Privacy policy

• • Your name and email address, either entered directly at registration or provided by Google/Facebook when you choose "Continue with Google" or "Continue with Facebook"
• • A one-way, irreversibly hashed copy of your password, if you set one — we never store or can see the password itself
• • If you connect a Google or Facebook account: a unique account identifier from that provider, so we can recognize you on a later sign-in. We do not receive or store your Google/Facebook password, and we only ever request your name, email address and basic profile information — nothing else, and nothing is ever posted back to Google or Facebook on your behalf
• • Sign-in activity: timestamps, IP address and device/browser information, kept so we can detect suspicious activity and show you a record of your own recent sign-ins

• • We never sell your information to anyone
• • An application you sign into only ever receives what it explicitly asked for and you were shown on the consent screen — typically just your name and email address, never your password or your Google/Facebook account details
• • We never post, message, or take any action on your Google or Facebook account on your behalf

Account information is kept for as long as your account exists. Test ("sandbox") accounts, created only for trying out an integration before it goes live, are automatically deleted after 30 days. Sign-in activity records are kept for security and audit purposes and are periodically cleaned up on the same schedule.

To disconnect a linked Google or Facebook account, remove OneLogin's access from your Google or Facebook account settings directly, or contact us at the address below and we'll do it for you. To request deletion of your OneLogin account and the data described above, contact us at the same address.

Questions about this policy, or a request to access or delete your data: [email protected].