sSourceOrigin

SourceOrigin

Privacy policy

Last updated 8 November 2026.

This policy explains what SourceOrigin knows about you, why, and for how long. It covers Origin Auth, the sign-in service at auth.sourceorigin.dev, with its account settings and developer console, the website sourceorigin.dev, and the emails it sends.

The short version

  • We keep only what SourceOrigin needs to sign you in and to keep your account safe. Nothing else.
  • We never sell your data, show you ads, track you across websites, or use your data for anything other than running SourceOrigin.
  • Your data is stored in France. A few trusted services help us send emails and deliver the website, and only get what that job needs.
  • You can see, download and delete your data yourself, at any time, from your account settings.
  • SourceOrigin's code is public, so you can check how your data is handled for yourself.

1. Who runs SourceOrigin

SourceOrigin is a personal, non-commercial project, run by an individual developer in France. Write to [email protected] about anything in this policy, or to exercise your rights.

As French law allows for a non-professional publisher, the developer's identity is held by our host instead of being published here: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, +33 9 72 10 10 07.

2. What we keep, and why

  • Your account: your username, which SourceOrigin calls your handle, and your display name. Your handle is public: apps you sign in to see it, and anyone can find out whether a handle is taken. Handles you stop using stay reserved, so nobody can take them to pretend to be you.
  • Your profile picture, if you add one. We keep only a square copy we make of it, without anything else the file held, such as where a photo was taken. Anyone with its link can see it, and apps you sign in to get the link along with your name.
  • Your email addresses, and which ones you have confirmed. We use them only to send you security alerts, confirmation links and account recovery links. An address you don't confirm is removed from your account after a day.
  • Your passkeys: the public half of each passkey, which lets us check that a sign-in really comes from it, the name you gave it, sometimes the model of device or password manager that holds it, and when it was added and last used. The secret half never leaves your device, and we never see your fingerprint, your face or your device's PIN.
  • Your signed-in devices: for each one, when and how it signed in, when it was last used, its IP address, and the type of browser and system, such as "Firefox on Linux". You see the list in your settings, and can sign any device out.
  • Your security history: a record of sign-ins and of changes to your account, such as a passkey added or removed, with the IP address and browser they came from. It lets you spot anything you didn't do. If an administrator ever changes something on your account, the history says so.
  • GitHub and Google, only if you choose to sign in with them. They tell us your account number there, your name, your email addresses and the address of your profile picture. We keep only the account number and your main confirmed email, to recognise you next time. If you create your Origin Account with them, we also copy their profile picture once, as yours, which you can then change or remove. We don't look at anything else in your GitHub or Google account.
  • Apps you use with Origin Auth: which apps you allowed, and what each may see.
  • Account recovery: if you ever lose all your passkeys and we help you back in, when that happened and which passkey it added.
  • Apps you register as a developer: each app's name, web addresses and settings.
  • Protection against attacks: to stop someone from guessing their way in, flooding SourceOrigin or flooding an inbox, we briefly count requests by IP address, by account and by email address. The counts are stored in a scrambled form, used for nothing else, and deleted within about an hour.
  • Service logs: which pages are requested, how long they take, which errors happen, and, when an account changes, a number identifying that account, so we can keep SourceOrigin working and fix problems. We don't put your IP address, name or email address in them.

We never ask for your birth date, phone number, postal address or payment details. The links we email you, and what keeps you signed in, are stored in a form that can't be reused even by someone who reads our database.

3. What we never do

  • Sell, rent or trade your data.
  • Show ads, or let anyone else show ads through SourceOrigin.
  • Use analytics, trackers, or third-party cookies.
  • Build a profile of you, or use your data to train AI.
  • Send you newsletters or marketing emails.

4. Cookies

SourceOrigin only uses the cookies it needs to work, so it doesn't ask you to accept them. They are set by auth.sourceorigin.dev, and can't be read by other websites or by scripts. sourceorigin.dev sets none.

  • One cookie keeps you signed in, for up to 30 days.
  • A few cookies remember a sign-in in progress, such as a GitHub or Google sign-in, for up to 10 minutes.
  • One cookie shows a message on the next page, such as "Passkey added", for up to a minute.

