Suloro Privacy Policy

1. Introduction

This Privacy Policy is meant to help you understand what information Suloro collects, why Suloro collects it, and how you can update, manage, export, and delete your information. Suloro provides authentication services, Single Sign-On (SSO), developer tools, and privacy controls across web and mobile applications.

You can use Suloro in a variety of ways to manage your privacy. For example, you can sign up for a Suloro Account if you want to store and synchronize your identity across authorized platforms, configure fine-grained OAuth 2.0 PKCE permissions for third-party developer applications, and take control of your profile claims. You can also interact with public Suloro resources and technical documentation without signing in. Across all Suloro services, you have direct control over your information and how that data is utilized.

2. Privacy & Security Principles

Suloro was engineered around core principles designed to protect your privacy and security:

3. Information Suloro Collects

We want you to understand the types of information Suloro collects as you interact with our services. Suloro collects information to deliver reliable Single Sign-On, protect your credentials against unauthorized access, mitigate brute-force cyber threats, facilitate delegated developer integrations, and support Suloro Ads functionality.

A. Things You Create or Provide to Suloro

When you create a Suloro Account, you provide essential identity claims and credentials necessary to authenticate and maintain your profile:

• Primary Display Name & Profile Identifier: Your chosen name or preferred display name used to identify your account across authenticated services and during OAuth consent prompts.
• Email Address & Recovery Contact: Your primary email address used as your unique login identifier, for cryptographic password reset workflows, and for essential security incident alerts.
• Cryptographic Password & Credential Hashes: High-entropy user passwords, which are immediately processed using memory-hard salted key derivation algorithms before storage. Passwords are never stored or transmitted in plaintext.
• Date of Birth & Age Verification: Collected strictly for international age verification and child safety compliance under COPPA and regional laws. Setting your date of birth ensures appropriate privacy guardrails are applied. Once verified, this date cannot be altered without identity verification, preventing age falsification or unauthorized account transfer.
• Profile Avatar: An optional profile picture or avatar you upload to personalize your identity across connected services and authorized applications.
• Developer Application Configurations: If you utilize developer tools, you provide technical metadata including application names, 1:1 square brand icons, authorized OAuth 2.0 redirect URIs, and delegated scope definitions.

B. Information Collected as You Use Suloro

When you access Suloro portals or authenticate via Single Sign-On, systems automatically collect technical operational diagnostics to preserve session integrity and detect malicious intrusion:

• Device & Hardware Signatures: Device model, operating system architecture, screen resolution, browser rendering engine, and language preferences to deliver optimized rendering and detect anomalous device switching.
• Network & Routing Telemetry: IP addresses and coarse geographic region data used strictly for security monitoring and detecting credential stuffing attacks.
• Session Lifecycles & Token Exchanges: Timestamps of sign-in events, token refresh handshakes, OAuth code exchange verifiers, and session invalidation requests.
• Security Event Logs: Failed password counters, exponential backoff locks, anomalous token requests, and rate-limiting triggers.

C. Client-Side Security & Session Management

To eliminate sluggish server roundtrips and enable fast multi-account switching on a single device, Suloro uses secure client-side session mechanisms:

• Encrypted Client State: Client-side data is encrypted to maintain sandboxed account profiles in the Suloro Account Chooser without sharing token contexts between different signed-in users.
• Ephemeral In-Memory State: Temporary, protected in-memory state used to manage verification proofs and cryptographic code challenges during OAuth authorization flows.

4. Why Suloro Collects Data

Suloro processes personal and technical data strictly for specific, legitimate purposes:

Operational Commitments

Suloro does not sell personal data to third parties. Any use of data outside the scope of this Privacy Policy requires explicit prior consent.

5. Your Privacy Controls

You maintain sovereignty over your information. Within your Suloro Account, you have access to privacy controls:

• Profile Information Management: Update your display name, profile picture, and account credentials directly from your dashboard at any time.
• Active Session Management: View all active devices, browsers, and IP locations signed into your account. You can terminate individual sessions or execute a sign-out that revokes refresh tokens across devices.
• Linked Application Audit: Review all third-party developer applications that have been granted access to your profile claims, inspect their approved scopes, and revoke their permissions instantly with a single click.
• Authentication Security Review: Audit recent sign-in history, rate-limiting triggers, and password update events to verify account integrity.

