# Suloro Policies & Terms

> Official legal agreements, privacy guarantees, security architecture disclosures, and compliance documentation for Suloro.

## System Overview
policies.suloro.com is the centralized legal and compliance portal for all Suloro platforms (including Suloro Accounts, Suloro Developer Console, Suloro Ads, and Suloro applications). Suloro provides privacy-centric Single Sign-On (SSO) and OAuth 2.0 delegated authorization with zero cross-site behavioral tracking, in-app Suloro Ads, and client-side hardware-backed encryption.

## Canonical Policy Documents
- [Overview](https://policies.suloro.com/): Portal landing page summarizing privacy principles, account controls, and developer safeguards.
- [Privacy Policy](https://policies.suloro.com/privacy): Exhaustive disclosure of data collection boundaries, zero-sale commitments, Suloro Ads in-app advertising, support-directed data export, user rights, and international compliance (GDPR, CCPA, CPRA, DPDPA).
- [Terms of Service](https://policies.suloro.com/terms): Legally binding terms of use for personal accounts, acceptable use standards, developer platform API requirements, and Suloro Ads publisher and advertiser rules.
- [Technologies & Security](https://policies.suloro.com/technologies): Technical deep dive into AES-GCM (256-bit) Web Cryptography, OAuth 2.0 with PKCE (RFC 7636), multi-session sandboxing, Suloro Ads telemetry, and zero surveillance architecture.
- [Frequently Asked Questions (FAQ)](https://policies.suloro.com/faq): Complete indexed answers for account management, password protection, developer console setups, Suloro Ads, token lifespans, data export procedures, and account deletion.

## Core Architectural Guarantees
1. **Zero Profiling Surveillance & Zero Data Sales:** Suloro never sells user data, never embeds behavioral surveillance pixels, and never performs third-party cross-site profiling.
2. **Suloro Ads Across Apps:** Advertisers launch privacy-conscious campaigns, and publishers show contextual ad units across participating mobile (Android, iOS) and web applications.
3. **Data Export via Support:** Direct automated self-service data export is disabled to prevent automated exfiltration; verified personal data archive requests are fulfilled via `support@suloro.com`.
4. **Strong Data Encryption:** All sensitive records, communications, and session contexts are safeguarded with robust end-to-end and data-at-rest encryption.
5. **OAuth 2.0 with PKCE Enforced:** Third-party integrations require Proof Key for Code Exchange (S256 code challenge) and explicit user consent for minimal scopes (`name`, `email`, `dob`).
6. **Immediate Revocation & Session Invalidation:** Changing an account password or revoking app permissions immediately invalidates all active JWT access and refresh tokens.
7. **Irreversible Account Deletion & DPDP Compliance:** Full compliance with the Digital Personal Data Protection Act (DPDP Act) and global privacy regulations, with self-service permanent account deletion.

## Developer Quick Reference
- **Issuer URL:** `https://accounts.suloro.com`
- **Authorize Endpoint:** `https://accounts.suloro.com/oauth/authorize`
- **Token Endpoint:** `https://accounts.suloro.com/api/oauth/token`
- **Userinfo Endpoint:** `https://accounts.suloro.com/api/oauth/userinfo`
- **Supported Scopes:** `name`, `email`, `dob`
- **Mandatory Requirements:** PKCE (`code_challenge_method=S256`), registered redirect URIs, public Privacy Policy URL, public Terms of Service URL.

## Full Context Document
- [Full Text Knowledge Base](https://policies.suloro.com/llms-full.txt): Complete unabridged text of all policies, terms, and technical disclosures for LLM context windows and RAG systems.

## Contact & Inquiries
- **Support & Security:** `support@suloro.com`
- **Account Portal:** `https://accounts.suloro.com/`
- **Corporate Entity:** Suloro