One Live ID Privacy Policy

Service: One Live ID (id.live.net.co), including accounts carried over from former Live Store Accounts

1. Who we are

One Live ID ("we", "us", "our") is the account and sign-in service of One Live, established in the European Union. For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and equivalent laws, One Live is the controller of the personal data described in this policy.

This policy covers the One Live ID website at id.live.net.co; account registration, sign-in, two-step verification, passkeys and app passwords; the OAuth 2.0 and OpenID Connect sign-in endpoints that other apps use (including sign-in by code on devices such as consoles and TVs); and the emails we send about your account (together, "the Service").

The One Live services and third-party apps you sign in to with your One Live ID have their own policies, which govern what they do with your data once they receive it (section 6).

Data protection contact: privacy@onelive.me. General support: support@onelive.me. We have not appointed a data protection officer because we are not required to; the privacy address above reaches the people responsible for data protection.

3. Personal data we process

3.1 Account data

Username and email address, and whether the email address has been confirmed.
Password, stored only as a salted, one-way hash. We never store or see your password in readable form.
When your account was created and last updated, and when you last signed in.
Account status (active, locked or restricted) and a security stamp that lets us sign you out everywhere when you change your password or ask us to.
Whether your account holds a One Live staff role (administrator or moderator).

3.2 Sign-in methods you choose to set up

Two-step verification: whether it is on, the secret key shared with your authenticator app, your one-time recovery codes, and, if you choose email codes, the codes we send you.
Passkeys: for each passkey, the credential identifier, its public key and signing algorithm, an identifier of the authenticator model (the "AAGUID", which can reveal the make of the device or password manager, for example a particular security key or phone platform), how it connects (built-in, USB, phone), whether it is synced or backed up, whether you verified yourself when creating it, a usage counter, the name you give it, and when it was created and last used. Your fingerprint, face or device PIN never leaves your device; we do not receive or store any biometric data.
App passwords: the name you give each one, a one-way hash of it, the app it is limited to (if any), and when it was created, last used and revoked. The app password itself is shown to you once and not stored in readable form.

3.3 Sign-in history and security data

Sign-in locations: each IP address you sign in from, with the user agent of the browser or app you used and when that address was first and last seen. We use this to email you when your account is used from a new address, and to ask for your second step again when two-step verification is on and you sign in from a new address.
Failed sign-in counters: the number of failed sign-in attempts from an IP address, kept in memory only, for up to 10 minutes.
Email throttling: how many activation or similar emails were requested for an email address, kept in memory only, for up to one hour.
Network check result: whether an IP address belongs to a proxy, VPN or hosting network, kept in memory only, for up to 12 hours (section 4).
Remembered devices: if you tick "remember this device" at two-step verification, a cookie on that browser (section 12).

3.4 Apps you connect

For each app you have signed in to: which app, when you first authorized it, the permissions ("scopes") you granted, and the sign-in codes and tokens issued to it (including refresh tokens that let an app stay signed in for up to 30 days at a time, and one-time codes for signing in on another device).
If you are a developer and register an app through the One Live Developer Centre, we store your account identifier as the app's owner, together with the app's name, description, logo address, redirect addresses, the permissions it may request, and the public support email address you provide. Your support email address and developer name are shown to users on the authorization screen.

3.5 Moderation data

Restrictions (bans): the reason, whether it covers all One Live services or only some (and which), when it starts and ends, which staff member issued or lifted it, and the reason for lifting it.
Appeals: what you tell us in an appeal (what happened, why you think the decision was wrong and your response to the stated reason), when you submitted it, its outcome, the staff member who reviewed it and their note.

3.6 Communications

The service emails we send you: account activation, password reset, two-step verification codes, alerts about a new sign-in location, a changed password, a changed email address (sent to both the old and the new address), a new passkey, a new app password or a newly authorized app, and notices about restrictions and appeals. These are necessary to run and secure your account; we do not send marketing emails from One Live ID.
Your correspondence with our support and privacy teams.

3.7 Technical and diagnostic data

Server logs: your IP address, the page or endpoint requested, timestamps, and security events such as failed or refused sign-ins, which may include the username entered.
Error reports and performance traces: when something goes wrong, or to measure how fast the Service responds, we record diagnostic information about the request. Log entries sent with these reports can include your username, email address or IP address where they appear in the entry (for example "password reset email sent to …").

3.8 What we do not collect

We do not collect your real name, date of birth, gender, phone number, postal address, payment details, precise location, contacts or biometric data. We do not knowingly process special categories of personal data (such as health, religion or political opinions). We do not run analytics, advertising or social-media tracking on the Service.

