Privacy

The platform account is deliberately small. We store:

• Your email address — the identity you sign in with, and the address we email a sign-in link to.
• Your access grants — which apps your account is approved for. An approved account currently holds a single wildcard grant covering every app on the platform.
• Your active sessions — a session record (with its creation and expiry time, and the IP address and user-agent of the sign-in) that keeps you logged in until it expires.
• Access requests — if you ask for access, we keep the email you submitted and whether it has been approved, so a person can review the list.
• Temporary sign-in records — when a sign-in link is requested for your email, a short-lived verification record (the address and a one-time token with an expiry) is stored so the link can be validated, then it expires. This can be created by anyone who enters an email into the login form, even before an account exists.

We do not store a password. The only way to sign in is a one-time magic link emailed to your address, so there is no password for us to hold.

The platform is a single account that works on every app. After you sign in on wastedtokens.io, the session cookie is set with Domain=.wastedtokens.io, which means it is shared across all *.wastedtokens.ioapps — that shared cookie is what lets you sign in once and use everything. The cookie is set only for the platform’s own domain; it is never sent to third parties.

When you use an app on a subdomain, that app asks the hub who is signed in. The hub returns your account id, your email, and your grants — nothing more. That is how an app knows it is you and that you are allowed in.

The public “request access” form is protected by Cloudflare Turnstile (a bot challenge verified on our server) and rate-limited using the requesting client’s IP address, so the form cannot be flooded. Approval is done by a person; there is no automated decision-making about your request.

• No advertising.
• No third-party analytics or tracking scripts.
• No selling or sharing of your data.
• No profiles beyond the account described above — we do not build a behavioural profile of you.

Mail is sent through an email delivery provider, which processes the email addresses and message content needed to deliver it. That covers your sign-in links and approval notices, and the notification we send ourselves when you request access (which includes the email you submitted). That provider is the only third party the platform hands your email to, and only to send these messages.

Each app on the platform may store data specific to what it does, and publishes its own privacy addendum on its own subdomain. The live example is Switchboard: switchboard.wastedtokens.io/privacy. When you use an app, read both this platform policy and that app’s addendum.

Access is invite-only and can be revoked at any time. To ask about your data, request deletion, or reach a person about privacy, email [email protected].

We may update this policy; changes are posted here with a new “last updated” date.