Legal

The paperwork, written to be read.

Authfu holds the credentials people use to sign in to your software. That only works on trust, and trust does not survive documents nobody can read. These say what we actually do.

Agreements

What you agree to by using Authfu, and what we agree to in return.

Terms of ServiceThe agreement between you and Authfu covering accounts, acceptable use, uptime, liability and termination.Updated 28 August 2026
Data Processing AddendumThe GDPR Article 28 terms that apply when Authfu processes personal data on your behalf.Updated 28 August 2026

Privacy

What we hold about people who sign in, and everyone who can touch it.

Privacy PolicyWhat Authfu collects, why, how long it is kept, who it is shared with, and the rights you have over it.Updated 28 August 2026
SubprocessorsEvery third party that can touch data held in Authfu, what each one does, and where it runs.Updated 28 August 2026
Cookies and TrackingAuthfu sets one cookie and runs no analytics. This page says exactly what that cookie is for.Updated 28 August 2026

Policies

The rules for what gets built on Authfu and how names are allocated.

Acceptable Use PolicyWhat you may not build on Authfu, and what happens when someone does it anyway.Updated 28 August 2026
Handle and Brand PolicyHow handles are allocated, which names are reserved, and how a trademark owner claims one.Updated 28 August 2026

Trust

How the service is secured, and how to tell us when it isn’t.

SecurityHow sign-in secrets are protected, what is encrypted, what is logged, and what we do not hold at all.Updated 28 August 2026
Vulnerability DisclosureHow to report a security problem in Authfu, what we promise in return, and what is out of scope.Updated 28 August 2026