Data-use policy

Version 1.0, in force from October 15, 2026.

This policy says how an app that uses Sign in with Atheron may use what it receives about people. It is part of the developer terms between you and Atheron Network Inc., 1631 Dickson Ave., Suite 1100, Kelowna, BC V1Y 0B5, Canada.

1. What you receive

You receive only what the person agreed to on the consent screen, scope by scope: an identifier (sub) and, if asked for and agreed to, their name, email, whether their age is verified and whether they are an adult where they live, their Atheron membership plan, their linked wallet addresses, their purchases or their creator status. You never receive a password, a date of birth, an identity document, a payment detail or anything a person did not agree to.

2. What you may do with it

• Use it to provide the features of your app that the person asked for and that you described on your consent screen and in your privacy policy.
• Use sub as the key for your own records about that person. Do not use email as a key.
• Ask userinfo for current details when you need them, rather than keeping copies you do not need.

3. What you may not do with it

• Sell it, rent it, or give it to data brokers or advertising networks.
• Use it to build profiles of people across apps or services, or to target advertising.
• Combine it with other data to identify a person who has not identified themselves to you, or to link wallet addresses to identities beyond what the person agreed to.
• Use the age claim for anything other than deciding whether your app's age rules are met.
• Use it to decide on credit, insurance, employment or housing, or in any way that discriminates unlawfully.
• Share it with anybody else, except service providers who process it for you under a written contract at least as protective as this policy.

4. Keeping it

Keep it only as long as you need it for the features the person uses. When a person takes back access (you receive consent.revoked), stop using what you received under that consent and delete it within 30 days, except what the law requires you to keep. When your app is removed or suspended, the same applies to everybody who connected it.

5. Sensitive details

Age, membership, wallet, purchase and creator details are sensitive. Your live app may ask for them only after our review, and only for the reason you gave us. Protect them with access controls and encryption.

6. People's rights

Tell people in your privacy policy how to reach you. Answer their requests to see, correct or delete what you hold about them within the time the law that applies to you requires, and in any case within 30 days.

7. Checking

We may ask you to show how you follow this policy, and to confirm in writing that you deleted data you no longer may keep. We may suspend an app that does not follow it.

8. Contact

Questions about this policy: privacy@aton-network.org.