Privacy Policy

How darkblue.tech ID collects, processes, and protects your personal information

shield

Privacy Commitments: darkblue.tech does not collect biometric data, never stores plaintext passwords, does not use advertising trackers, and under no circumstances sells or monetizes your personal data.

Table of Contents:

1. Introduction and Scope
2. Categories of Data We Collect
3. Purposes & Legal Bases (GDPR)
4. Cookies & Technical Tokens
5. Third-Party Data Sharing

6. Data Retention Policy
7. Your Data Protection Rights
8. Technical & Security Safeguards
9. Policy Updates
10. Contact Information and DPO

1. Introduction and Scope

1.1. This Privacy Policy (the "Policy") explains how darkblue.tech (the "Operator") collects, uses, stores, discloses, and protects personal data of users accessing the darkblue.tech ID identity and authentication service (the "Service").

1.2. This Policy complies with international data privacy standards, including the European Union General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), Council of Europe Convention 108, and applicable national laws.

1.3. By registering an account or authenticating through darkblue.tech ID to access ecosystem services or authorized third-party applications, you acknowledge and agree to the practices described in this Policy.

2. Categories of Personal Data We Collect

2.1. Information You Provide Directly:

Registration Details: Valid email address, unique username, and password (stored solely as an irreversibly salted cryptographic hash);
Profile Attributes (Voluntary): First and last name, contact telephone number, date of birth, interface language preference, and profile image (avatar);
Security Credentials (When Configured): TOTP secret keys for authenticator applications, emergency recovery backup codes, and public authentication keys for passwordless devices.

Zero-Knowledge Biometric Statement: The Operator does not collect, capture, process, or store your biometric data (such as fingerprints, Face ID, or iris scans). When utilizing passwordless authentication (Passkeys), biometric verification occurs strictly on your local device within its hardware-isolated secure enclave. The Service verifies only a cryptographically signed assertion that contains no biometric information whatsoever.

2.2. Information Collected Automatically:

Network and Technical Data: Network IP address, operating system, browser type and version, and approximate device classification;
Session and Activity Records: Timestamps of account access, last active session timestamps, and security setting modifications;
Security Audit Logs: To prevent fraud, account takeover, and brute-force attacks, the Service automatically logs authentication events associated with IP addresses and user agents.

2.3. External Provider Data (Social Login): When authenticating via external providers (Google, Yandex, GitHub), we receive verified basic information: external user identifier, primary email address, public display name, and profile picture.

3. Purposes and Legal Bases for Processing Data

Processing Purpose	Categories of Data	Lawful Basis (GDPR)
Account maintenance and Single Sign-On (SSO)	Email, username, profile attributes, session tokens	Contract performance (Art. 6(1)(b) GDPR)
Multi-factor security and Passkeys	Password hashes, 2FA parameters, public Passkey keys	Contract performance and legitimate interest (Art. 6(1)(f))
Third-party application access on User request	Profile attributes corresponding to granted scopes	Data subject consent (Art. 6(1)(a) GDPR)
Fraud prevention and threat defense	IP addresses, browser details, security audit logs	Legitimate interests (Art. 6(1)(f) GDPR)
Service communications and notices	Email address	Contract performance (Art. 6(1)(b) GDPR)

4. Cookies and Technical Tokens

4.1. The Service uses exclusively strictly necessary technical cookies required for secure session management, authentication continuity, and request forgery defense:

Authentication Session Tokens: Encrypted tokens verifying identity across pages and API endpoints;
Session Continuity Tokens: Long-lived tokens enabling uninterrupted authentication during active use;
Cross-Site Request Forgery (CSRF) Tokens: Single-use technical tokens verifying the authenticity of login and consent requests;
Notification Routing Identifiers: Ephemeral technical identifiers used to route transient UI toast notifications across browser tabs.

4.2. Sensitive cookies are secured with HttpOnly, Secure, and SameSite=Lax attributes. The Service does not use marketing or third-party behavioral tracking cookies.

5. Third-Party Data Sharing

5.1. darkblue.tech Ecosystem Services: When accessing official interconnected services (Tunnel, Drive, Crewspace, Calendar, Codebox, Automate, Talk, Dario, Games), basic profile attributes are shared automatically to provide unified Single Sign-On (SSO).

5.2. Third-Party Applications: Personal data is shared with external applications solely after you have explicitly approved access at the permission prompt. You may revoke access at any time in your profile.

5.3. Gravatar Service: If you enable Gravatar for your profile image, an irreversible cryptographic hash of your email address is sent to Gravatar. Your actual email address is never disclosed.

5.4. Absolute Ban on Sale of Data: darkblue.tech never sells, rents, monetizes, or trades your personal data to advertisers or third-party data brokers.

6. Data Retention Policy

6.1. Active Account: Personal data is retained throughout the lifetime of your account until deleted by you or terminated for Terms violations.

6.2. Session Lifetimes: Active sessions remain valid for up to 30 calendar days. Sessions with no activity for 14 consecutive days are automatically terminated.

6.3. Security Logs: Security audit logs are retained for up to 12 months for threat detection and fraud investigation, after which they are routinely purged.

6.4. Account Deletion: Upon confirmed deletion in your account settings, all personal data, registered authenticators, credentials, and active sessions are permanently and irrevocably deleted from active databases.

7. Your Data Protection Rights (GDPR)

Under applicable data protection laws, you possess the following rights:

Right of Access: Review all personal data, active devices, and authorized applications in your dashboard at id.darkblue.tech/users/me;
Right to Rectification: Update or correct your personal data in profile settings;
Right to Withdraw Consent: Revoke third-party application permissions in one click;
Right to Erasure ("Right to be Forgotten"): Permanently delete your account and data at any time;
Right to Data Portability: Request an export of your personal data in a structured, machine-readable format;
Right to Lodge a Complaint: File a complaint with your local data protection supervisory authority.

8. Technical & Security Safeguards

The Operator employs industry-standard cryptographic and operational safeguards:

Advanced one-way salted hashing protecting all user passwords;
End-to-end TLS/HTTPS encryption with strict transport security;
Asymmetric digital signatures for all authentication and identity tokens;
Strict role-based access control and multi-factor authentication for infrastructure administration;
Intelligent rate limiting protecting against automated credential stuffing and brute-force attacks.

9. Policy Updates

9.1. The Operator may update this Policy periodically. The prevailing version is always available at https://id.darkblue.tech/privacy with the latest revision date.

9.2. In the event of material modifications, users will be provided advance notice via the user interface or by email.

10. Contact Information and DPO

Data Protection Officer (DPO): privacy@darkblue.tech
Information Security: security@darkblue.tech
Customer Support: support@darkblue.tech