5. Why we process your data and our lawful bases

Purpose	Data used	Lawful basis (GDPR Article 6)
Creating your account, confirming your email address, signing you in and letting you manage your account	Account data, sign-in methods, communications	Performance of a contract (Art. 6(1)(b))
Signing you in to One Live services and to the apps you choose, and sharing the data those apps need (section 6)	Account identifier, username, email address, roles, app authorizations and tokens	Performance of a contract (Art. 6(1)(b)), at your request
Two-step verification, passkeys and app passwords	Sign-in methods	Performance of a contract (Art. 6(1)(b)); you choose to turn them on
Protecting your account: security alert emails, sign-in history, asking for your second step from new locations, limiting repeated failed sign-ins	Sign-in history and security data, communications	Legitimate interests (Art. 6(1)(f)) in keeping accounts secure, and our duty to secure personal data (Art. 32)
Preventing automated, fraudulent and abusive registrations (section 4)	IP address, network check result	Legitimate interests (Art. 6(1)(f)) in preventing fraud and abuse
Enforcing our Terms: restricting accounts, handling appeals	Moderation data, account data	Legitimate interests (Art. 6(1)(f)) in a safe service for everyone; performance of a contract (Art. 6(1)(b))
Registering and running apps on the Developer Centre	Developer app data	Performance of a contract (Art. 6(1)(b))
Finding and fixing errors, keeping the Service reliable	Technical and diagnostic data	Legitimate interests (Art. 6(1)(f)) in a working service
Answering your support and privacy requests	Communications, account data	Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for data protection requests
Complying with the law, responding to lawful requests, and establishing, exercising or defending legal claims	Any relevant data	Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f))
Remembering the language you picked	Language cookie	At your request; strictly necessary for the function you asked for

Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms and limited the data to what the purpose needs. You may object to that processing (section 11).

Providing a username, an email address and a password (or other sign-in method) is necessary to create a One Live ID; without them we cannot provide the Service. Everything else in section 3.2 is optional.

6. Who your data is shared with

6.1 One Live services you sign in to

When you sign in to a One Live service (for example One Live Network, One Live Profile, Live Store or One Live's games), One Live ID sends that service your account identifier, username, email address and any staff role. Because these services are part of your One Live account, you are not shown a separate authorization screen for them; the first time you sign in to each one, we email you to say so. Each service's own policy explains how it uses that data.

6.2 Third-party apps

Developers outside One Live can build apps that use "Sign in with One Live ID". Before such an app receives anything, we show you an authorization screen that names the app and its developer, lists what it is asking for, and gives the developer's contact address. The app receives only what you approve:

Sign-in only: an identifier for your account.
Profile: your username.
Email: your email address.
Roles: whether your account holds a One Live staff role.
Stay connected: continued access after you close the app, until you withdraw it.
Read your One Live Profile or email: permission for the app to ask the One Live Profile service for the details described on the authorization screen, under that service's policy.

Once an app receives your data, its developer is an independent controller: its own terms and privacy policy govern what it does with the data, and we are not responsible for them. You can withdraw an app's access at any time on the Sessions page. The app then loses access to your One Live ID, but it may keep the data it already received under its own policy.

6.3 Service providers (processors)

We use the following providers to run the Service. They process personal data only on our instructions, under data-processing terms:

Hosting and infrastructure providers that run our servers and database in the European Union.
Cloudflare, Inc.: the network edge in front of id.live.net.co and our asset server (assets-id.live.net.co). All requests, and therefore your IP address and browser details, pass through Cloudflare's network, which also protects the Service against attacks.
Zoho Corporation B.V. (ZeptoMail, EU data centre): delivers our service emails. It receives your email address, username and the content of the email.
Microsoft Ireland Operations Ltd. (Microsoft 365): a back-up route for service emails when our main provider is unavailable. It receives the same data.
Functional Software, Inc. (Sentry, EU data region): error reports and performance traces (section 3.7).
ip-api.com: the network lookup at registration (section 4). It receives your IP address only.

6.4 Content delivery networks loaded by your browser

Pages of the Service load standard open-source scripts from the public jsDelivr and cdnjs (operated by Cloudflare) content delivery networks. When your browser loads them, those networks receive your IP address and browser details as part of the request. We do not send them any account data.

6.5 One Live staff

Authorized One Live administrators and moderators can look up accounts by username or email address, see restriction history, and review appeals, only as far as needed to run and protect the Service.

6.6 Authorities and legal successors

We may disclose data where the law requires it, to respond to a valid legal request, to protect the rights, property or safety of our users, the public or One Live, or to a successor in a merger, acquisition or transfer of the Service (you will be told before your data becomes subject to a different policy).

We do not sell your personal data, and we do not share it for advertising.

8. How we protect your data

Encryption in transit (HTTPS) between your browser or app and the Service, and encrypted connections to our email providers.
Passwords and app passwords stored only as salted one-way hashes; passkeys stored as public keys only.
Email confirmation before an account can be used, optional two-step verification and passkeys, alerts when your account is used from a new place, and limits on repeated failed sign-ins.
Sign-in tokens are digitally signed and short-lived; refresh tokens expire after 30 days.
Access to production systems and to staff tools is limited to the people who run the Service.

No system is completely secure and we cannot guarantee absolute security. Please use a strong, unique password, and turn on two-step verification or a passkey.

If something goes wrong: if a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and we will tell you directly where the risk is high, as the GDPR requires.

