Privacy policy

Last updated: June 11, 2026

1. Overview

Lakebed Auth is an auth broker for Google sign-in. Lakebed Auth collects the minimum data needed to authenticate users and return identity assertions to requesting apps.

2. Information Lakebed Auth Collects

  • Google account identifier (sub) after successful sign-in.
  • Optional profile data (email, email_verified, name, picture) only when an app requests it and you approve consent.
  • Client and consent records (requesting app origin, consent grant timestamps).
  • Security/operations data, including short-lived nonces, authorization codes, replay identifiers, rate-limit counters, and request metadata such as IP address for abuse prevention.
  • A signed HTTP-only session cookie (lakebed_auth_session) so Lakebed Auth can keep you signed in.

3. How Lakebed Auth Uses Data

  • Authenticate users with Google and create/maintain Lakebed Auth sessions.
  • Issue identity tokens containing an immutable Lakebed subject and an origin-scoped compatibility identifier to requesting apps.
  • Enforce security controls (PKCE, replay prevention, rate limiting, and abuse monitoring).
  • Maintain auditability and operational reliability.

4. How Data Is Shared

  • With the requesting app: Lakebed Auth shares an id_token containing an immutable Lakebed subject plus the origin-scoped pairwise_sub; optional profile fields are included only when requested and consented.
  • With infrastructure providers needed to run Lakebed Auth.
  • Lakebed Auth does not sell personal information.

5. Retention

  • Auth codes and state nonces expire quickly and are cleaned up automatically.
  • Replay-protection and rate-limit rows are retained briefly for security windows.
  • User identity/profile and per-app consent records are retained until deleted.

6. Your Controls

  • You can sign out anytime at /me.
  • You can delete your Lakebed Auth account data from /me using "Delete My Data".

7. Google API Data

Lakebed Auth's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Changes

Lakebed Auth may update this Privacy Policy. Updated versions will be posted at this URL with a new effective date.

9. Contact

For privacy requests, contact support@ping.gg.