Privacy Policy

NumID collects only the minimum data necessary to provide our service:

• Phone Number: Verified via SMS OTP during signup. Used to create your unique NumID address and for account recovery.
• Destination Email: Where you want emails forwarded. Verified through a code sent by Cloudflare.
• Avatar Image (Optional): Your profile picture, stored on Cloudflare R2 (AWS-backed object storage) in the us-west region.
• Social Profiles (Optional): Links to your public profiles (Twitter, GitHub, LinkedIn, etc.) shown on your public directory.
• Vault Items (Encrypted): Credentials, notes, and sensitive data encrypted end-to-end. We never see the plaintext.
• Usage Logs: Audit trail of account actions (logins, email changes, vault edits) for security.

Database: Supabase (PostgreSQL hosted on AWS) in the us-east-1 region. Data is encrypted at rest.

Vault Encryption: Your vault items are encrypted client-side using AES-256 before leaving your browser. Only you can decrypt them—NumID servers never have access to the plaintext keys.

Email Forwarding: Cloudflare Email Routing handles your incoming emails. Email headers are processed by Cloudflare's servers; we do not store the email content.

Avatars: Stored on Cloudflare R2 (AWS S3-compatible) with public read access so your profile picture displays on your public directory page.

In Transit: All communication between your browser and NumID servers uses TLS 1.3 encryption. We use HTTPS everywhere.

• No Ads: We do not show advertisements or sell ad space.
• No Data Sales: We never sell, rent, or trade your personal data.
• No Third-Party Sharing: We do not share your data with external services except those required to operate (Supabase, Cloudflare, AWS, Twilio for SMS verification).
• No Tracking: We do not use analytics pixels, cookies, or third-party trackers to follow your behavior.
• No Reading Your Emails: Cloudflare Email Routing forwards emails directly to your destination inbox. NumID never reads the content.
• No Vault Access: Your encrypted vault items cannot be decrypted by NumID employees or servers.

Data Export: You can download all your data (profile, audit logs, vault metadata) in JSON format from your dashboard.

Account Deletion: You can permanently delete your account and all associated data. After deletion, there is a 30-day grace period before permanent removal from backups.

Right to Be Forgotten: Under GDPR and similar regulations, you have the right to request erasure of your personal data. See our GDPR/Data Rights page for details.

Correction: You can update your email, name, avatar, and social profiles at any time from your account settings.

NumID relies on the following third-party services. We are not responsible for their privacy practices; please review their policies:

• Supabase: Database and authentication. See Supabase Privacy Policy
• Cloudflare: Email routing and R2 storage. See Cloudflare Privacy Policy
• Twilio Verify: SMS OTP delivery. See Twilio Privacy Policy
• Resend: Invitation emails. See Resend Privacy Policy

We only use essential cookies for:

• Maintaining your session (authentication)
• Storing your theme preference (light/dark mode)

We do not use analytics services, pixels, or third-party cookies.

• Active Accounts: Data is retained as long as your account is active.
• Deleted Accounts: After deletion, data is removed from live databases within 24 hours. Backups are retained for 30 days, then permanently deleted.
• Audit Logs: Security logs are retained for 90 days for fraud investigation.

NumID is committed to compliance with:

• GDPR (EU): You have rights to access, export, and delete your data.
• CCPA (California, USA): You have the right to know, delete, and opt-out of data sales (which we don't do anyway).
• PIPEDA (Canada): Your personal information is protected under Canadian privacy law.

See our GDPR/Data Rights page for more information on exercising your rights.

If you have privacy questions, data requests, or concerns, contact us at:

Email: privacy@numid.dev

We commit to responding within 30 days to any privacy inquiry.