Privacy policy

Version 2026-09. Commons runs the identity service at commons.cascalheira.me and is the controller of the personal data described here.

What is kept

• Your identifier (a did:webvh DID) and its log, which contains public keys and hashes only.
• Your email address, for codes, recovery and notices.
• Your passkeys and linked wallets, as public keys and addresses.
• Sessions, tokens and the consents you gave each application.
• Memberships and credentials that organizations issue to you. For these, the organization is the controller and this operator acts on its instructions.
• A security log of what happened to your account. Network addresses are stored only as keyed hashes whose key rotates every 90 days.

What applications receive

Each application sees a different identifier for you, so applications cannot link you across each other. An application receives nothing beyond that identifier unless you agree to it on the consent page, item by item. Credentials you present disclose only the claims you approve. Trust anchors and other operators never see your sign-ins.

How long

Account data lasts as long as your account. Sign-in codes and challenges are deleted a day after they expire; sessions within 90 days of ending. The security log is kept two years. When an account is deleted, its deactivated DID log stays public for a year so others can see the identity ended.

Your rights

The account pages show your sessions, passkeys, wallets, credentials and activity. The export gives you a complete machine-readable copy that another operator can import. To correct or delete data, or for anything else, write to the contact below.

Processors

Hosting and email delivery providers process data on this operator's behalf.

Contact

mailto:[email protected]