer: If the Service is sold or merged, information may transfer to the new operator, who must honour this policy.

Information processed by service providers outside Canada may be accessible to courts and authorities in those countries under their laws.

Account data is stored on servers we operate in Calgary, Alberta, Canada.

We protect it with reasonable safeguards, including encrypted connections (TLS), hashed passwords, multi-factor authentication options, network isolation of the database and administrative interfaces, restricted administrator access, and regular security updates. No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the relevant privacy commissioner as the law requires.

We do not currently keep backups of account data. Information that is deleted, whether at your request or through a system failure, cannot be recovered. We will update this policy before we start keeping backups.

The Service uses only strictly necessary cookies: session cookies that keep you signed in, and security cookies that protect sign-in flows against forgery. Cloudflare may also set a cookie to filter malicious traffic. We do not use analytics, advertising or tracking cookies. Blocking these cookies will prevent sign-in from working.

You can:

• Access the personal information we hold about you and learn how it has been used and shared.
• Correct information that is inaccurate or incomplete (most details can be edited in your account settings).
• Withdraw consent and delete your account, subject to legal limits. Deleting your account ends your ability to sign in to Connected Applications through the Service.
• Revoke a Connected Application's access at any time.

Send requests to auth-contact.epilogue605@passinbox.com. We may need to verify your identity first, and we will respond within 30 days, or tell you if we need an extension the law allows.

If you are not satisfied with our response, you can complain to the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada.

The Service is not intended for children under 13, and we do not knowingly collect their information. If you believe a child under 13 has created an account, contact us and we will delete it.

We may update this policy. We will change the "Last updated" date, and for material changes we will notify you by email or at sign-in before they take effect.