Privacy Policy

This Privacy Policy explains how OAuth 2.0 Playground ("we," "us," or "our") collects, uses, and safeguards your personal data when you visit oauthplayground.io (the "Site") or contact us through it. We handle personal data in line with the EU General Data Protection Regulation (GDPR), the UK GDPR, and, where applicable, the California Consumer Privacy Act (CCPA/CPRA).

We are the data controller for the personal data described here. If you have any questions, contact us at privacy@oauthplayground.io.

1. Data we collect

Information you provide

When you submit our feedback form, we collect the data you enter:

• your email address, so we can reply to you;
• the message you write.

If you email us directly, we receive your email address, your message, and anything else you choose to include.

Information you enter into the playground

By default, the OAuth configuration, client secrets, private keys, and tokens you enter into the playground are stored locally in your browser and are not sent to our server. Two optional features change that, in addition to the sign-in and config sync described below:

• Published JWKS keys - private keys are never uploaded for this, but a public key you choose to publish is stored on our server and served from a JWKS endpoint so authorization servers can discover it. We store the IP address that published each key alongside it, to prevent abuse of that endpoint.
• Backend proxy - where you choose to route a pushed authorization request or a token introspection request through our server rather than calling the provider directly from your browser, we receive that request - including any client credentials, tokens, and DPoP proofs it contains - forward it to the provider you named, and return the response to you. We process it only to perform the request. We do not store the request body or the provider's response; our server logs record the target host and the response status, not their contents.

Signing in to the Playground and syncing configs

Signing in to the Playground is optional and separate from the OAuth/OIDC flows you test in the playground itself:

• Sign-in is backed by an identity service we operate, which supports signing in with a Google account.
• When you sign in, our identity service maintains your account details - such as your email address, and your linked Google account identifier if you use Google sign-in - as part of its own records.
• Your sign-in tokens are held in your browser's session storage. When you use a feature that requires being signed in, your browser sends the access token and a proof-of-possession (DPoP) proof to our backend so that it can authenticate that request. The backend validates that token - including its issuer, expiry, and the binding to your proof - and uses the subject identifier in it, a stable, pseudonymous identifier, to associate your synced configurations with your account.
• That access token is issued with the scope openid email profile, so it may carry your email address and basic profile claims. The playground application does not store them: it keeps only the pseudonymous identifier, and it does not store your sign-in tokens as part of your configuration records. The identifier is pseudonymous rather than anonymous, because our identity service can link it back to your account.
• If you enable config sync, saved playground configurations - including client secrets and private keys used for client authentication, encryption, or DPoP - are sent to and stored on our server, encrypted at rest, and associated with that pseudonymous identifier. This is not end-to-end encryption: the plaintext reaches our server, which encrypts it for storage and decrypts it again to return the configuration to your browser. Configurations you do not sync remain browser-only, as described above.

Information collected automatically

• Usage and device data - if you consent to analytics, Google Analytics collects e.g. pages viewed, approximate location, browser and device type, and referring links.
• Server logs - our server logs technical request details, including your IP address, browser user-agent, and the referring URL, to diagnose and fix issues and protect the Site.
• Anti-spam data - we use Google reCAPTCHA to protect the feedback form from spam and abuse. It loads only on the feedback page (regardless of your analytics choice) and collects hardware and software information and interaction data to distinguish humans from bots.

2. Cookies and similar technologies

We use a small number of cookies and local storage entries:

• Strictly necessary / functional - local storage entries that remember your light or dark theme preference, your cookie-consent choice, and the OAuth configuration and tokens you work with in the playground. These are not used for tracking. Your theme and consent choices never leave your browser, and neither does your playground data unless you use one of the optional features described in section 1.
• Sign-in sessions - if you sign in, your sign-in session tokens are held in browser sessionStorage. This is functional, not used for tracking, and is cleared when you close the tab or sign out. The access token is sent to our backend to authenticate requests that require being signed in, as described in section 1; we do not store it.
• Analytics - Google Analytics sets cookies to measure and improve how the Site is used. These load only after you consent.
• Security - Google reCAPTCHA may set cookies to provide spam and abuse protection. reCAPTCHA loads only on the feedback page, is necessary for site security, and is not affected by your analytics choice.

