Privacy Policy - OAuth 2.0 Playground

This Privacy Policy explains how OAuth 2.0 Playground ("we," "us," or "our") collects, uses, and safeguards your personal data when you visit oauthplayground.io (the "Site") or contact us through it. We handle personal data in line with the EU General Data Protection Regulation (GDPR), the UK GDPR, and, where applicable, the California Consumer Privacy Act (CCPA/CPRA).

We are the data controller for the personal data described here. If you have any questions, contact us at privacy@oauthplayground.io.

1. Data we collect

Information you provide

When you submit our feedback form, we collect the data you enter:

your email address, so we can reply to you;
the message you write.

If you email us directly, we receive your email address, your message, and anything else you choose to include.

Information you enter into the playground

OAuth configuration, client secrets, and tokens you enter into the playground are stored locally in your browser and are not sent to our server. The one exception is client cryptographic keys: private keys stay in your browser, but public keys you choose to publish are stored on our server and served from a JWKS endpoint so authorization servers can discover them. We store the IP address that published each key alongside it, to prevent abuse of that endpoint.

Information collected automatically

Usage and device data - if you consent to analytics, Google Analytics collects e.g. pages viewed, approximate location, browser and device type, and referring links.
Server logs - our server logs technical request details, including your IP address, browser user-agent, and the referring URL, to diagnose and fix issues and protect the Site.
Anti-spam data - we use Google reCAPTCHA to protect the feedback form from spam and abuse. It loads only on the feedback page (regardless of your analytics choice) and collects hardware and software information and interaction data to distinguish humans from bots.

2. Cookies and similar technologies

We use a small number of cookies and local storage entries:

Strictly necessary / functional - local storage entries that remember your light or dark theme preference, your cookie-consent choice, and the OAuth configuration and tokens you work with in the playground. These are not used for tracking and never leave your browser.
Analytics - Google Analytics sets cookies to measure and improve how the Site is used. These load only after you consent.
Security - Google reCAPTCHA may set cookies to provide spam and abuse protection. reCAPTCHA loads only on the feedback page, is necessary for site security, and is not affected by your analytics choice.

You can change your analytics consent at any time using the Cookie preferences link in the footer, or block and delete cookies through your browser settings. Disabling analytics will not prevent you from using the Site, though the feedback form may not function correctly without reCAPTCHA, which cannot be disabled through our cookie controls.

3. How we use your data

To respond to the feedback and questions you send us;
To operate, secure, and improve the Site;
To serve the JWKS endpoint for public keys you choose to publish;
To measure traffic and understand how the Site is used;
To prevent spam, fraud, and abuse;
To comply with our legal obligations.

4. Legal bases (EU/UK visitors)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

Consent - for analytics cookies, where required. You may withdraw consent at any time.
Legitimate interests - to respond to your feedback, operate the JWKS endpoint, secure the Site, keep server logs, and prevent abuse.
Legal obligation - where we must retain or disclose data by law.

5. Service providers and sharing

We do not sell your personal data. We share it only with service providers who process it on our behalf:

Google Analytics - website usage analytics; see the Google Privacy Policy;
Google reCAPTCHA - Google processes device and interaction data on our behalf for security, fraud, and abuse prevention on our feedback form;
Zoho - our email provider, used to receive and respond to messages you send us;
Hetzner - our hosting provider, which operates the servers that deliver the Site and store its logs.

We may also disclose data where required by law or to protect our rights.

6. International transfers

Our providers may process personal data in the EU/UK or the United States. Where personal data is transferred out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

7. Data retention

We keep feedback messages and emails you send us for as long as needed to handle your enquiry and keep reasonable business records. If you ask us to delete a message, we will do so where we can, unless we need to retain it for legal, security, or legitimate business reasons. Published JWKS keys and the IP address recorded with them are retained while the key remains in use and are removed once it is no longer requested. Server and error logs are retained for up to 90 days for security and debugging. Your theme and cookie-consent choices are stored in your browser until you change them or clear your browser storage. Analytics data is retained for up to 14 months, in line with our Google Analytics data-retention configuration.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data; to object to or restrict certain processing; and to withdraw consent. EU/UK residents may lodge a complaint with their local data protection authority. To the extent the CCPA/CPRA applies, California residents may also request to know, access, delete, or correct their personal data, and not to be discriminated against for exercising these rights; we do not sell or share personal data as defined by the CCPA.

To exercise any of these rights, email us at privacy@oauthplayground.io. We will respond within the timeframes required by applicable law.

9. Children

The Site is a developer tool and is not directed to children under 16. We do not knowingly collect their personal data.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above.

11. Contact

OAuth 2.0 Playground - Michael Mineev
Privacy and data protection: privacy@oauthplayground.io
You can also use the feedback form or reach out on LinkedIn.