Privacy Policy

Last updated: August 31, 2026

MyWBS.com is being built. Today the site is a landing page and a Google sign-in, and nothing else. This page explains, plainly, what that collects and what happens to it.

What Google sends us

Signing in asks Google for exactly three permissions (openid, email, profile). From those, Google gives us:

your permanent Google account ID, which we use as the stable anchor for your account;
your email address, and whether Google has verified it;
your display name;
the URL of your profile photo — we store the link, not a copy of the image.

We never see or store your Google password.

What we store

Your account record: Google account ID, email address, email-verified flag, display name, profile photo URL, sign-in provider, role, permission level, account status, when the account was created, and when it last signed in.
Your sessions: the SHA-256 hash of each session token — never the token itself — plus when the session was created, when it expires, when it was last seen, the browser identifier, and the IP address.
A sign-in audit log: the event type (sign-in succeeded, sign-in denied, sign-out, session expired, admin action, account deleted), the email address, a short detail string, the IP address, the browser identifier, and a timestamp. It exists to protect accounts and investigate abuse.
A per-account settings store (simple key and value pairs). It is empty and unused, because the site has no settings yet.

Cookies

All of them are first-party. There are no advertising or analytics cookies and no third-party trackers on this site.

wbs_session keeps you signed in, for up to 90 days. It is Secure, HttpOnly and SameSite=Lax, and holds a random token; the server keeps only that token's SHA-256 hash, so a copy of the database cannot be replayed as a login.
wbs_oauth_state and wbs_oauth_next last 10 minutes and are scoped to /auth/. They protect the sign-in handshake against cross-site request forgery, and are deleted afterwards.

Server logs

The web server writes ordinary operational logs: access logs (IP address, timestamp, requested URL, response status, referring page, browser identifier) and error logs, which record the details of failed sign-ins.

Who can see it

We do not sell, rent, or share your personal information.
The only third party involved is Google, and only for the sign-in itself, under Google's privacy policy.
We would disclose information only if legally required to.

Why sign-in is through Google

We use Google sign-in so that MyWBS.com never stores a password for you. Authentication happens on Google's side, protected by your own Google account security — including any two-factor protection you have enabled.

Age requirement

MyWBS.com is for adults: you must be 18 or older to use it. Google does not tell us your age or date of birth, so the requirement rests on your own confirmation when you sign in. We do not knowingly collect information from anyone under 18; if we learn an account belongs to someone under 18, we delete it.

Your controls

Everything is on your account page.

Sign out at any time.
Delete your account. This permanently removes your account record; your sessions and settings go with it automatically, and your rows in the sign-in audit log are purged, leaving a single anonymised marker that records only that an account was deleted — no email address, no account ID. It cannot be undone. You are welcome to sign in again later, which simply creates a fresh account.
Expired sessions are purged automatically.

This policy will change

MyWBS.com is still in development, and this page describes only what the site does today. We will update it as the site gains features.

Questions about this policy? Contact the site owner. See also the Terms of Service.