Privacy.

What we store

• Your account: the email address you sign in with, the name and avatar address your sign-in provider gave (if any), which provider you used, and when you last signed in. No password — the service does not have one to store.
• Passkeys: for each one, the site it belongs to, the account name the site uses for you, the origin your browser was on when you enrolled it, and the private key, envelope-encrypted at rest. The key is used to sign; it is never exported, displayed or sent anywhere.
• Agents and grants: each agent’s public key and label, and for each consent you gave, which passkeys it covers, when it expires and whether signatures need your approval.
• Notes: the operating notes you or your agents write about how a site signs in. They are shown to agents you connect and to nobody else.
• The audit log: every enrolment, signature, approval, denial and revocation, with the agent, the site, the origin and the time. It is append-only in the database itself.

What we do not store

Session cookies for the sites you sign in to, anything an agent does once it is signed in, the contents of the pages it visits, or analytics about you. The service signs a challenge and stops.

Who sees it

You, through the dashboard. Agents you connect see the passkeys you granted them, the notes, and the outcome of their own requests. Sign-in providers (Google, Apple) see only that you signed in to this service. Nothing is sold, shared for advertising or used to train anything.

How long

Account data and passkeys stay until you revoke them or ask for the account to be deleted. A revoked passkey or agent is marked revoked rather than removed, so the log still says which one signed what, and a deleted account is marked deleted for the same reason. The audit log is kept for as long as the account exists.

Your rights

You can read everything above in the dashboard, export the audit log as CSV, and revoke any passkey or agent. To have the account deleted, or if you are in a jurisdiction that grants you further rights over your data, write to hello@solospace.dev and we will answer within thirty days.