SolAuthPrivacy Policy
This describes exactly what SolAuth stores, why it needs it, and how long it stays. It covers the dashboard at solauth.cc, the loader API at api.solauth.cc, and the Discord bot.
1. Account data
When you create a SolAuth account we store:
- Username and a bcrypt hash of your password — never the password itself.
- Email address, encrypted at rest, used to verify ownership and to send you a 6-digit code.
- Discord ID and username from the OAuth link, so account ownership can be proven and the bot can reach you.
- A hash of your API key plus its first 5 characters as a display hint. The key itself is never stored, which is why it can only be shown once.
- The invite code you registered with, and your account creation date.
- Optional IP allowlist entries, if you choose to restrict API access.
2. Your buyers' data
When you whitelist someone, SolAuth stores their Discord ID, their Discord username, any note you add, the projects they can reach, and their loader key. When that key first runs, a hardware identifier reported by the executor is bound to it so the key can't travel.
You are the one deciding what to collect about your buyers here. Tell them what you store and why — SolAuth processes that data on your behalf.
3. Execution logs
Every execution is recorded so you can see who is running what: the script and project, the buyer's key and Discord username, the IP address the request came from, and a timestamp. Denied attempts are recorded too — that is how key sharing becomes visible.
Administrative actions (invites generated, users banned, keys revoked) are written to an audit log with the acting account and time.
4. How it's protected
- Passwords are bcrypt-hashed; API keys are stored as keyed hashes; email addresses are encrypted at rest.
- Script builds are delivered encrypted to a verified execution, never exposed as a public file.
- Sensitive endpoints are rate-limited, and browser navigation to loader or API paths returns a generic page rather than any data.
- Sign-in is protected by a bot check (Cloudflare Turnstile).
No system is perfect. If we discover a breach affecting your data, we will tell you what happened and what to do about it.
5. How long we keep it
- Account data — for as long as your account exists.
- Whitelist entries and keys — until you revoke or delete them.
- Execution logs — until you clear them from the dashboard, which removes them for your projects.
- Audit logs — retained for security review.
Delete your account and the associated records are removed with it.
6. Third parties
SolAuth uses a small number of services, and shares only what each one needs:
- Discord — OAuth login and bot messages: your Discord ID and username.
- Cloudflare Turnstile — bot verification on sign-in and registration.
- Email delivery provider — sends verification codes to the address you enter.
- Hosting and database provider — stores the data described above.
We do not sell your data, and we do not use it for advertising.
7. Your choices
- Access and correction — your account page shows what we hold; email and Discord links can be changed there.
- Deletion — ask us and your account and its data are removed.
- Key rotation — reset your API key at any time; the old one dies immediately.
Cookies
SolAuth sets no advertising or analytics cookies. Your session token is held in your browser's session storage and disappears when you close the tab; your light/dark preference is stored locally on your device. Cloudflare Turnstile may set its own cookie as part of the bot check.
8. Contact
Questions about this policy, or a request about your data: [email protected]. We answer data requests within 30 days.
If we change this policy, the "last updated" date above changes with it.