Privacy Policy
Y Account is built around data minimisation. This page explains what is stored, why, and what is deliberately never stored.
1. Data we collect
Account data: username, email address, display name, language preference, password hash and acceptance timestamps. Security data: last sign-in time, last IP address and rate-limit counters. Optional verification: surname initial and the final two characters of your resident ID.
2. How we use it
We use this data to authenticate you, protect the service from abuse, display your account, respond to security incidents and operate integrations you explicitly authorise.
3. What we never store
Passwords are stored only as one-way hashes. Full resident ID numbers are validated in memory and discarded; they are never written to the database or application logs.
4. Cookies and sessions
Y Account uses a hardened session cookie, a language cookie and, if you choose, a remembered-device cookie. These are HttpOnly and SameSite. No advertising or analytics cookies are used.
5. Sharing
We do not sell personal data. Data is shared with a connected application only after you approve the requested scopes. We may disclose data when legally required or to protect rights and safety.
6. Retention and your rights
We retain account data while your account is active and for as long as needed to meet legal and security obligations. You may request access, correction or deletion through the Y Account operator.