Skip to content
hoandat.com
Account

Privacy policy

Applies to the sign-in service auth.hoandat.com. Updated 24 October 2026.

Data we store

  • Username, email address, display name and profile picture.
  • The service uses no passwords. Accounts created before passwords were removed may still hold an argon2id hash of the old password and old recovery codes; they are no longer used to sign in.
  • When you sign in with Google, GitHub or Apple: your account ID at the provider, and the verified email, name and profile picture the provider returns. With Apple, the email may be a private relay address you chose to share, and a token is kept only to revoke the link at Apple when you remove it.
  • When you link Telegram: the chat ID and Telegram username.
  • Sign-in sessions, devices and apps you allowed, with when they were used.
  • Which app you signed in to and when (the app's ID, the time, and whether you signed in on these pages or with an existing session), without IP address or browser; kept for 400 days.
  • A security log (sign-ins, linking or removing sign-in methods, revoked sessions and access) with IP address and browser; the IP address and browser of events not yet delivered are deleted after 30 days.

How we use it

Data is used only to authenticate you, keep you signed in, recover your account, detect unusual access and count, in aggregate, how many people use each app. The service sends no email, shows no ads, and never sells or shares your data or these statistics.

The pages use Cloudflare Web Analytics to count visits in aggregate; it sets no cookies.

Sharing

Profile information goes only to apps run by the same owner (the hoandat.com apps) or to apps you allowed, within what you allowed. It is not shared with anyone else.

Your rights

On your Account page you can see and edit your profile, unlink Google, GitHub, Apple or Telegram, and sign out sessions and apps you allowed.

You can delete your account yourself on the Account page (Delete account). It is deleted right away: sessions, devices, links, app sign-in history and your profile are removed, and the security log keeps only the event type, its time and the account ID.

If deleting does not work, contact [email protected].

Storage

Data is stored on servers in Vietnam managed by the service owner, with daily backups kept for 14 days.

YouTube API Services

The owner of this service publishes videos about its apps to its own YouTube channels with a tool that uses YouTube API Services. The tool acts only on those channels: it does not read, store or share the YouTube data of people who use this service. Use of YouTube API Services is subject to the YouTube Terms of Service, and Google handles data under the Google Privacy Policy. Access granted to the tool can be revoked in your Google account's security settings.