Privacy policy

Last updated: 2026-10-10

1. Controller

Controller within the meaning of the General Data Protection Regulation (GDPR):

Email: yaroslavnashyvan@gmail.com
Phone: +491627491111

2. Overview

sso.nashyvan.com is the shared sign-in service for the apps listed on the home page: one account, used to sign in to each of them. This policy covers the sign-in service only; each app processes your data in that app under its own privacy policy. We process personal data only as far as running your account and signing you in require. There is no advertising, no tracking, no analytics or marketing cookies, and no third-party content embedded in the pages. Fonts are served from our own server.

3. Hosting and server

The service runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data center in Germany. Hetzner processes the data on our behalf (Art. 28 GDPR).

When you open a page, the server necessarily processes your IP address and the requested address. To prevent abuse, sign-in attempts per IP address are counted in memory only (one hour at most) and are not stored. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

4. Your account

Your account consists of your email address, whether it is verified, your name (if you give one), when the account was created, and when you last signed in. If you set a passcode, we store it only as a secure hash, together with its length. If you link a Google account, we store its ID. The legal basis is the performance of the contract of use (Art. 6(1)(b) GDPR). You can change your name, passcode, and Google link on your account page at any time.

5. Signing in

Email codes. When you sign in with your email address, we send you a one-time six-digit code. It is stored only as a hash, with the IP address that requested it, and expires after 10 minutes.

Sessions. When you sign in, your browser receives a session cookie (section 8). We store the session with a hash of its token, your IP address, your browser identification (user agent), and when it was created and last used. A session ends after 30 days or when you sign out; you can sign out of all devices on your account page.

Sign-in log. For every sign-in attempt we record the time, the email address entered, the IP address, the browser identification, and whether it succeeded (and why not). Your recent sign-ins are shown on your account page so you can spot misuse. The legal basis is our and your legitimate interest in protecting your account (Art. 6(1)(f) GDPR).

Continue with Google. If you choose it, you are sent to Google, which learns that you sign in with us. Google tells us your email address, whether it is verified, and your Google account ID; we store the ID to recognize you next time.

6. Signing in to an app

When you sign in to one of the apps, it receives your account ID, your email address, whether it is verified, and your name — nothing else. The one-time code used for this hand-over is stored only as a hash and expires after two minutes. We record which apps you have signed in to, and when you first and last did, to show them on your account page. The legal basis is Art. 6(1)(b) GDPR.

7. Emails

Sign-in codes are sent through Resend (Resend, Inc., USA), which acts on our behalf (Art. 28 GDPR); it receives your email address and the message.

8. Cookies

We only use cookies that are strictly necessary (§ 25(2) no. 2 TDDDG); no consent is required for them:

• sso_session: keeps you signed in, up to 30 days;
• google_oauth_nonce: protects a sign-in with Google against forgery, 5 minutes.

9. Recipients and transfers to third countries

Recipients of your data are Hetzner as our host, Resend for sign-in codes, Google if you sign in with Google, and the apps you sign in to (section 6). Beyond that we do not pass your data on unless we are legally obliged to. Resend and Google may process data in the USA; such transfers rely on the EU–U.S. Data Privacy Framework or the EU standard contractual clauses (Art. 45, 46 GDPR).

10. Storage period

We keep your account, its sign-in log, and the list of apps you use until you ask us to delete your account. Sessions are kept until they expire or you sign out. Database backups are kept for 14 days at most.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). To exercise them, write to the email address in section 1. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work, or of the alleged infringement.

There is no automated decision-making within the meaning of Art. 22 GDPR. An email address is required to have an account; without it we cannot provide one.

12. Changes

We update this policy when the service or the law changes. The version published here applies. See also the legal notice.