Privacy

Currawong ID is the sign-in for every Currawong app. This page says what it keeps, and who else sees anything.

What we keep

• Your email address, when you made your ID, and when you last signed in.
• For each passkey: its public key, the name you gave it, and when it was added and last used. The private half never leaves your device.
• If you connect Google: the number Google uses for your account, and the email address it gave us.
• If an app invited you and you add a backup address: that address, when it was added and when it was last used to sign in, and a record of changes to it (kept for a year). Apps are never told it.
• If an app invited you: the invitation, and when it was used. Your name and the name of the person who invited you are kept only to greet you on the invitation page, and are deleted once it has been used or has run out.
• Your signed-in sessions (up to 30 days), and sign-in links and codes for as long as they work. We keep only a scrambled copy of each link and code.
• To stop abuse, a count of recent sign-in requests for each email address and each internet address, kept for about two hours.

What apps are told

When you sign in to a Currawong app, it is told your ID’s number (a random string), your email address, and how and when you signed in: email link, passkey or Google. Nothing else.

Who else sees anything

• Cloudflare runs this service and sends its emails. Its request logs, which include internet addresses, are kept for up to seven days.
• Google, only if you use Sign in with Google. Google sees that you signed in to Currawong ID, and when. It doesn’t see which Currawong app you were going to, or anything you do there. We ask Google for your email address only, not your name or photo.
• Nobody else. There are no ads and no trackers, and nothing is sold or shared.

Deleting your ID

Ask us with the form on currawong.dev and we’ll delete your ID, its passkeys and any connected Google account. Database backups keep a copy for up to 30 days. Each app keeps its own records, such as the newsletters you made, and deleting your ID doesn’t remove those.

Updated 12 November 2026.