Privacy
Effective
crzao is run by YKCD, LLC, a Washington limited liability company ("we"). This notice says what we keep about you when you use crzao.com and auth.crzao.com, why, and for how long. We keep as little as we can, and we don't sell it or use it for ads.
What we keep
Visiting crzao.com: nothing about you. The site sets no cookies and runs no analytics or scripts.
Signing in: your email address, which becomes your account, and the day you made it.
Each sign-in: a session record with your IP address, your browser's user agent, and when it started and was last used.
A security log of sign-ins and sign-outs, with the IP address and user agent of each.
The codes we email you, stored only as a keyed hash, and a record of each email we sent: the address, when, and whether it was delivered.
Why
To sign you in and keep you signed in, which you ask for when you enter your email (the contract between us).
To keep accounts safe and stop abuse: limiting how often codes are sent and tried, and showing you where you are signed in (our legitimate interest in security).
We send you email only for sign-in codes. We don't send marketing.
How long
A sign-in code: until it is used, or 10 minutes.
A session: it ends after 7 days unused or 30 days in all, or when you sign out. Its record is deleted 30 days after it ends.
The security log: 1 year. Counts used to limit abuse: 1 day. Records of emails sent: 90 days.
Cloudflare's request logs, which include IP addresses: up to 7 days.
Your account: until you ask us to delete it.
Cookies
auth.crzao.com sets two cookies, both needed to sign in: one holds your session, and one holds a sign-in in progress for 10 minutes. Neither is shared with any other site.
We use no advertising or tracking cookies, so there is nothing to opt out of.
Who else sees it
Cloudflare, Inc. hosts crzao, stores its data, and sends its email, as our processor. It may handle data in the United States and other countries.
Cloudflare Turnstile checks that a sign-in comes from a person. It reads signals from your browser, under Cloudflare's own privacy policy.
We share data otherwise only if the law requires it, or to protect people from harm.
Your choices
You can ask to see, correct, export or delete what we keep about you, or object to how we use it. Write to hello@crzao.com from your account's address. We answer within 30 days.
Deleting your account removes it and its sessions. The security log ages out within the year.
You can sign out of any session from your account page at auth.crzao.com.
If you are in the EU or UK, you can also complain to your data protection authority.
Children
crzao is not for anyone under 16. If we learn a child has an account, we delete it.
Changes
We change this notice when what we keep changes, and update the date above. If a change matters, we email account holders first.
Questions: hello@crzao.com.