NearAuth.ai Privacy Policy
NearAuth.ai ("NearAuth.ai", "we", "us"), operated by Christopher McLain, makes sign-in software that checks a person's registered phone is next to their registered computer. This policy explains what personal information we handle, why, where it is kept, for how long, and your choices.
1. Two roles
For our customers' users we are a processor. When an organization uses NearAuth.ai for its staff, the organization decides how the service is used and is the controller of that data. We process it only on the organization's instructions. If you use NearAuth.ai through your employer, contact them about your data first; we will help them answer you.
For everyone else we are the controller. That covers visitors to www.nearauth.ai, people who sign up or contact us, and the administrators who manage a customer account.
2. What we collect
| Information | Examples | Source |
|---|---|---|
| Account details | Name, work email address, company name, role (user or administrator), group memberships from your organization's Google Workspace or Microsoft Entra ID | You, your administrator, or your organization's directory |
| Device information | Random device identifiers, device name, operating system and app version, device public keys, push notification tokens | Our phone and computer apps |
| Sign-in and security events | Time and result of sign-ins and proximity checks, IP address, approximate location derived from the IP address, names of the Wi-Fi networks your devices are connected to | Our apps and servers |
| Phone number (optional) | Collected only if your organization turns on text-message codes | You or your administrator |
| Contact and sign-up information | Name, email, company and anything you write to us | You, through our website or email |
| Website usage | Pages visited, browser type, approximate location, cookie identifiers | Google Analytics on www.nearauth.ai |
What we never collect: passwords (you keep signing in to Google or Microsoft as usual); biometric data (Face ID, Touch ID and fingerprint checks happen inside your phone, which only tells us the check passed); device private keys (they never leave your devices); the content of your email, files or applications; or your phone's GPS location.
App permissions. Our apps use Bluetooth to talk to your paired device, notifications to show sign-in requests, the camera to scan setup QR codes, and biometrics through your phone's own security features. On Android, the system requires location permission for Bluetooth scanning and Wi-Fi information; we do not use it to collect GPS location.
3. Why we use it
| Purpose | Legal basis (EU/UK) |
|---|---|
| Providing the service: pairing devices, deciding sign-ins, sending notifications, showing administrators their activity | Performance of a contract; for customer users, our customer's instructions |
| Security: detecting suspicious sign-ins, preventing abuse, investigating incidents | Legitimate interests in keeping the service and our customers secure |
| Account emails: invitations, reminders, service and security notices | Performance of a contract; legitimate interests |
| Answering questions and sales conversations | Legitimate interests |
| Measuring website visits | Consent, where required by law |
| Meeting legal obligations | Legal obligation |
4. Who we share it with
We share personal information only with:
- Our subprocessors, listed with their purpose and location at nearauth.ai/subprocessors: Google Cloud (hosting, database, key management, Android notifications), Apple (iPhone and Mac notifications), Mailjet (email) and Twilio (text messages, only if turned on). We give 30 days' notice before adding or replacing one.
- Your organization and the identity providers and applications it connects to NearAuth.ai.
- Authorities, when required by law. We will tell the affected customer unless the law forbids it.
- A buyer or successor, if NearAuth.ai is merged or sold, under this policy's protections.
We do not sell personal information or share it for targeted advertising.
5. Cookies
The NearAuth.ai service (secure.nearauth.ai) uses only cookies needed to keep you signed in and to recognize the browser you set up. Our marketing website (www.nearauth.ai) uses Google Analytics cookies to count visits. You can block or delete cookies in your browser, and opt out of Google Analytics at tools.google.com/dlpage/gaoptout.
6. Where it is stored
Service data is stored in Google Cloud in the United States (us-central1, Iowa). Mailjet processes email data in the European Union. If you are in the EEA, UK or Switzerland, transfers to the United States are protected by the European Commission's Standard Contractual Clauses and the UK Addendum, which we include in our customer agreements.
7. How long we keep it
- Sign-in and security logs: 90 days, then deleted automatically.
- Account and device information: while the account is active; deleted when an administrator removes the user or device, or when the customer closes its account.
- Database backups: kept for a short period (at least 7 days) and overwritten on a rolling basis.
- Contact and sales emails: as long as needed to answer you and keep business records.
- Website analytics: according to our Google Analytics retention setting.
8. How we protect it
All connections use TLS. Data is encrypted at rest, and the private keys we hold are encrypted a second time under a key protected by Google Cloud KMS. Each phone and computer proves itself with a key held in its own hardware. Only named NearAuth.ai staff with two-factor authentication can reach production. No system is perfectly secure; if a breach affects your personal data, we will notify the affected customer without undue delay and within 72 hours of confirming it.
9. Your rights
Depending on where you live (for example under the GDPR, the UK GDPR, or US state laws such as California's), you may have the right to access, correct, delete or export your personal information, to object to or restrict some processing, and to withdraw consent. We do not discriminate against anyone for using these rights.
- If you use NearAuth.ai through your employer, ask your administrator; they can remove your devices and account at any time, and we will help them with your request.
- You can request deletion of your NearAuth.ai data at secure.nearauth.ai/deleteMyData.
- Otherwise, email privacy@nearauth.ai. We answer within 30 days and may need to confirm your identity.
If you are in the EEA or UK, you may also complain to your local data protection authority.
10. Children
NearAuth.ai is a business service and is not directed to children under 16. We do not knowingly collect their personal information.
11. Changes
We will post changes here and update the date above. For significant changes we will also email customer administrators.
12. Contact
NearAuth.ai (Christopher McLain), 86 Aldrich Ave, Binghamton, NY 13903, USA
privacy@nearauth.ai
See also: Subprocessors