You can change your analytics consent at any time using the Cookie preferences link in the footer, or block and delete cookies through your browser settings. Disabling analytics will not prevent you from using the Site, though the feedback form may not function correctly without reCAPTCHA, which cannot be disabled through our cookie controls.

3. How we use your data

• To respond to the feedback and questions you send us;
• To operate, secure, and improve the Site;
• To serve the JWKS endpoint for public keys you choose to publish;
• To let you sync your saved playground configurations across your devices, if you choose to sign in and enable sync;
• To perform the requests you choose to route through our backend proxy;
• To measure traffic and understand how the Site is used;
• To prevent spam, fraud, and abuse;
• To comply with our legal obligations.

4. Legal bases (EU/UK visitors)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Consent - for analytics cookies, where required. You may withdraw consent at any time.
• Legitimate interests - to respond to your feedback, operate the JWKS endpoint, secure the Site, keep server logs, prevent abuse, and perform the requests you choose to route through our backend proxy. The proxy does not require you to sign in; signing in only raises the rate limit that applies to it.
• Performance of a contract - to provide the features you ask us for by signing in: authenticating you, and storing and returning the configurations you choose to sync.
• Legal obligation - where we must retain or disclose data by law.

5. Service providers and sharing

We do not sell your personal data. We share it only with service providers who process it on our behalf:

• Google Analytics - website usage analytics; see the Google Privacy Policy;
• Google reCAPTCHA - Google processes device and interaction data on our behalf for security, fraud, and abuse prevention on our feedback form;
• Google - if you choose "Sign in with Google", Google authenticates you and returns to our identity service the claims it requests: your email address, basic profile information, and your Google account identifier. Our identity service uses them only to create and recognise your account; we do not use them for advertising or share them onward. See the Google Privacy Policy;
• Zoho - our email provider, used to receive and respond to messages you send us;
• Hetzner - our hosting provider, which operates the servers that deliver the Site and store its logs.

We may also disclose data where required by law or to protect our rights.

6. International transfers

Our providers may process personal data in the EU/UK or the United States. Where personal data is transferred out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

7. Data retention

We keep feedback messages and emails you send us for as long as needed to handle your enquiry and keep reasonable business records. If you ask us to delete a message, we will do so where we can, unless we need to retain it for legal, security, or legitimate business reasons. Published JWKS keys and the IP address recorded with them are deleted after 30 days without a successful retrieval of the key from our JWKS endpoint; each successful retrieval restarts that 30-day period. There is currently no button in the playground to withdraw a published key sooner - email us and we will remove it. Requests you route through our backend proxy are not stored. Server and error logs are retained for up to 90 days for security and debugging. Your theme and cookie-consent choices are stored in your browser until you change them or clear your browser storage. Analytics data is retained for up to 14 months, in line with our Google Analytics data-retention configuration. Synced playground configurations, including any secrets or private keys within them, are retained until deleted: we delete our copy once the deletion request from your browser succeeds. If you are signed out at the time, or the request fails, the deletion is queued and sent the next time you are signed in, so our copy can briefly outlive the one in your browser. Signing out does not delete your synced configurations - they remain associated with your account and reappear the next time you sign in. Your account identifier and any remaining synced configurations are retained until you delete them or request deletion of your account. The account records held by our identity service - your email address, any linked Google account identifier, and that service's own session and security logs - are retained for as long as your account exists. If you ask us to delete your account, we delete those records and any remaining synced configurations within 30 days of your request, and confirm to you when it is done.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data; to object to or restrict certain processing; and to withdraw consent. EU/UK residents may lodge a complaint with their local data protection authority. To the extent the CCPA/CPRA applies, California residents may also request to know, access, delete, or correct their personal data, and not to be discriminated against for exercising these rights; we do not sell or share personal data as defined by the CCPA.

If you signed in and synced playground configurations, you can delete any individual synced configuration at any time from within the playground. To request deletion of your account and any remaining synced configurations, email us at privacy@oauthplayground.io; we do not yet offer a self-serve option to delete an account in bulk.

To exercise any of these rights, email us at privacy@oauthplayground.io. We will respond within the timeframes required by applicable law.

9. Children

The Site is a developer tool and is not directed to children under 16. We do not knowingly collect their personal data.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above.

11. Contact

OAuth 2.0 Playground - Michael Mineev
Privacy and data protection: privacy@oauthplayground.io
You can also use the feedback form or reach out on LinkedIn.