Privacy Notice
Prototype notice updated 29 October 2026
1. Data we handle
Account profiles may include name, email address, telephone number, username, administrator-assigned MyID, profile photo, and account role. Authentication also uses credentials, device sessions, passkeys, and optional authenticator secrets.
2. Storage and providers
The configured deployment uses Notion for account, service, and connection records; Cloudflare for compute and session storage; and ImgBB for profile images when uploads are enabled. Those providers have separate privacy terms.
3. Sharing with connected services
Registered services request specific fields during authorization. AVA records your approval and releases only the approved data to that service.
4. Controls
Account holders can inspect linked services, revoke access, manage active device sessions, and configure passkeys and an authenticator. Administrators can modify or deactivate accounts.
5. Security and retention
Sessions are limited in duration. Stored credentials should use non-reversible password hashing. Older prototype accounts may still use legacy encrypted credentials and should be migrated before a public launch. Photos uploaded to ImgBB may persist under the image host's terms.
6. Questions
Contact the administrator listed on the AVA Passport sign-in screen. This notice is a development draft and should be reviewed before public use.