6. Sign in with Suloro & Third-Party Applications

When you choose to use "Sign in with Suloro" on third-party web apps, games, mobile applications, or developer platforms, Suloro serves as your secure identity provider. Data shared with external parties is governed by strict safeguards:

Strict Protections for Third-Party Logins:

• Zero Password Sharing: Third-party applications never see, handle, or store your Suloro account password. Authentication is validated purely through cryptographically signed OAuth 2.0 PKCE tokens.
• Scope Minimization: Developers are restricted to least-privilege scoping. Applications cannot request or access unapproved profile attributes, other linked applications, or private security logs.
• Real-Time Permission Revocation: You can revoke an application's access at any time through the Linked Apps tab in your Suloro Account. Revocation immediately invalidates existing access and refresh tokens, preventing any further data requests.
• Mandatory Developer Compliance: Every application registered with Suloro must maintain accessible Privacy Policy and Terms of Service URLs, uphold data security, and never harvest user credentials.

7. Suloro Ads Platform & In-App Publisher Advertising

Suloro operates Suloro Ads, a proprietary advertising platform designed for advertisers, publishers, and users across mobile applications and web services.

Privacy Standards in Suloro Ads

• No Selling of Personal Data: Suloro Ads does not sell your name, email, or personal profile data to advertisers or third parties.
• Publisher Responsibility: Publishers integrating Suloro Ads into their apps must disclose ad rendering in their own application privacy policies and comply with applicable app store rules and privacy laws.
• Ad Event Telemetry: When an ad is displayed or clicked in an app, Suloro processes technical metrics (such as device type, coarse region, and timestamps) strictly to verify legitimate ad delivery, prevent click fraud, and calculate publisher payouts.

8. Sharing Your Information

Suloro does not sell, rent, trade, or share your personal information with third-party companies, organizations, or individuals, except under the following strictly defined conditions:

• With Your Explicit Affirmative Consent: When you authorize a third-party application via "Sign in with Suloro", Suloro shares only the specific claims you explicitly approved on the consent screen.
• With Domain Administrators: If your Suloro Account is managed by your employer, school, or organization, your domain administrator may have administrative access to review security logs, reset passwords, or manage organization access.
• With Infrastructure Service Providers: Suloro partners with cloud datastore, hosting, and network edge providers strictly to host infrastructure, maintain database clusters, mitigate DDoS attacks, and deliver reliable service. These providers process information exclusively under instructions and strict security agreements.
• For Legal & Safety Compliance: Suloro will disclose information if required by applicable statutory law, valid subpoena, enforceable court order, or governmental mandate, or to protect the safety, rights, and property of Suloro, users, and the public.

9. Keeping Your Information Secure

Suloro deploys defense-in-depth security architectures to ensure that systems are protected against unauthorized access, data alteration, and cyber threats:

• Transport Encryption: All data in transit across our networks and endpoints is encrypted using modern, secure transport protocols with Perfect Forward Secrecy and Strict Transport Security.
• Storage Encryption: All user records, session caches, and cryptographic keys are encrypted at rest across isolated datastores.
• Memory-Hard Password Hashing: User passwords are never stored in plaintext or reversible formats. Passwords are salted with cryptographically secure random salts and hashed using memory-hard algorithms designed to defeat brute-force dictionary attacks.
• Adaptive Rate Limiting: Authentication endpoints enforce progressive, adaptive cooldowns upon repeated failed login attempts, rendering automated credential stuffing ineffective.
• Cryptographic Multi-Session Isolation: Each account session on the client device is sandboxed in its own isolated cryptographic context, preventing session leakage between multiple active accounts.

10. Exporting & Deleting Your Information

Suloro respects your data ownership and rights to erasure and data portability.

