Privacy Policy

When you sign in or connect an account, Identity Hub stores the platform account id, name, handle and picture the platform returns, plus its access and refresh tokens. Tokens are encrypted with AES-256-GCM before they are written.

If you use email and password, we store your name, your email address once you confirm it, and an Argon2id hash of your password (never the password itself). To check it against known breaches, only the first five characters of its SHA-1 hash are sent to Have I Been Pwned. Two-factor secrets are encrypted; recovery codes are stored as hashes.

To stop password guessing and abuse we count attempts per IP address and per email address. Those counters are deleted within a day.

An app you authorize receives your Identity Hub user id, name, picture and confirmed email address, and the name, handle and picture of the accounts you chose. Only for accounts granted with publish access can the app request that account's platform access token, from its server, to post on your behalf.

We keep a log of sign-ins, connections and grants so you can see who has access. We do not sell data.

Disconnecting an account or removing an app takes effect immediately. To delete everything, use the Data Deletion page or email support@makketing.com.