Summary
- Client secrets, authorization codes, and tokens are used only for the request you make, then discarded. They are not stored, logged, or sent to error monitoring.
- There are no user accounts, tracking pixels, or advertising cookies. Page views are counted with cookieless analytics that never see credentials.
- Your IP address and basic request details are processed to deliver the site, prevent abuse, and fix errors. They are kept for between one minute and 90 days, depending on the purpose.
Who is responsible
The data controller is [Operator name — to be confirmed], [Registered address — to be confirmed]. Contact hello@oauthhub.com for any privacy question or request. No data protection officer has been appointed, because the law does not require one for processing of this kind and scale.
Credentials you enter
When you run a workflow, the values you enter (client ID, client secret, authorization code, PKCE verifier, and access or refresh tokens) are sent over HTTPS to OAuth Hub's server. The server forwards them to the provider you selected and returns that provider's response to your browser.
- They are held in memory only for the length of that request.
- They are not written to a database, to files, or to server logs. Logs record only whether a value was present.
- The workflow page removes the authorization code and state from the address bar as soon as it has read them, so they don't stay in browser history or reach analytics.
- Before any error report leaves the server, request bodies, headers, and cookies are removed, and values that look like credentials are redacted.
Verification steps can return details of the provider account the token belongs to, such as a username, account ID, or shop name. These are shown to you and then discarded, not stored.
The provider you choose, such as Shopify, Instagram, or GitHub, receives these credentials because you asked OAuth Hub to send them. For that request, the provider is a separate controller, and its own privacy policy and terms apply.
In a custom flow, OAuth Hub sends these requests to the endpoints you enter, and reads the discovery document from the issuer URL you enter. Only public https:// addresses are accepted. The settings you enter are not stored. A setup link keeps the non-secret settings in the part of the link after #, which browsers never send to a server.
What is processed and why
| Data | Purpose and legal basis | Retention |
|---|---|---|
| Credentials and provider account details from a workflow you run | Carrying out the request you asked for (Art. 6(1)(b) GDPR) | Only for the duration of the request. Never stored. |
| IP address | Rate limiting to protect the service from abuse (Art. 6(1)(f): legitimate interest in security) | Up to one minute, in server memory |
| Request logs: IP address, time, route, provider ID, status code, request ID, browser type | Operating, securing, and debugging the service (Art. 6(1)(f)) | One hour on the current hosting plan |
| Error and performance reports: route, error code, status, timing, and a sample of about 10% of requests | Finding and fixing failures (Art. 6(1)(f)) | Up to 90 days, depending on the monitoring plan |
| Anonymous page-view statistics: page path (without query string), referrer, country, browser, operating system, and device type | Understanding which pages are used, to improve the service (Art. 6(1)(f)) | Visitor sessions are discarded after 24 hours. Aggregated reports are kept for one month on the current plan. |
| Website domains you submit to the Shopify domain finder | Fetching that public website to find its myshopify.com domain (Art. 6(1)(b)) | Not stored. The result is returned to you. |
The legitimate interests relied on are keeping the service secure, available, and working correctly. The data used is kept to what those purposes need, and it is deleted on the short schedules above. You can object at any time (see Your rights).
Cookies and browser storage
OAuth Hub sets one kind of cookie, and it is strictly necessary, so no consent is needed. Analytics uses no cookies and stores nothing on your device.
oauth_state_<provider>: a random, single-use value that protects the authorization redirect against cross-site request forgery. It is set only when you start an authorization, is HTTP-only, expires after 10 minutes, and is deleted when the code is exchanged.
OAuth Hub does not save anything in your browser's local or session storage. An earlier version of the Shopify workflow had an optional Remember setting for the shop domain, scopes, and redirect URI. That setting has been removed, and the Shopify page deletes any values it saved the next time you open it.
OAuth Hub does not currently provide accounts or project saving. Credentials are not saved by OAuth Hub; copy anything you need before closing the page.
Recipients and transfers
- Vercel Inc. (United States): hosting, serverless functions, and Web Analytics. The server-side functions currently run in Vercel's Washington, D.C. (US) region. Web Analytics identifies a visit only by a hash of the request, which is discarded after 24 hours. It does not use cookies, and it receives page paths with query strings and fragments removed.
- Functional Software, Inc. (Sentry): server-side error and performance monitoring. Event data is stored in Sentry's EU region in Frankfurt, Germany. Browser-side monitoring and session replay are turned off.
- Cloudflare, Inc.: DNS only. Site traffic is not routed through Cloudflare.
Where personal data goes to the United States, the transfer relies on the EU–US Data Privacy Framework adequacy decision (Commission Implementing Decision (EU) 2023/1795). Each of these companies is certified under that framework. Personal data is not sold, and not shared for advertising.
Your rights
Under the GDPR you have the right to:
- access the personal data held about you;
- have inaccurate data corrected;
- have data erased;
- restrict processing;
- object to processing based on legitimate interests;
- data portability, where it applies.
OAuth Hub has no accounts, and most data is deleted within an hour, so there is often nothing left to identify you. You can still send any request to hello@oauthhub.com, and you will get a reply within one month.
You can also complain to a supervisory authority. In Ireland, that is the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963 (dataprotection.ie). You can also complain to the authority in the EU country where you live or work.
Other information
- There is no legal or contractual requirement to give OAuth Hub any data. The workflows cannot run without the credentials you choose to enter, though.
- No automated decision-making or profiling takes place. The only automated measure is rate limiting, which briefly blocks excessive requests.
- OAuth Hub is a tool for developers and is not directed at children.
Changes
Accounts and an encrypted credential vault may be added later. If they are, this policy will be updated before they launch, to describe exactly what is stored and how it is protected. The date at the top of this page shows when it last changed.