# Suloro Complete Policies, Terms & Security Knowledge Base (llms-full.txt) > This document is the full unabridged knowledge base for Suloro Policies (policies.suloro.com). It provides authoritative answers for LLMs, AI agents, search engines, and compliance verifiers. --- # 1. System Overview & Core Identity - **Organization:** Suloro - **Service Name:** Suloro Policies & Legal Compliance Portal - **Canonical Domain:** `https://policies.suloro.com` - **Account Management Portal:** `https://accounts.suloro.com` - **Support & Security Email:** `support@suloro.com` Suloro is a privacy-first platform offering Single Sign-On (SSO) authentication, account management, developer identity tools, Suloro Ads, and productivity applications. Suloro's core mission is to empower users with cryptographic ownership over their personal identity while providing zero surveillance tracking and zero data sales. --- # 2. Suloro Privacy Policy Summary & Full Clauses ## Foundational Privacy Principles 1. **Zero Surveillance Tracking & Zero Data Sales:** Suloro does not sell personal user data or engage in commercial cross-site behavioral tracking or profiling. 2. **Minimal Data Collection:** Suloro collects only the minimum required information to provide secure authentication and identity services: Name, Email Address, and Date of Birth. 3. **Purpose Limitation:** Information is used strictly for identity verification, account recovery, session security, and developer authorization. 4. **Encrypted Architecture:** Sensitive device caches, transit channels, and stored records are protected using robust encryption. 5. **Self-Service Account Deletion:** Users can permanently delete their account and associated OAuth applications at any time from the account dashboard. 6. **Data Export via Support:** Direct automated self-service data export is disabled in the dashboard to protect against automated exfiltration; users requiring verified archives can email `support@suloro.com`. 7. **Suloro Ads Platform Disclosures:** Suloro Ads enables advertisers to run campaigns and publishers to display ads in web and mobile applications across the Suloro network without selling user personal data. 8. **DPDP Act & Global Compliance:** Adherence to India's Digital Personal Data Protection Act (DPDP Act), GDPR, CCPA/CPRA, and global statutory standards. ## Information We Collect - **Profile Information:** Name (display identifier), Email Address (primary login and security alerts), and Date of Birth (age verification compliance under COPPA and regional minor privacy laws). - **Security & Session Telemetry:** IP address (used temporarily for rate limiting and fraud prevention, not cross-site tracking), user agent, and timestamp of active logins. - **Suloro Ads Telemetry:** Ad unit identifiers, impression counts, interaction timestamps, and bot verification signals solely for billing and anti-fraud auditing. - **Developer App Credentials:** Application names, logos, authorized redirect URIs, client IDs, and hashed client secrets. ## Sign in with Suloro & Third-Party Applications When users use "Sign in with Suloro" to access third-party applications: - The third-party developer receives only the scopes explicitly granted by the user (`name`, `email`, `dob`). - Third-party apps never receive the user's password, security questions, or payment data. - Users can view and revoke permissions for any connected app in real-time under the "Linked Apps" section of `https://accounts.suloro.com`. ## Data Retention & Deletion Cycles - **Active Accounts:** Data is retained while the account is active. - **Account Deletion:** When a user clicks "Delete Account" and confirms with their password, all profile data, active authentication tokens, and registered developer applications are permanently purged from active databases immediately. - **Backups:** Encrypted database backups purge purged records in automated 30-day rolling rotation cycles. --- # 3. Suloro Terms of Service ## User Agreements & Account Creation - **Age Requirement:** Users must meet the statutory legal consent age in their jurisdiction (typically 13+ or 16+ depending on regional law) to create a standalone Suloro Account. - **Account Security:** Users are responsible for maintaining the confidentiality of their credentials and enabling secure passwords. - **Single Sign-On Rules:** One account provides access across authorized Suloro services and third-party apps integrated via OAuth 2.0. - **Suloro Ads Terms:** Advertisers agree to brand safety standards and billing rules. Publishers integrating Suloro Ads agree that ads may appear across participating mobile and web apps, and prohibited from generating artificial or fraudulent impressions/clicks. ## Acceptable Use Policy Users and developers agree NOT to: - Attempt unauthorized access, credential