Privacy notice · Revised 3 November 2026
Privacy notice
This notice explains what tapdoor does with the information that passes through it. tapdoor is a sign-in relay: it receives the browser of a visitor who has just approved a sign-in with an identity provider and forwards that browser to the partner site that requested the sign-in.
- Stored data
- None
- Cookies
- None
- Request logs
- None
- Third parties
- None
1. What passes through
The identity provider appends two values to the return address: a one-time authorisation code and a state parameter. Both belong to the sign-in that the visitor started on the partner site. tapdoor includes them, unchanged, in the redirect it sends to that site. The code is not exchanged for tokens here, and no profile information, such as a name, an e-mail address or an account identifier, is requested or received by tapdoor.
2. What is kept
Nothing. tapdoor has no user accounts, no database and no session store. Request logging is switched off for this host, so neither the visit nor the values carried in the return address are written to disk. Once the redirect has been sent, no record of the visit remains.
3. Cookies and tracking
No cookies are set by this host. No analytics, advertising, fingerprinting or social-media code is embedded in its pages, and no resource is loaded from any third party. The pages you are reading are static files delivered with the same security headers as the relay itself.
4. Transport security
All traffic to and from this host is encrypted with TLS 1.2 or later. A request made over plain HTTP is redirected to HTTPS before any content is served.
5. The partner site and the identity provider
The sign-in is completed by the partner site, which exchanges the authorisation code with the identity provider and creates or opens your account under the privacy policy published on that site. Your relationship with the identity provider is governed by that provider's own terms and privacy policy. tapdoor is a party to neither.
Where the identity provider is Google, the information a partner site receives from a Google account is used only to create or open the visitor's account on that site, in accordance with the Google API Services User Data Policy, including its Limited Use requirements.
6. Changes to this notice
This notice is reviewed whenever the relay changes. The revision date at the top of the page identifies the current version.
7. Contact
Questions about this notice can be sent to [email protected].