What Omxus stores about you

This is everything Omxus keeps for an account, in plain words.

What	Why	How long
Your email address or mobile number, readable, and when you verified it	To send your codes and security notices	Until you change it or delete your account. Not yet verified: 30 days at most
Your usernames, shared or per site	So sites can show your name	Until you change them or delete your account
A scrambled form of your password, never the password	To check your password when you sign in	Until you change it or delete your account
The public part of each passkey, the site it's for, when you saved it and last used it, and whether it's backed up	To check passkey sign-ins	Until you remove it or delete your account
A site address for the name, date of birth and secret words way in, if you use it	To recognise that account	Until you delete your account
Your sessions: site, how you signed in, when, your browser, and a shortened network address	To keep you signed in and let you sign out anywhere	Up to 90 days per sign-in
Security events, with a shortened network address	So you can review activity, and to protect accounts	90 days
Codes and sign-in tokens, as one-way fingerprints only	To check them once	Minutes to days, then they expire
Recent attempts from an address, account or network	To slow down and stop guessing	Used for 15 minutes
Whether support turned the account off, and why	To protect people from abuse	Until it's turned on again or the account is deleted

For sites that moved to Omxus

If a site brought your account across, we also keep its old ID for you and any role you had there, for that site only, plus its old password record until your first sign-in replaces it.

What we don't store

• Your password or secret words.
• Your name or date of birth. Email and mobile accounts never ask for them, and the name, date of birth and secret words way in keeps them on your device.
• What you do on the sites you sign in to.
• Advertising profiles or tracking identifiers.

For the full legal detail, read the Privacy Policy.