Privacy Policy
Sigma Auth is built so the most sensitive data, your private keys, never reaches the server at all. This page covers what is collected, what is stored, and what cannot be read by design.
What this website collects
sigmaidentity.com is a documentation and product site. Reading it requires no account. Our hosting infrastructure records standard server logs, including IP address, requested URL, and user agent, which are used for operating and securing the service. This site does not run third-party advertising trackers.
What the hosted service stores
Creating a Sigma Auth account stores the account records needed to operate it: the public identifiers of your identity (such as a BAP identity key and derived Bitcoin addresses), the mapping between an OAuth account you connect (for example Google or GitHub) and your identity so it can act as a recovery handle, wallet connection records you create, and, if you purchase a paid tier, payment records processed by our payment provider (Stripe). Payment card details go to the payment provider directly and are not stored by Sigma Auth.
What Sigma Auth cannot read, by design
The key backup service stores encrypted blobs only. Your identity keys are encrypted on your device with a password that never leaves it, before anything is uploaded. Sigma Auth holds the ciphertext and cannot decrypt it, cannot read your private keys, and cannot reset the backup password. A connected OAuth account locates your encrypted backup; it does not unlock it. This is a structural property of the product, not a policy promise: the server-side code has no key material to disclose, whether by request, breach, or subpoena.
Cookies and sessions
The public site works without cookies. Signing in to the hosted dashboard sets session cookies required for authentication to function. These are functional cookies, not cross-site tracking cookies.
Sharing and retention
Account data is not sold. It is shared with service providers only as needed to operate the product (hosting, payment processing) and where the law requires. Encrypted backups are retained so you can recover your identity; deleting your account removes the recovery mapping. Note that identity records you chose to publish on the Bitcoin blockchain (such as a published BAP profile) are public and permanent by the nature of the chain, and no operator can unpublish them.
Contact and changes
This policy is operated by Open Protocol Labs, Inc., the publisher of Sigma Auth. Questions and data requests go to info@opl.dev. Material changes to this policy will be published on this page.
Looking for the technical detail behind these claims? The key backup security documentation describes the encryption model end to end.