PRIVACY
POLICY.

Last updated: February 14, 2026

1. Overview

Shoo is an auth broker for Google sign-in. Shoo collects the minimum data needed to authenticate users and return identity assertions to requesting apps.

2. Information Shoo Collects

  • Google account identifier (sub) after successful sign-in.
  • Optional profile data (email, email_verified, name, picture) only when an app requests it and you approve consent.
  • Client and consent records (requesting app origin, consent grant timestamps).
  • Security/operations data, including short-lived nonces, authorization codes, replay identifiers, rate-limit counters, and request metadata such as IP address for abuse prevention.
  • A signed HTTP-only session cookie (shoo_session) so Shoo can keep you signed in.

3. How Shoo Uses Data

  • Authenticate users with Google and create/maintain Shoo sessions.
  • Issue domain-scoped identity tokens to requesting apps.
  • Enforce security controls (PKCE, replay prevention, rate limiting, and abuse monitoring).
  • Maintain auditability and operational reliability.

4. How Data Is Shared

  • With the requesting app: Shoo shares pairwise_sub and an id_token; optional profile fields are included only when requested and consented.
  • With infrastructure providers needed to run Shoo.
  • Shoo does not sell personal information.

5. Retention

  • Auth codes and state nonces expire quickly and are cleaned up automatically.
  • Replay-protection and rate-limit rows are retained briefly for security windows.
  • User identity/profile and per-app consent records are retained until deleted.

6. Your Controls

  • You can sign out anytime at /me.
  • You can delete your Shoo account data from /me using "Delete My Data".

7. Google API Data

Shoo's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Changes

Shoo may update this Privacy Policy. Updated versions will be posted at this URL with a new effective date.

9. Contact

For privacy requests, contact support@ping.gg or open an issue at github.com/pingdotgg/shoo/issues.