9. How long we keep your data

Data	How long
Account data, sign-in methods and sign-in history	While your account exists. Passkeys and app passwords can be removed or revoked sooner by you; a revoked app password stays on record, unusable, until your account is deleted.
App authorizations and their tokens	Until you withdraw the app's access or delete your account. Refresh tokens stop working 30 days after they are issued.
Restrictions and appeals	While your account exists, so that repeated behaviour can be recognised and appeals handled.
Failed sign-in counters, email throttling, network check results	In memory only: 10 minutes, one hour and 12 hours respectively.
Server logs, error reports and performance traces	Up to 90 days.
Service emails	We do not keep copies. Our email providers keep delivery records for a limited period under their own terms.
Support and privacy correspondence	For as long as needed to resolve the matter, and up to 24 months afterwards, so that we can show how a request was handled.

When you delete your account, your account data, sign-in methods, sign-in history, restrictions and appeals are deleted from our live database straight away, and records of the apps you authorized and their tokens are deleted within 30 days. Copies in backups, if any, are overwritten on a rolling basis within 90 days, and logs expire as shown above. We keep data for longer only where the law requires it or where it is needed to establish, exercise or defend legal claims. Deleting your One Live ID does not delete the data held by the One Live services or third-party apps you used it with; see their own policies.

11. Your rights

Under the GDPR you have the right to:

Access the personal data we hold about you and receive a copy.
Rectification of inaccurate or incomplete data. You can change your username, email address and password yourself in ID Settings.
Erasure ("right to be forgotten"). You can delete your account yourself from the Delete Account tab in ID Settings, or ask us to do it.
Restriction of processing in certain circumstances.
Data portability: to receive the data you gave us in a structured, commonly used, machine-readable format. Contact us for an export.
Object to processing based on our legitimate interests (section 5).
Withdraw an app's access to your account at any time on the Sessions page, and sign out of every browser at once from the same page.
Not be subject to automated decisions with legal or similarly significant effects (section 10).
Lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement. A list of authorities is at edpb.europa.eu. We would appreciate the chance to deal with your concern first.

To exercise these rights, write to privacy@onelive.me, ideally with the subject "One Live ID Privacy Rights Request". We will respond within one month, as the GDPR requires (extendable by two further months for complex or numerous requests, in which case we will tell you why within the first month). To protect your account, we may need to verify that the request comes from you, normally by asking you to write from the email address on your One Live ID. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

12. Cookies and similar technologies

We only use first-party cookies that are strictly necessary for the Service or for a function you asked for, so they do not require consent under the ePrivacy rules. We do not use advertising, analytics or third-party tracking cookies.

Cookie	Purpose	Duration
`.AspNetCore.Identity.Application`	Keeps you signed in	Until you close your browser or sign out
`Identity.TwoFactorUserId`	Remembers who is signing in while you complete two-step verification	A few minutes
`Identity.TwoFactorRememberMe`	Only if you tick "remember this device": skips the second step on that browser	14 days
`OneLiveID.Banned` (restricted accounts only)	Lets a restricted account view the restriction and submit an appeal	Up to 4 hours
`onelive_passkey`	Holds the one-time, encrypted challenge while you add or use a passkey	5 minutes
`.AspNetCore.Antiforgery.*`	Protects forms against cross-site request forgery	Until you close your browser
`onelive_lang`	Only if you pick a language: remembers your choice	365 days

Cloudflare may also set a strictly necessary security cookie (such as __cf_bm) to tell people apart from automated traffic.

13. Additional information for certain regions

13.1 United Kingdom and Switzerland

If you live in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply, and you may complain to the Information Commissioner's Office (ico.org.uk). If you live in Switzerland, the Federal Act on Data Protection applies, and you may complain to the Federal Data Protection and Information Commissioner. The rights in section 11 apply to you in the same way.

13.2 United States

If you live in a US state with a consumer privacy law (such as California, Colorado, Connecticut, Virginia or Utah):

Categories collected in the last 12 months: identifiers (username, email address, IP address, account identifier); account login credentials (password hash, two-step verification secrets, passkey public keys); internet or electronic network activity (sign-in history, user agent, logs); and inferences limited to whether your network is a proxy, VPN or hosting network. Sources, purposes and recipients are described in sections 2, 5 and 6; retention in section 9.
We do not sell personal information and do not share it for cross-context behavioural advertising, and have not done so in the last 12 months. We do not process personal information for targeted advertising or for profiling with legal or similarly significant effects.
We use account login credentials (sensitive personal information) only to sign you in and secure your account, not to infer characteristics about you.
You have the right to know, access, correct and delete your personal information, and to appeal our decision on your request by replying to it. You may use an authorized agent, whose authority we may verify. We will not discriminate against you for exercising these rights.

13.3 Other countries

If you live elsewhere, for example in Brazil (LGPD), Canada (PIPEDA) or another country with data protection law, you have the rights that law grants you. Contact us as described in section 11 and we will honour them where they apply.