AIHERD

AIHerd authentication privacy policy

Updated 11 October 2026. This page covers auth.aiherd.dev, operated by Elazar Leibovich for AIHerd.

Sign-in is optional

You can use the AIHerd companion app without signing in, through SSH, Tailscale or an existing paired connection. Signing in is an optional way to discover herds belonging to your account. A herd connecting to a public AIHerd relay requires its own authorization; a phone does not need an AIHerd account to use an approved pairing link.

Information used for sign-in

If you choose GitHub, Google or Apple sign-in, we retain your email address, an opaque AIHerd account ID, your provider account identifier and available display name while your account exists. Email addresses do not merge accounts or authorize terminal access. We use this information only to identify your account, show it to you and discover your herds. We do not receive your provider password or request access to repositories, mail, contacts or files. Sign-in does not upload terminal sessions or project files to the authentication service.

Google requests openid, profile and email; Apple requests email; GitHub requests user:email. We do not retain Google or GitHub access tokens. An Apple refresh token is stored encrypted solely so we can revoke Sign in with Apple authorization when you delete your account.

Account deletion and retention

After signing in, choose Account → Delete account in the app, or Delete account on account management. After confirmation, we delete your email, account ID, profile, provider links, enrollments, refresh records, browser sessions and saved account herd entries from the active authentication service. All account credentials are revoked. We retain only unlinked random credential IDs to reject previously issued credentials; these records contain no email, account ID or provider identity. Restricted-access deployment backups expire after 30 days. Service and hosting-provider operational logs follow their separate retention policies.

Deleting your account does not delete files on your computers or existing paired-device credentials. You can continue using the app without signing in. Signing out revokes only the current enrollment and does not delete the account. Signing in after account deletion creates a new account.

Sessions and security

A secure browser cookie correlates sign-in and account-management steps and expires after fifteen minutes. Pending sign-in requests expire after ten minutes. Enrollments and key-bound credentials remain until revoked or deleted, or until a configured renewal deadline. Short-lived records prevent replay. Your device stores its credentials and proof key locally.

Service providers

Cloudflare delivers HTTPS and processes network metadata. Client IP addresses are used temporarily for rate limiting. Your chosen identity provider handles its own sign-in under its own policies: Cloudflare, GitHub, Google, and Apple. We do not use account information for advertising or model training, and do not sell it.

Contact

For privacy questions or assistance, contact [email protected].