Draft Last updated 2026-11-06
Privacy policy
This notice explains what Shomahmudoff Account stores about you, why, and what you can do about it. The account signs you in to the Shomahmudoff services; each service has its own notice for the data you create in it.
What we store
- Your account: name, email address, language and time zone.
- Sign-in methods: your password only as an Argon2id hash, the two-step verification secret encrypted, recovery codes only as hashes, and the public keys of your passkeys.
- Linked accounts: when you sign in with Google or GitHub, the provider, your account ID there, and the name and email address it gave us.
- Devices and sessions: a short browser description, the browser user agent, IP addresses and times.
- Organizations: the teams you belong to and your role in them.
- Connected apps: which apps you allowed, what they may see and when you allowed it.
- Activity log: security events such as sign-ins, failed attempts and changes, with time, IP address and browser.
Why we store it
To sign you in, to keep the account safe (limits on attempts, alerts about new devices, the security check-up), to tell the apps you allow who you are, and to send you codes and security emails.
What apps receive
An app receives only what you allowed: your account ID and, if it asks, your name, email address and language. Built-in services of the ecosystem are connected without asking; you see them under Connected apps and can revoke them there.
Other parties
If you choose to sign in with Google or GitHub, that provider tells us who you are. We never see your password there.
When a password is set, we check it against known breaches with the Have I Been Pwned service. Only the first five characters of a hash of the password leave our server, never the password.
Emails are sent by our own mail service through our mail provider. We do not sell data and we show no ads.
Cookies
We use three cookies, all required: the session cookie while you are signed in, a device cookie (400 days) to recognise your browser, and a language cookie (one year). Your theme choice stays in your browser. There are no tracking or third-party cookies and no third-party scripts.
How long we keep it
Your account data stays until you delete the account. The activity log is kept for 400 days and ended sessions for 90 days. Sign-in codes expire within minutes.
When you delete the account, we remove your email addresses, sign-in methods, linked accounts, app connections and memberships, and sign you out everywhere. An empty record with your account ID stays so that the services can tell that the account was deleted; activity entries stay until they expire.
Your choices
You can see and change your data in the account, download a copy of it and delete the account at any time: Data and privacy
Questions? Write to support@shomahmudoff.uz
Changes
This is a draft. When it changes, we update this page and its date, and tell you about important changes by email.