Privacy Policy | Vorenthic Identity

01. Zero-Trust Privacy Commitment

At Vorenthic Identity ("where technology meets privacy"), privacy is not a setting or an afterthought — it is our foundational engineering constraint. Our identity provider platform is architected around zero-trust protocols, end-to-end edge encryption, and zero data monetization.

We do not sell, rent, monetize, or profile user identity data. We do not track users across third-party websites or build behavioral advertisement models.

02. Information We Collect & Process

We collect only the absolute minimum telemetry required to issue OpenID Connect authentication tokens:

Account Identity: Primary email address, username, and encrypted password hash (SHA-256 / WebAuthn credentials).
Authentication Credentials: WebAuthn Passkey public keys and Turnstile verification tokens.
OAuth 2.0 Session Context: Ephemeral state tokens (`state`, `code_challenge`, `nonce`) stored in isolated Cloudflare KV nodes with automatic TTL expiration (600s).

03. How We Process OpenID Connect Tokens

When you authorize a third-party application using "Continue with Vorenthic", we issue cryptographic JWT Access Tokens and ID Tokens strictly scoped to the permissions (`openid`, `profile`, `email`) you explicitly approve on the consent screen.

Authorization codes are single-use (`v_code_*`) and are burned immediately upon token redemption. Token signatures are verified publicly via our JSON Web Key Sets (`GET /auth/o/jwks.json`).

04. Data Storage & Edge Isolation

All account records and OAuth client metadata are stored across globally distributed Cloudflare D1 SQLite database clusters with encryption at rest and in transit. Temporary session state and rate limits reside in Cloudflare KV namespaces with strict time-to-live policies.

05. Your Data Rights (GDPR & CCPA)

You maintain full ownership over your digital identity. At any time, you have the right to:

Revoke OAuth Apps Disconnect any third-party app instantly from your User Dashboard.

Export Data Download your identity records and active session logs in standard JSON format.

Account Erasure Permanently delete your account and associated D1 database records.

Passkey Management Add or revoke WebAuthn hardware security keys at will.

06. Contact Privacy Engineering

If you have questions regarding this Privacy Policy, cryptography audits, or zero-trust data protection, contact our privacy engineering team at privacy@vorenthiclab.com.