notlogin

Privacy Policy

Notlogin is an auth and payments broker for AI agents. Doing that job means holding identity proofs, credentials and, if you use it, a custodial wallet. This page says exactly what is stored, who else processes it and how to remove it. Last updated 2026-10-12.

Who we are

Notlogin is operated from Chile. Contact: hello@notlogin.com. "We" means the Notlogin service; "you" means the account holder, and by extension the agents that act with credentials you issue.

What we store

Account

Your email address, name if you give one, password hash (if you use a password), passkeys and two-factor secrets, and the sessions of your signed-in devices. Accounts created through Google, Apple or another sign-in provider also store the identifier that provider returns.

Identity proofs

Each proof you complete is stored as a type plus its canonical value: a verified email, an E.164 phone number, a linked Google/Apple/GitHub/LinkedIn/X/Discord account identifier, a wallet address, a World ID nullifier or a KYC result. For KYC we keep the decision and the minimum metadata the identity provider returns; document images stay with the provider. For SMS anti-abuse we keep a SHA-256 hash of the destination number, its country prefix and the requesting IP for a few days.

Credentials and vendor logins

Every verifiable credential you issue (vendor, scope, budget, expiry, proof transcript, signature, optional on-chain anchor hash) and the OAuth sign-ins you approve for vendors. Vendors receive only what the credential or consent screen shows you.

Wallets and payments

If you use the managed wallet, we generate one key pair per network family. Private keys are encrypted at rest (AES-256-GCM); in the vault tiers they are encrypted under a secret only you hold and we cannot move those funds. We record payments, charges, swaps, bridges and withdrawals made through Notlogin (amount, network, counterparty, transaction hash, status) to enforce budgets and to give you a history. Blockchain transactions are public by nature and cannot be deleted.

Operational data

Server logs (IP address, user agent, request path, time) kept for security and debugging, and error reports with secrets removed.

Analytics

The public site uses Google Analytics 4 only if you accept analytics cookies in the consent banner (Google Consent Mode v2; denied by default). You can change your choice at any time from the "Cookie settings" link in the footer.

Providers that process data for us

  • Google Cloud (hosting, database, encrypted backups) — United States.
  • Resend (transactional email: verification, sign-in links, charge approvals, receipts).
  • SMSGlobal (SMS verification codes).
  • Didit (identity verification / KYC), only if you start a KYC check.
  • World ID, Google, Apple, GitHub, LinkedIn, X and Discord, only for the proofs you choose to link.
  • Blockchain RPC providers and, for swaps and bridges, the routing services shown before you confirm.
  • Google Analytics, only with your consent.

We do not sell personal data and we do not use it for advertising.

How long we keep it

Account, proofs, credentials and wallet records are kept while your account exists. SMS anti-abuse rows are pruned after a few days. Server logs are rotated regularly. Backups are kept for 14 days. Records we must keep for fraud prevention or legal obligations may be retained longer.

Your rights

You can see your proofs, credentials and payment history in the dashboard, revoke any credential or vendor authorization at any time, and export your wallet keys (non-vault tiers). To access, correct or delete your data, or to close your account, write to hello@notlogin.com from the email on the account. Withdraw any funds before deletion: once keys are deleted they cannot be recovered.

Security

Credentials are signed with Ed25519, tokens are stored hashed, sensitive actions require a fresh sign-in (step-up), and wallet keys are encrypted at rest. No system is perfectly secure; report vulnerabilities to hello@notlogin.com.

Children

Notlogin is not directed to children under 16 and we do not knowingly hold their data.

Changes

We will update this page when the system changes and change the date at the top. Material changes are announced by email to account holders.

Privacy Policy — Notlogin