A. Data Export Policy

B. Permanently Deleting Your Suloro Account

Upon password confirmation, the deletion process executes immediately. Your account credentials, profile attributes, active session tokens, and registered developer applications are permanently and irreversibly purged from active datastores.

11. Retaining Your Information & Erasure Cycles

Suloro retains personal data only as long as necessary to maintain your active account, support legitimate Suloro Ads verification, and fulfill security purposes:

• Active Account Profile Data: Retained in active datastores for the lifetime of your account until modified or deleted by you.
• Security & Ad Audit Telemetry: Network logs, IP addresses, rate-limiting counters, and advertising verification records are cycled and purged in accordance with standard retention schedules.
• Deleted Account Records: Once you complete account deletion, your primary records are purged immediately. Ephemeral backup snapshots are overwritten in standard rotational cycles.

12. All Ages, Child Safety & Global Laws

Suloro is designed for users worldwide, adhering to international data protection frameworks:

A. Minor & Child Safety Safeguards

Suloro takes the protection of minors seriously. In compliance with the U.S. Children's Online Privacy Protection Act (COPPA), EU GDPR child consent rules, and global child safety statutes:

• Suloro does not knowingly collect personal information from children under 13 (or under 16 in certain European jurisdictions) without verifiable parental consent.
• Date of birth is verified during registration to ensure age-appropriate safeguards and prevent deceptive account creation.
• Accounts belonging to minor users are never subject to commercial targeting or public indexation.

B. European Union, EEA & United Kingdom (GDPR & UK GDPR)

If you reside in the European Economic Area or the United Kingdom, you possess statutory rights under Articles 15–22 of the GDPR, including the Right of Access, Right to Rectification, Right to Erasure, Right to Restriction of Processing, Right to Data Portability, and Right to Object. For data export requests under GDPR, email support@suloro.com.

C. United States Privacy Frameworks (California CCPA/CPRA & State Laws)

Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), as well as privacy statutes in Virginia, Colorado, Connecticut, Texas, and other states, residents have rights to know, access, correct, and delete personal data. Suloro does not sell personal information. For verifiable consumer data requests, contact support@suloro.com.

D. India & Digital Personal Data Protection Act (DPDP Act)

For users in India, Suloro strictly complies with the Digital Personal Data Protection Act (DPDP Act) and applicable Indian data protection and cybersecurity regulations:

• Lawful & Consent-Based Processing: Personal data is processed solely for lawful, specific, and explicitly stated purposes with verifiable user consent or for legitimate uses recognized by law.
• Data Principal Rights: Under the DPDP Act, Indian users as Data Principals have statutory rights to:
  • Obtain a summary of personal digital data being processed and processing activities.
  • Request correction, completion, and updating of inaccurate or misleading data.
  • Request erasure of personal data that is no longer necessary for the specified purpose.
  • Avail readily accessible mechanisms for grievance redressal.
  • Nominate another individual to exercise data rights in the event of death or incapacity.
• Purpose Limitation & Data Minimization: We collect only the minimum digital personal data required to deliver Suloro services and retain it only as long as necessary to fulfill specified purposes or satisfy statutory obligations.
• Child Privacy Safeguards: Under the DPDP Act, processing of children's data is carried out with verifiable parental consent, with strict prohibitions on behavioral tracking, targeted advertisements directed at minors, or detrimental processing.
• Grievance Redressal: In accordance with the DPDP Act, users may direct privacy inquiries or exercise their statutory Data Principal rights by emailing our designated privacy team at support@suloro.com.

E. Asia-Pacific & Global Frameworks

Suloro similarly upholds privacy legislation across all regions, including the Singapore Personal Data Protection Act (PDPA), Australia Privacy Act (Australian Privacy Principles), Japan APPI, Brazil LGPD, and Canada PIPEDA.

13. About This Policy & Contact

Suloro may periodically update this Privacy Policy to reflect technological improvements, service enhancements, or legal requirements. Significant amendments will be announced with prominent notices on our website and within your dashboard.