ChengID is the single sign-on service operated by ChengOS ("we", "us"). It holds one account that signs you in to the Cheng family of products. This policy describes exactly what ChengID stores, why, and what you can do about it.

1. What we collect

Account information

• Email address — your sign-in identifier, and the only address we use to reach you about your account.
• Password — stored only as an Argon2id hash. We never store, log, or are able to recover your password itself.
• Username, display name, and avatar URL — the profile you choose, shown to applications you sign in to.

Linked sign-in providers

If you sign in through a third-party provider, we store the provider's name and the account identifier it issues for you, plus any display name, avatar, or email address that provider chooses to return. Providers differ in what they release — some never return an email address at all. We never receive your password at that provider.

Sessions

For each active sign-in we record the browser or application's user-agent string (truncated to 256 characters) and the session's creation and expiry times, so you can recognise your own sessions on the account page. We do not record your IP address.

Application authorizations

When you allow an application to sign you in through ChengID, we record which application it was, the permissions you granted, and when.

Verification and reset tokens

Email-verification and password-reset links are stored only as SHA-256 hashes and expire after a short period. The token in the link itself is never retained in a usable form.

2. Cookies and local storage

ChengID sets exactly one cookie, and it is strictly necessary — you cannot stay signed in without it. We set no analytics, advertising, or tracking cookies, and no third-party cookies.

Name	Purpose	Attributes
chengid_session	Keeps you signed in	Path=/, HttpOnly (unreadable by scripts), SameSite=Lax, Secure in production, Max-Age matching the session lifetime. Cleared immediately when you sign out.

Your browser's local storage additionally holds chengid.lang, which remembers your language choice. It is not a cookie, is never sent to us, and contains no personal information.

Blocking cookies for this site will prevent sign-in from working; nothing else on these pages depends on them.

3. What we share

We do not sell your information and we do not share it for advertising.

• With applications you authorize. After you approve a sign-in request, the application receives a stable identifier for you, your username, and your display name. Your email address is released only when you grant the email permission.
• With sign-in providers you choose. Starting a third-party sign-in sends you to that provider, whose own privacy policy governs what happens there.
• With infrastructure providers. Hosting and email delivery are performed by service providers acting on our instructions.
• Where legally required. We may disclose information when compelled by valid legal process.

4. Your choices

From your account page you can review and change your profile, change your password, see your active sessions and sign out of all other ones, review and revoke applications you have authorized, and unlink a third-party sign-in provider.

To request a copy of your data or the deletion of your account, email [email protected] from your account's address. Deletion removes your account record, linked identities, sessions, and authorizations; it cannot be undone, and applications you signed in to may retain data under their own policies.

5. Retention and security

Account information is kept while your account exists. Sessions, verification tokens, and reset tokens expire on their own and are removed after expiry. Passwords are hashed with Argon2id; tokens are stored as hashes; traffic is served over HTTPS in production. No system is perfectly secure, but we do not store secrets we do not need.

6. Children

ChengID is not directed to children under 13, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will remove it.

7. Where your data is handled

ChengID's servers are located in Los Angeles, California, and your information is processed in the United States. If you use the service from elsewhere, you are transferring your information to the United States.

8. Changes

We may update this policy. The effective date and version above will change, and material changes will be announced on the sign-in page before they take effect.

9. Contact

ChengOS — [email protected]

ChengID 是由 ChengOS（以下称"我们"）运营的统一登录服务，用一个账号登录 Cheng 系列全部产品。本政策说明 ChengID 究竟存储了什么、为什么存储，以及您可以如何处置这些信息。

一、我们收集的信息

账号信息

• 邮箱地址——您的登录标识，也是我们就账号事宜联系您的唯一地址。
• 密码——仅以 Argon2id 哈希形式存储。我们不会存储、记录密码本身，也无法还原它。
• 用户名、显示名称与头像地址——您自行设置的资料，会展示给您登录的应用。

关联的第三方登录

若您通过第三方身份提供商登录，我们会存储该提供商的名称及其为您签发的账号标识，以及该提供商选择返回的显示名称、头像或邮箱。各提供商返回的内容不同，有些完全不返回邮箱地址。我们不会获得您在该提供商处的密码。

会话记录

对每个有效登录，我们会记录浏览器或应用的 User-Agent 字符串（截断至 256 字符）以及会话的创建与过期时间，以便您在账号页面辨认自己的会话。我们不记录您的 IP 地址。

应用授权记录

当您允许某个应用通过 ChengID 登录时，我们会记录该应用、您授予的权限范围以及授权时间。

验证与重置令牌

邮箱验证与密码重置链接仅以 SHA-256 哈希形式存储，并在短时间后失效。链接中的令牌原文不会以可用形式保留。

二、Cookie 与本地存储

ChengID 只设置一个 Cookie，且属于严格必要——没有它就无法保持登录状态。我们不设置任何分析、广告或追踪类 Cookie，也不使用第三方 Cookie。

名称	用途	属性
chengid_session	保持登录状态	Path=/、HttpOnly（脚本不可读取）、SameSite=Lax、生产环境下附加 Secure，Max-Age 与会话有效期一致。退出登录时立即清除。

浏览器本地存储中另有 chengid.lang，用于记住您的语言选择。它不是 Cookie，不会发送给我们，也不含任何个人信息。

若您在浏览器中禁用本站 Cookie，登录将无法完成；除此之外本站页面不依赖 Cookie。

三、我们共享的信息

我们不出售您的信息，也不为广告目的共享信息。

• 共享给您授权的应用。在您同意登录请求后，该应用会获得您的稳定标识、用户名和显示名称。只有当您授予邮箱权限时，才会一并提供邮箱地址。
• 共享给您选择的登录提供商。发起第三方登录会将您跳转至该提供商，其后的处理受该提供商自身的隐私政策约束。
• 共享给基础设施服务商。主机托管与邮件投递由按我们指示行事的服务商完成。
• 法律要求时。在合法法律程序强制要求时，我们可能披露相关信息。

四、您的选择

在账号页面，您可以查看和修改个人资料、修改密码、查看全部有效会话并退出其他所有会话、查看并撤销已授权的应用、解除第三方登录关联。

如需获取您的数据副本或删除账号，请使用账号邮箱发送邮件至 [email protected]。删除操作会移除您的账号记录、关联身份、会话与授权记录，且不可撤销；您曾登录过的应用可能依其自身政策继续保留数据。

五、保留与安全

账号信息在账号存续期间保留。会话、验证令牌与重置令牌会自行过期，并在过期后清除。密码以 Argon2id 哈希保存，令牌以哈希形式保存，生产环境全程使用 HTTPS。没有系统是绝对安全的，但我们不会存储不需要的秘密信息。

六、未成年人

ChengID 不面向 13 周岁以下儿童，我们不会在知情的情况下收集其信息。若您认为有儿童注册了账号，请联系我们，我们将予以删除。

七、数据处理地

ChengID 的服务器位于美国加利福尼亚州洛杉矶，您的信息在美国境内处理。若您在其他国家或地区使用本服务，即表示您将信息传输至美国。

八、政策变更

我们可能更新本政策。届时上方的生效日期与版本号会随之变更，重大变更将在生效前于登录页面公告。

九、联系我们

ChengOS —— [email protected]