This text is a draft waiting for approval. It describes how Zenith ID works today, but it has no effect until it is published as final.
Who is responsible for your data
Data controller: the founder of Zenith UniverSoft, a private individual based in Italy. Privacy contact: admin@zenithuniversoft.com.
For privacy questions and requests about your data: admin@zenithuniversoft.com. This address is for privacy matters only.
This page covers Zenith ID (https://id.zenithuniversoft.com) and this website.
How sign-in works
There is no password. You enter your email address and we send you a code of 8 digits. The code expires after 10 minutes. To keep your account safe, there is a limit of 5 attempts and 5 codes sent per hour.
What we keep
| Data | What exactly | How long |
|---|---|---|
| Email address | Your address, written in lowercase, and the date it was verified. | Until you delete your account. |
| Account ID | A random identifier that starts with zid_. | Until you delete your account. |
| Account status | Whether your account is active. | Until you delete your account. |
| Discord link (optional) | Your Discord ID, only if you link your Discord account. | Until you unlink it or delete your account. |
| SCC Universe link (optional) | The link between Zenith ID and your existing SCC Universe account. | Until you delete your account. |
| Sessions | Only a fingerprint of the session token, never the token itself. | 30 days. You can revoke a session at any time by signing out. |
| Sign-in codes | Only as an HMAC fingerprint, never in clear. | Only while they are needed (the code lasts 10 minutes). |
| Connected apps | Which app you connected and which permissions you gave it (openid, email). One-time authorization codes and access tokens are saved only as fingerprints. | Authorization codes last 60 seconds and can be used once. Access tokens last 1 hour. |
What connected apps receive
When you sign in to a connected app with Zenith ID, the app receives only your account identifier and, if you allow it, your verified email address. Nothing else.
Why we may process your data
We process this data to provide the service you ask for: creating and using your Zenith ID account (performance of the service, Art. 6(1)(b) GDPR).
Who helps us run the service
Zenith ID runs on Cloudflare: it hosts our workers, it stores our database (D1, in the Eastern Europe region) and it sends the sign-in emails from a no-reply address of our own domain, using the Cloudflare Email service.
The service keeps technical logs. We use them only for security and to find and fix faults, and we keep them for 30 days.
Cloudflare is a US company. Where your data is handled outside the European Union, the transfer is covered by the EU-U.S. Data Privacy Framework, under which Cloudflare is certified, and by the European Commission's standard contractual clauses in Cloudflare's data processing terms.
What we do not do
- No advertising.
- No tracking.
- We never sell your data.
- No third-party cookies.
This website uses only your browser’s local storage, and only to remember whether you prefer the light or the dark theme.
Your rights
Under the GDPR you have the right to access your data, to correct it, to have it erased, to receive it in a portable format, and to object to its processing. You can also lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali).
To use these rights, write to the privacy address above.
Partner apps
When partner apps exist, each app is responsible for the data of its own app. Zenith UniverSoft is responsible for the identity data of Zenith ID.