Privacy Policy

Effective October 31, 2026

Tooly SSO (at sso.tooly.fyi) is a single sign-on service operated by itpro360 LLC ("we"). It lets you sign in once and use connected self-hosted apps. This policy explains exactly what the service collects, why, who can see it and how long it's kept.

What we collect and why

• Account details: your name, email address, whether and when you confirmed it, a username derived from your email, the time you agreed to these policies, the invite code you used (if any), your groups, whether you are an administrator, your theme preference, and when you last signed in. We need these to run your account and decide which apps you can use.
• Profile photo (optional): if you add one, we store a 320×320 copy you cropped in your browser. It is published at a long, hard-to-guess web address so connected apps can show it, which means anyone who has that address can see it. You can change or remove it any time, and administrators can remove it.
• Email confirmation, email changes and password resets: when you sign up, ask to change your email or reset your password, we store a one-time code (only as a hash), the new address you asked for, and when you asked. Sign-up confirmation links work for 48 hours, email-change links for 24 hours and password-reset links for 60 minutes; the record is cleared when the link is used or replaced.
• Security credentials: your password is stored only as a salted scrypt hash. Your authenticator secret is stored so we can check your codes. Recovery codes are stored only as hashes. We record failed attempts and temporary lockouts to protect your account.
• Sign-in sessions and app tokens: when you sign in we create a session, and when an app asks to sign you in we issue it short-lived codes and tokens. These record which account and which app they belong to.
• What connected apps receive: when you open an app you have access to, it receives your account ID, email address (and whether you confirmed it), name, username, photo, groups and whether you are an administrator, depending on what that app requests. Each app then handles that information under its own practices.
• Activity log (security): each sign-in, sign-out, sign-up, failed attempt, lockout, rate-limit block, password, two-step or recovery-code change, email change, password-reset request, profile-photo change, email sent or failed, app sign-in, access refusal, administrator action, settings change, data export, account deletion and server error is recorded with the time (UTC), the event, the account involved, short details, your IP address and your device/browser description (user agent). We use it to detect and investigate misuse. You can see your own recent sign-ins on your account page.
• Deletion records: when an account is deleted we keep a separate record of the account ID, email, who deleted it, when, and the IP address and device used.
• Analytics: daily totals only: page views; unique visitors, counted with a one-way hash of your IP address and browser that uses a secret that changes every day (the raw IP is not stored for analytics, and the day's hashes are discarded when the day changes); pages viewed; the domain of the site that linked you here; browser, operating system and device type; your country as reported by Cloudflare; and counts of actions such as sign-ins, sign-ups and app sign-ins. No third-party analytics tools are used.

Cookies and browser storage

We use only strictly necessary storage, so there is no cookie banner:

• sso_sid: keeps you signed in to this site and protects forms from forgery.
• _session, _interaction, _interaction_resume (and their .sig signatures): used by the sign-in protocol so connected apps can sign you in.
• sso-theme in your browser's local storage: remembers whether you chose the light, dark or automatic theme. It never leaves your browser (if you are signed in, the same choice is also saved on your account).

We don't use advertising or tracking cookies.

Who can see your information

• You can see your profile, apps, and recent sign-in history on your account page.
• Connected apps receive the sign-in details listed above when you use them.
• Administrators of this service can see accounts, groups, the activity log and analytics, and can reset passwords and two-step verification.
• SMTP2GO (our email delivery provider, a processor) handles the emails we send you: sign-up confirmations, email-change confirmations and notices, password-reset links and invites. It receives your email address and the message content.
• Cloudflare carries traffic to this site as our network provider (processor) and sees connection data such as IP addresses.
• Authorities, if we are legally required to disclose information.

We don't sell or rent personal information.

Requests your browser makes to others

This site loads all of its pages, styles, scripts and icons from itself. Your profile photo is cropped in your browser before it's uploaded. The QR code for your authenticator is drawn in your browser and isn't sent anywhere. When you open an app from your app list, your browser goes to that app's own address.

How long we keep it

• Account details, credentials and profile photo: until your account is deleted (or, for the photo, until you remove it).
• Email-change requests: until confirmed, cancelled or expired (24 hours). Password-reset requests: until used or expired (60 minutes).
• Sign-in sessions: up to 14 days. App sign-in codes: about 2 minutes; app access tokens: 1 hour; app refresh tokens: up to 14 days.
• Sign-in history shown on your account page: 30 days (drawn from the activity log).
• Activity log and deletion records: 12 months, then deleted automatically.
• Analytics daily totals: about 120 days.
• Data backups: daily copies of account data, kept 14 days. A deleted account may remain in backups until they expire.

Your choices and rights

• See and export: download a copy of your account information and your activity from your account page.
• Correct: change your name, photo, email (confirmed by a link to the new address) and password on your account page. If you forget your password, use "Forgot your password?" on the sign-in page.
• Delete: delete your account yourself from your account page (password and code required). It signs you out of every app immediately.
• Contact us with any other request at [email protected].

Security

We protect accounts with mandatory two-step verification, hashed passwords, lockouts after repeated failures, per-network rate limits, encrypted connections (HTTPS through Cloudflare) and a security log. No system is perfectly secure, and we can't guarantee that information will never be accessed without permission.

Where it's stored

On a server operated by itpro360 LLC in the United States.

Age

This service isn't intended for anyone under 16, and they may not create an account.

Changes

If we change what we collect or how long we keep it, we'll update this page and its effective date, and note it in the changelog.

Contact

itpro360 LLC: [email protected].