Privacy at Paruto sign-in
Paruto signs you in to Paruto apps (such as TapeSensei). It only knows who you are; each app keeps its own data under its own privacy policy.
What we keep, and why
- Your email address, confirmed by a code or by Google, so you can sign in and recover your account.
- Your name and Google account ID, only if you sign in with Google, so the same account is recognised next time.
- Your passkeys: the public half of each passkey you save and a label for the device type (for example "iPhone"). The private half never leaves your device, and we never see your Face ID, fingerprint or screen lock.
- Sign-in sessions: a one-way hash of your session token (never the token), the browser's user-agent and timestamps, so you stay signed in and other Paruto apps can sign you in without asking again.
- Sign-in codes: a keyed hash of each 6-digit code (never the code) for 10 minutes, and a count of codes sent to each address for a day, to stop abuse.
- Sign-in requests: which app asked and where to send you back, for up to 15 minutes.
- Network address: used in memory to limit repeated attempts; not stored.
- Page views: Cloudflare Web Analytics counts visits to these pages without cookies or personal data, and is switched off if your browser sends Global Privacy Control or Do Not Track.
- Error reports: where an error happened and its first line, without personal data, to fix problems.
What apps receive
When you sign in to an app, it receives a stable account ID, your email address, your name if Google provided it, how you signed in and when. Nothing else.
Who processes it for us
- Cloudflare hosts the service and its database, sends the emails with your sign-in codes, and runs the Turnstile check that stops bots asking for codes.
- Resend sends those emails instead if Cloudflare's email service is unavailable.
- Google, only if you choose to continue with Google.
We don't sell your data, use it for advertising, or share it with anyone else.
Cookies and storage
- One session cookie keeps you signed in for up to 30 days.
- One short-lived cookie protects a Google sign-in while it completes (10 minutes).
- Your Light, Dark or System choice is kept in your browser and never leaves your device.
How long we keep it
Your account, passkeys and email address: until you ask us to delete them. Sessions: until you sign out or 30 days pass. Codes: 10 minutes. Sign-in requests: 15 minutes. Code counts: one day. Error reports: until fixed.
Your choices and rights
You can ask for a copy of your data, a correction, or deletion of your Paruto account and passkeys by emailing capital@paruto.com; we reply within one working day. Deleting your Paruto account signs you out of every Paruto app; each app's own data is deleted from within that app. You can also complain to the Nigeria Data Protection Commission (NDPC) or, in the EU and UK, your local data protection authority.