Legal terms for identity verification, registered applications, and secure auth-code exchange.

dxAuth is an independent authentication and application-registration platform operated for doxanh applications and other approved registered applications.

General contact: contact@doxanh.dev. Privacy requests: privacy@doxanh.dev. Abuse reports: abuse@doxanh.dev. Legal notices: legal@doxanh.dev.

Application configuration may include app id, client id, active secret prefix, protected secret hash records, redirect URI allowlists, browser origin allowlists, login mode, client mode, sender settings, and security policy.

Sign-in and identity data may include email address, challenge method, request-token metadata, verification status, failed-attempt state, one-time auth-code records, and verified identity data returned after successful exchange.

Email delivery and anti-abuse records may include email job status, provider metadata, retry state, delivery failure state, suppression records, rate-limit signals, Turnstile results, failed attempts, and auth/security audit logs.

We collect hashed admin/session tokens and session metadata for dxAuth admin use.

We use information to verify email control, send magic-link or 6 digit code emails, issue one-time auth codes, and allow registered application backends to exchange auth codes for verified identity data.

We use operational records to enforce redirect URI and origin restrictions, prevent enumeration, email bombing, brute force, spam, abusive login attempts, and support incident review.

dxAuth does not create dx Capture's final logged-in web or extension session. The registered application backend creates its own session after successful auth-code exchange.

dxAuth does not own dx Capture media, recordings, screenshots, share links, viewer ads, or dx Capture workspace data.

We may share verified identity data with the registered application backend after successful auth-code exchange.

We may share information with email, anti-abuse, hosting, storage, logging, monitoring, legal, and security providers that help operate, secure, and support the platform.

dxAuth returns only the verified identity data needed for the registered application to create its own session.

dxAuth may use necessary session cookies for admin sessions, request tokens or verification state needed to complete sign-in, Turnstile or similar anti-abuse technology, operational logs, and audit records.

dxAuth verification pages should not load advertising scripts, optional analytics pixels, behavioral tracking pixels, or third-party widgets unrelated to authentication or abuse prevention.

Login challenges, request tokens, and auth codes are one-time or short-lived. Exchanged or expired auth codes and old email jobs may be removed by cleanup jobs.

Audit logs, abuse events, suppression records, and admin/session records are retained according to operational, security, and legal needs. Deletion may be delayed for legal obligations, abuse investigation, security investigation, dispute resolution, backup recovery windows, or service integrity.

dxAuth uses controls such as hashed secrets and tokens, one-time request tokens, one-time auth codes, exact redirect URI allowlists, browser origin checks, generic public responses, rate limits, Turnstile/adaptive challenge support, suppression records, and audit logging.

No internet service can guarantee absolute security.

Depending on location, users may request access, correction, deletion, restriction, portability, objection, or consent withdrawal.

Requests should be sent to privacy@doxanh.dev.

dxAuth is not intended for children under 13 or for anyone below the minimum age required by applicable law. Registered applications must not use dxAuth to collect children's personal information unless approved by the operator and legal reviewer.

If dxAuth is offered outside the operator's home jurisdiction, additional transfer, lawful-basis, and local rights disclosures may be required.

We may update this policy. Material changes should be posted with an updated date and, where appropriate, additional notice.