5. Why we're allowed to use your data

  • To give you the service you asked for: your account, signing you in to the apps you choose, and the emails your account needs.
  • To keep SourceOrigin secure, which is in your interest and ours: preventing attacks and misuse, and keeping a record of changes to your account that can't be secretly altered.
  • When the law requires it.

6. What apps you sign in to receive

When you sign in to an app with Origin Auth, you see what it asks for and approve it, unless the app is one of SourceOrigin's own. It gets only what you approve:

  • Always: an identifier for your account, which is the same for every app, an identifier for this sign-in, and when and how you signed in.
  • If it asks: your handle, display name and profile picture.
  • If it asks: your confirmed email address.
  • If it asks: permission to keep you signed in.

When you sign out, the apps you signed in to may be told, so they sign you out too. Once an app has your data, its own privacy policy applies. You can remove an app's access at any time in Settings → Connected apps.

7. Who else handles your data

  • OVHcloud (France) rents us the servers SourceOrigin runs on, in its Strasbourg data centre. Your account data, and our logs, are stored there.
  • Resend (United States) sends our emails, so it receives your email address and the message.
  • Cloudflare (United States) delivers Origin Auth's pages and protects them from attacks, so your requests and IP address pass through it.
  • GitHub and Google (United States), only if you sign in with them: as when you use them anywhere else, they know you signed in to Origin Auth.
  • SourceOrigin's administrator, currently only the developer who runs SourceOrigin, can look at an account to help its owner or to stop misuse. Opening an account's details, and every change, is recorded in its security history, and an administrator can never add a passkey, a linked account or an email address to your account.
  • Authorities, only when the law requires it.

Resend, Cloudflare, GitHub and Google may handle data in the United States. Each is certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as protecting your data, and also uses the European Commission's standard contractual clauses.

8. How long we keep it

  • Your account, with its profile picture, email addresses, passkeys, linked accounts and allowed apps: until you delete it. A profile picture you replace or remove is deleted at once. Passkeys and linked accounts you remove stay listed as removed, so your security history still makes sense.
  • Signed-in devices: a device stays signed in for up to 30 days, or until you sign it out. Its record, with its IP address, is deleted soon after: usually within a day or two, and at most about a month later if an app was keeping you signed in.
  • Security history: the IP address, browser and other details of each entry, such as an email address you added, for 90 days. After that, only what happened, when, and to which account is kept.
  • Our record of emails we sent: 7 days, or 30 days if sending failed.
  • Sign-ins in progress and attack counters: from a few minutes to a day.
  • Service logs: up to 30 days.
  • Database backups, kept so SourceOrigin can recover from a failure: data you delete disappears from them as they are replaced.

9. Your rights

You can, at any time:

  • Download your account's data and its security history, in Settings → Your data.
  • Correct it: change your handle, add or remove email addresses and passkeys, and unlink GitHub or Google in your settings. Write to us for anything else.
  • Delete your account, in Settings → Your data. You are signed out of SourceOrigin everywhere at once, and apps you use lose access within minutes. The account is erased for good 30 days later; until then, you can sign in with a passkey and choose to restore it. What remains: your old handles, reserved so nobody can impersonate you; a record that events happened, with your account's number but no other personal details; any apps you registered, reduced to their identifier and settings, without their name or web addresses, so their identifiers are never reused; and, until they expire, service logs and database backups.
  • Object to how we use your data, or ask us to limit it.

Write to [email protected] for any of these. We answer within a month. If you're not satisfied, you can complain to the French data protection authority, the CNIL, or the one where you live.

10. Security

Passkeys can't be phished, guessed or reused on another website. Everything travels encrypted over HTTPS, our signing keys are encrypted, and every change to an account is kept in a record that can't be secretly altered. If your data is ever affected by a breach, we will tell you, and the CNIL, as the law requires.

11. Children

You must be at least 15 to create an Origin Account. If you believe a child under 15 has an account, write to us and we will delete it.

12. See for yourself

SourceOrigin's source code is public at github.com/sourceorigin-dev/sourceorigin. If you want to understand exactly how your data is handled, you can read it there, or ask us.

13. Changes

If this policy changes, we will post the new version here with its date, and email account holders before any important change takes effect.

14. Contact

[email protected]