Legal

Privacy Policy

Service: IAM Auth Server (auth.dilipdangoriya.com.np)
Operator: Dilip Dangoriya, Nepal
Contact: dilipdangoriya@gmail.com
Effective date: 2026-09-07

1. Scope

This Privacy Policy explains how the IAM Auth Server (the Service) — operated by Dilip Dangoriya (the Operator) — collects, uses, stores, and shares personal information when you sign in to the Service or use a connected application on the dilipdangoriya.com.np family of domains.

Connected applications include (but are not limited to): dilipdangoriya.com.np, calender.dilipdangoriya.com.np, live.dilipdangoriya.com.np, meroshare.dilipdangoriya.com.np, and play.dilipdangoriya.com.np. The list may grow over time; the latest list is always available on our home page.

2. What data we collect

We collect the minimum information needed to authenticate you and let you sign in across connected apps. This includes:

  • Account identifiers: email address (used as your unique sign-in handle), display name, and (optionally) profile picture.
  • Authentication data: a salted & hashed password (only if you create a local account instead of signing in with Google); your TOTP secret (only if you enable two-factor authentication).
  • Security & operational data: sign-in timestamps, IP address, user-agent, and a short audit log of security-relevant events (sign-in, sign-out, password change, 2FA enable/disable, etc.).
  • Application access data: which connected application initiated the sign-in (the OIDC client_id) and the requested scopes.

We do not collect browsing history, contacts, location, or any data outside what is described above.

3. How we use it

We use the data above to:

  • Authenticate you when you sign in (locally or via Google).
  • Issue short-lived, signed identity tokens to the connected application you are signing in to.
  • Protect your account (rate-limiting, 2FA, suspicious-activity review).
  • Send you security-related emails: email verification codes on sign-up, password-reset links, 2FA disable/reset confirmation codes, and a one-time welcome email after your account is created.

We do not use your data for advertising, profiling, or sale to third parties.

4. Google sign-in (OAuth)

The Service offers Sign in with Google. When you choose this option, Google authenticates you and sends us a limited profile. We request and store only the following OAuth scopes:

  • openid — to identify you uniquely across sign-ins.
  • email — your verified email address (also used as your sign-in handle).
  • profile — your display name and profile picture.

We do not request access to your Gmail, contacts, Drive, Calendar, or any other Google service. Google's handling of your data is governed by Google's Privacy Policy.

You can revoke the Service's access to your Google account at any time from your Google account permissions page.

5. Sharing & sub-processors

We share your data only with:

  • Connected applications you sign in to. They receive the minimum fields they need (typically your email, name, and a unique user id) inside a signed OIDC identity token.
  • Google, when you use Google sign-in (as described above).
  • Email delivery provider (currently SMTP/Brevo), used solely to send you security and account-related emails.

We do not sell, rent, or share your data with advertisers, data brokers, or analytics providers.

6. Retention

  • Account data (email, name, picture, hashed password, 2FA secret) is kept for as long as your account is active.
  • Sign-in and security audit logs are kept for up to 30 days.
  • Short-lived verification codes (email verification, password reset, 2FA disable/reset) expire automatically within 10 minutes.
  • On account deletion, all personal data is removed from primary storage within 30 days. Backups are rotated within 90 days.

7. Security

We protect your data with industry-standard measures, including:

  • Passwords stored as bcrypt hashes.
  • Short-lived, signed tokens for email verification, password reset, and 2FA operations.
  • Rate limiting on sign-in, sign-up, OTP, and password-reset endpoints.
  • HTTP-only, secure session cookies.
  • Optional TOTP-based two-factor authentication.

No method of transmission or storage is 100% secure. If you believe your account has been compromised, change your password immediately and contact dilipdangoriya@gmail.com.

8. Your rights

You can at any time:

  • Access the personal data we hold about you (via the Profile page in the management portal).
  • Correct your name and profile picture from the Profile page.
  • Change your password or reset your 2FA from the Profile page.
  • Delete your account by contacting dilipdangoriya@gmail.com. We will delete your account and associated data within 30 days.
  • Revoke Google access at myaccount.google.com/permissions.

9. International transfers

The Service is operated from Nepal. Your data may be processed in countries other than your own. By using the Service, you understand that your data may be transferred to, stored, and processed in countries whose data-protection laws may differ from those in your country of residence.

10. Children's privacy

The Service is intended for use by adults (18 years or older) operating internal tools. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us so we can delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. The effective date at the top of this page reflects when this version took effect. Material changes will be communicated by a notice on the home page and, where appropriate, by email.

12. Contact

For any privacy-related question, request, or complaint, please contact:

Dilip Dangoriya
Email: dilipdangoriya@gmail.com
Service URL: auth.dilipdangoriya.com.np