Frequently Asked Questions

A Suloro Account is your Single Sign-On (SSO) identity across Suloro and connected third-party platforms. It gives you a single, highly secure profile where you can manage credentials, connected apps, privacy settings, and developer client credentials.

Yes. The Suloro Account Chooser allows you to store and switch between multiple accounts seamlessly on a single browser. Each account session maintains strict cryptographic isolation, ensuring one account cannot access the active tokens or data of another.

Date of birth is collected solely for age-verification compliance under international child privacy protection laws (such as COPPA and GDPR Article 8). Once set, it cannot be changed arbitrarily without identity verification, preventing account hijacking or age falsification.

Suloro uses cryptographically signed JWT access tokens that expire after short durations, paired with secure sliding refresh tokens. If an account remains inactive for extended periods or if a security-sensitive event occurs (such as a password change), sessions terminate automatically.

Suloro enforces strict password hashing using memory-hard cryptographic key derivation functions. Passwords are never saved in plaintext, are never logged, and are shielded against brute-force dictionary attacks.

When you update your password in the Security settings, all active authentication tokens and refresh tokens across all devices are immediately invalidated. Anyone who had an active session on another device is signed out instantaneously.

Suloro employs adaptive exponential rate limiting. After multiple consecutive failed password attempts, authentication requests are temporarily locked for progressive cooldown intervals to prevent automated credential stuffing.

All sensitive records and session contexts are encrypted end-to-end in transit and at rest using modern cryptographic protocols, preventing unauthorized cross-session decryption or credential eavesdropping.

No. Suloro operates on a strict zero-ad-tracking and zero-data-sales policy. We do not embed behavioral advertising scripts, commercial tracking pixels, or cross-site fingerprinting mechanisms.

You can permanently delete your Suloro Account directly inside your Suloro Account dashboard. Navigate to the Data & Privacy section, scroll down to the bottom of the page, and click the Delete Account button. After entering your password to confirm, your account, profile data, active sessions, and registered OAuth applications are permanently and irreversibly purged from active databases.

Direct automated self-service data export archives are not available in the account dashboard to safeguard against automated exfiltration and keep client-side operations lightweight. If you require an important personal data archive or formal records, please contact our support team at support@suloro.com. Our security team will verify your identity and deliver a structured archive in standardized JSON or CSV format.

Suloro Ads is a high-performance advertising platform that connects advertisers with publishers. Advertisers create campaigns (CPC, CPM, CPI) across banner, interstitial, and rewarded ad formats. Publishers integrate Suloro Ads into their applications to show ads and earn revenue based on legitimate impressions, clicks, and installs.

Suloro Ads can show in any mobile (Android, iOS) or web applications integrated with the Suloro Ads network. Ad units are dynamically rendered within registered publisher apps.

No. Suloro Ads does not create personal surveillance profiles, does not track your cross-site browsing history, and never sells user data. Ad serving relies strictly on contextual category matching, geographical locality, and campaign bidding parameters.

The Developer Console allows engineers and developers to register OAuth 2.0 client credentials. This enables third-party web apps and platforms to offer "Sign in with Suloro" to their users securely.

To register an application, developers must provide:

• Application Name: A clear, non-deceptive brand name.
• 1:1 Application Logo: A square brand icon or logo for the consent screen.
• Authorized Redirect URIs: Whitelisted callback URLs where tokens are securely returned.
• Privacy Policy & Terms URLs: Valid, accessible public policy links explaining how user data is handled.

Proof Key for Code Exchange (PKCE, RFC 7636 with S256) prevents authorization code interception attacks on public and single-page clients. By enforcing PKCE across all client flows, Suloro guarantees that intercepted authorization codes cannot be exchanged without the dynamically generated code verifier.

Your Client Secret must always remain strictly confidential on your backend servers. Never expose your Client Secret in public client-side JavaScript, GitHub repositories, or mobile app binaries.

The Linked Apps section displays all third-party websites and applications that you have granted authorization to access your Suloro profile claims (such as Name, Email, or Date of Birth).

Navigate to Linked Apps in your dashboard and click Remove next to the desired application. Its authorization token will be immediately revoked, preventing any future data access until you re-authorize it.

On the sign-in page, click "Forgot password?" to receive a secure, time-limited password reset link delivered directly to your registered email address.

For all inquiries, account assistance, security reports, or technical queries, contact us at: