Privacy Policy

Last updated: 2026-10-23

This policy explains how (operator not configured: OPERATOR_NAME) (“the operator”) handles information about users of ArazzoIDE (“the service”) provided at https://ide.arazzo.hidearea.net.

1. Information we receive from your Google account

The service uses Google OpenID Connect (“Sign in with Google”) with only the openid, email and profile scopes. From the ID token Google issues at sign-in, it uses:

Information	Purpose	Stored
Google account ID (`sub`)	To identify you and link your account	Yes
Email address (verified)	To authenticate you, to check whether your account is allowed by the operator, and to show which account is signed in	Yes
Name	To display in the user interface	Yes
Profile picture URL	Received as part of your account profile	Yes (the image itself is not downloaded)
Google Workspace domain (`hd`)	To check whether your domain is allowed by the operator	No

The access token returned by Google is used only to obtain the ID token; it is not stored or used for anything else. The service does not request a refresh token (offline access). It does not access Gmail, Google Drive, Google Calendar, Contacts or any other Google data.

ArazzoIDE's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never used for advertising, sold, or used to train AI or machine-learning models.

2. Information stored when you use the service

Workspace content: files you create, upload or edit (up to 5 MB per file and 50 MB per workspace), workspace names, and up to the last 50 revisions of each file.
Sign-in sessions: a hash of the session token, its creation time and last-used time. Sessions expire after 7 days of inactivity or 30 days after creation.
Personal access tokens and connected apps: hashes of the tokens you issue with their names, scopes and expiry; for apps you authorize over MCP, the client identifier (its client ID URL), name, scopes, authorization time and last-used time, and hashes of refresh tokens.
Server logs: operational events such as failed sign-ins, which may include your email address. The operator's servers and reverse proxy may record IP addresses and access times.

3. Cookies and browser storage

A cookie that keeps you signed in (HttpOnly, up to 30 days).
A cookie used only during sign-in (a signed state, nonce and PKCE value; expires after 10 minutes).
Your display language preference (browser localStorage).

No analytics or advertising cookies or trackers are used.

4. Sharing

The operator does not sell your information or share it for advertising. It is shared only:

with apps you authorize over MCP (such as coding agents), which can read and write your workspace files within the scopes you granted;
with server and network providers that host the service on the operator's behalf;
when required by law.

5. Retention and deletion

Account information is kept while your account exists. To have your account and its data deleted, contact the operator below.
You can delete workspaces and files in the user interface; deleting a workspace removes its files and revisions from the database.
You can revoke personal access tokens and connected apps at any time.
You can also remove the service's access from your Google account at Google Account third-party connections.

6. Security

Session tokens, personal access tokens and refresh tokens are stored only as hashes, and the signing keys for MCP access tokens are stored encrypted. Sign-in uses PKCE, state and nonce, and the ID token's signature, issuer, audience and expiry are verified.

7. Changes

If this policy changes, the updated text and its date will be published on this page.

8. Contact

Operator: (operator not configured: OPERATOR_NAME)
Contact: (contact not configured: OPERATOR_CONTACT)