Legal

Privacy Notice

Effective: 23 August 2026

Controller and scope

Kequtech Innovations Kft., 1061 Budapest, Paulay Ede utca 56., 4. emelet 1. ajtó, Hungary, is the controller for MyAddress ID. Questions and data-rights requests may be sent to [email protected]. This notice covers the account, authentication, connected-application, and developer features at id.myaddress.cc.

Data we process

• Account data: an internal account identifier, status, creation time, and the private email address or addresses attached to the account.
• Authentication data: passwordless challenge records, hashed one-time codes, attempt and expiry information, sessions, and any optional Google or GitHub sign-in link.
• Connection data: consent decisions and a distinct pairwise identifier and generated MyAddress address for each connected application.
• Developer data: registered application details, verified domains, redirect addresses, hashed credentials, status, and message-request usage needed to protect the service.
• Technical and security data: request metadata, security events, timestamps, and diagnostic records produced when the service is used.

Most data comes directly from the account holder. If an optional social sign-in method is used, the relevant provider supplies the identifier and account information required to link that method.

Why we process it

We process account and authentication data to create and operate the requested account and connected sign-ins, to deliver one-time codes, and to honour connection and account-management choices. We process limited security and diagnostic data for our legitimate interests in preventing abuse, maintaining reliability, and establishing or defending legal claims. Where a legal obligation applies, that obligation is an additional basis.

Recipients and service providers

• Railway provides application and database hosting.
• Cloudflare provides DNS and proxy services and may process connection data.
• SMTP2GO delivers passwordless sign-in and other transactional messages.
• Google or GitHub processes data only if that optional sign-in method is enabled and chosen.
• Connected applications receive their own pairwise subject and generated MyAddress address after approval. They do not receive the private sign-in email from MyAddress ID. Each connected application is responsible for its own processing.
• MyAddress Mail receives the account identifier needed to operate the mailbox and may request the current notification address when delivering an account notification.

MyAddress ID does not use advertising or analytics trackers, and it does not send data to OpenAI.

Some providers may process data outside the European Economic Area. Where required, Kequtech relies on an adequacy decision or appropriate contractual safeguards for that transfer.

Retention and account closure

Account and active connection data is retained while the account is open. One-time sign-in codes expire after 10 minutes and browser sessions expire after 30 days, although security records about an event may be kept separately for as long as reasonably needed to investigate abuse.

An account holder may ask support to close the account and delete its content. Kequtech will delete or irreversibly anonymise the active account, connection, and associated MyAddress Mail content, subject only to data that must be retained for a legal obligation or the establishment, exercise, or defence of legal claims. Such limited records are ordinarily kept for no longer than five years unless a longer statutory period applies.

Cookies and security

MyAddress ID uses strictly necessary host-only cookies for CSRF protection, passwordless sign-in, authentication sessions, and OpenID Connect interactions. They are not used for advertising. Sessions expire after 30 days or are cleared on sign-out; shorter-lived interaction cookies expire when their task ends.

Kequtech applies access controls, hashed one-time codes and developer credentials, encrypted transport, scoped connected-app identities, and other measures proportionate to this service. No internet service can guarantee absolute security.

Your rights

Subject to applicable law, a person may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Consent may be withdrawn where consent is the basis. Requests should be sent to [email protected]. A complaint may be made to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or another competent supervisory authority.

Age requirement and changes

MyAddress ID is intended only for people aged 18 or over. Kequtech may update this notice when the service or its legal obligations change; the effective date above identifies the current version.