stuffing, or brute-force attacks against authentication endpoints. - Register misleading, fraudulent, or impersonating developer applications. - Reverse-engineer private backend infrastructure or bypass rate-limiting controls. - Utilize Suloro services to transmit malware, phishing payloads, or spam. ## Developer Platform Terms - Developers utilizing Suloro OAuth 2.0 must enforce Proof Key for Code Exchange (PKCE with SHA-256). - Client secrets must be stored securely on server-side environments and never exposed in client-side code. - Developers must maintain a public, accessible Privacy Policy and Terms of Service for their applications. - Suloro reserves the right to suspend any developer client ID found violating user privacy or operating deceptive practices. --- # 4. Technologies & Security Architecture ## Cryptographic Standards - **In-Transit Encryption:** Encrypted transport using modern, secure TLS protocols with Perfect Forward Secrecy and Strict Transport Security. - **At-Rest & Client State:** Robust data encryption across datastores and sandboxed client sessions to ensure confidentiality and integrity. - **Password Security:** Memory-hard cryptographic hashing with salting and adaptive work factors, resistant to brute-force attacks. ## OAuth 2.0 & PKCE Implementation - **Standard:** RFC 6749 (OAuth 2.0 Authorization Framework) & RFC 7636 (PKCE). - **Challenge Method:** Dynamic cryptographic code challenge verification (`code_verifier`). - **Token Format:** Cryptographically signed JSON Web Tokens (JWT) with asymmetric verification keys and strict expiration timestamps. - **Immediate Invalidation:** Password changes trigger an instant revocation cascade, invalidating all outstanding refresh tokens across all registered devices. ## Multi-Session Account Chooser - The account switcher enables users to maintain multiple authenticated profiles on a single browser. - Each profile session is isolated in distinct cryptographic vaults, ensuring tokens from Account A cannot be accessed or reused by Account B. --- # 5. Frequently Asked Questions (FAQ) Knowledge Base ### Q1: What is a Suloro Account? **A:** A Suloro Account is your secure Single Sign-On (SSO) identity across Suloro and connected third-party platforms. It allows you to manage credentials, privacy settings, active sessions, and developer client IDs in one unified dashboard. ### Q2: Does Suloro track my browsing or sell my data? **A:** No. Suloro enforces a strict zero-surveillance and zero-data-sales policy. We do not use commercial surveillance pixels, cross-site tracking profiles, or behavioral advertising trackers. ### Q3: How do I delete my Suloro Account permanently? **A:** Navigate to `https://accounts.suloro.com/`, open **Data & Privacy**, scroll to the bottom, and click **Delete Account**. After confirming your password, your account, personal data, active sessions, and registered OAuth applications are permanently and irreversibly purged. ### Q4: Can I export my personal account data? **A:** Direct automated self-service data export is not provided in the dashboard to protect against automated exfiltration and keep client-side security lightweight. If you require an official or important personal data archive, email `support@suloro.com` for verified processing. ### Q5: What is Suloro Ads and where do ads appear? **A:** Suloro Ads is a contextual, privacy-focused advertising platform. Advertisers launch campaigns across banner, interstitial, and rewarded formats, while publishers integrate Suloro Ads into their mobile (Android, iOS) and web applications. Suloro Ads can show in any apps across the Suloro network without selling user personal data. ### Q6: How does Suloro protect passwords? **A:** Suloro uses salted memory-hard cryptographic key derivation functions. Passwords are never stored in plaintext, never logged in diagnostic files, and protected against offline brute-force attacks. ### Q7: What happens when I update my password? **A:** When you update your password, all active JWT sessions and refresh tokens across all logged-in devices are instantly terminated. ### Q8: What is required to register an app in the Developer Console? **A:** Developers must provide an Application Name, a 1:1 square Application Logo, valid Authorized Redirect URIs, a public Privacy Policy URL, and a public Terms of Service URL. PKCE (S256) is mandatory for authorization code exchanges. ### Q9: How do I revoke third-party app access? **A:** Visit `https://accounts.suloro.com/`, go to **Linked Apps**, and click **Remove** next to any connected application to immediately invalidate its authorization. ### Q10: How can I contact Suloro Support? **A:** Reach out by email at `support@suloro.com` or manage your account at `https://accounts.suloro.com/`. --- © 2026 Suloro. All rights reserved.