This policy covers the Codmir administration console, an internal tool used by Codmir staff to operate the platform. It is not a public product and it is not open to general sign-up: access is restricted to an allowlist of administrator addresses, and a sign-in attempt from any other address is rejected before an account is created.
The console collects the minimum needed to sign you in and attribute your actions. When you authenticate with Google we receive your name, email address and profile image, and we store the OAuth tokens Google issues so your session can be maintained. If you sign in with an emailed link instead, we store only your email address and the short-lived token for that link. We do not collect passwords, because the console has none.
Sign-in is handled by Auth.js running inside this application, using Google as the identity provider and, where configured, single-use links sent to your email address that expire after ten minutes. Google authenticates you and tells us who you are; it does not host your account with us.
There is no third-party authentication service holding your account. Your user record, your session and the OAuth tokens described above are stored in Codmir's own database. Codmir is the controller of that data, and requests about it should come to us rather than to any other provider.
Access is granted by email address — either an address on a Codmir-operated domain or one added individually to the administrator allowlist. Signing in with Google does not by itself grant access; an address that is not on the allowlist is refused.
Your information is used to authenticate you, to keep you signed in, and to record which administrator performed an action. It is never sold, rented, or shared with third parties for marketing or commercial purposes.
If you have questions about this policy, or want to access or delete data held about you, contact us at [email protected].
Last updated: 11 September 2026