Privacy in this demo
This experimental message board is operated by Mark Moriarty. It is an independent experiment, not an official Stripe sign-in product. It demonstrates Stripe, email and third-party sign-in.
What we store
We store the provider account identifier returned during authorization, an internal account identity, your public display name, comments, and sign-in session records. For email sign-in, we also store your email address to recognize you and send the requested code and link. OAuth profiles use non-deliverable internal aliases; these are not real email addresses. Each sign-in method creates a separate profile. Session records may include an IP address and browser information. The application and database run on Cloudflare.
The demo does not request access to payments, balances or customers. OAuth tokens are used during sign-in and discarded rather than retained in the database. Google sign-in requests an account identifier and email, without requesting your name or photo. The full Google email is used transiently to validate a verified Google Workspace domain, then discarded. We retain only that domain and the verification time in a private evidence record; missing/non-authoritative claims do not create domain evidence. Google remains identified by its subject, not email, and provider accounts are never automatically merged. Stripe sign-in reads the authorized account’s business name and website where available and retains only those account-profile fields. The Stripe account display name (or business profile name) becomes the public merchant name and cannot be edited here. It refreshes when you sign in again. If the name is unavailable, merchant posting is disabled. Account display names can contain a person’s name, including for sole proprietors; the sign-in screen discloses that the account name will be public with comments. Other default public display names are random. Account contact email, human identity and the remaining account response are not retained. The account-profile request is read-only and the website does not change your Stripe account. The shared app requests read-only account-details/settings access; only the permissions shown by Stripe apply to your installation. Email sign-in codes and links expire after two hours and share one redemption. We protect the code with a keyed hash and use a temporary browser cookie to associate it with the request. Expired challenges are removed by scheduled cleanup. Cloudflare sends the email, with activity-log body previews disabled.
What other people can see
Comments, display names and posting times are public. Your Stripe account identifier is not displayed. Avoid posting personal or confidential information. Teammates selecting the same Stripe account share company comment ownership, including deletion. Stripe human names are remembered separately for each browser and Stripe account, using a necessary opaque HttpOnly cookie and server-side preference for up to one year. This does not sign you in or identify you as an individual. Other browsers or teammates have separate preferences. Company names remain Stripe-sourced and non-editable. Stripe comments record that sign-in’s chosen human name. Email/Google comments follow the current chosen human name. Each new comment records its selected affiliation evidence; deleted-comment cleanup also erases these snapshot fields. Email/Google participants may opt in to publish only a verified non-shared email domain, never their full email. Showing or hiding that affiliation updates domain labels on earlier comments. The labels prove account or mailbox access, not employment, domain ownership or the human’s legal identity/admin role. Avatars use the public company website from Stripe or the email domain you chose to disclose. Cloudflare retrieves small website icons and serves them from this site; your browser makes no avatar requests to those websites. Missing or unsafe icons use local initials, and individuals always use initials without new photo permissions. Hiding an email-domain affiliation also stops its avatar from being shown.
Cookies and deletion
Necessary cookies maintain your sign-in session and secure the authorization flow. Sessions expire after one hour. Expired session and rate-limit database records may remain until routine cleanup or a deletion request; expiry prevents their use for access. We do not add advertising cookies or analytics trackers. Signing out ends your demo session; it does not sign you out of your provider or uninstall the Stripe App. Stripe sign-in installs the demo on the selected Stripe account, with no requested payment/customer permissions. Account administrators can manage installed apps in Stripe Dashboard. If that account is configured as the demo moderator, its teammates share moderation rights too.
Deleting a comment removes it from the public board. You have five seconds to undo a deletion. During that window the text stays in the database but is hidden from the public board. After the window closes, request cleanup or a scheduled background task erases the text. Comment metadata remains for posting-limit enforcement, and removal metadata prevents delayed requests from deleting a restored comment. Non-merchant display-name changes are limited to three per day. Stored Stripe business profiles are removed when their authentication account is deleted; orphaned failed-signup projections become eligible for cleanup after one day on subsequent sign-ins. Email-request limits use keyed hashes of the recipient and IP, removed after two days on subsequent requests. A draft can stay in this tab’s session storage so a failed submission does not lose your text; closing the tab clears that browser storage. To request deletion of stored account or comment records, contact m@rkmoriarty.com. Authentication and hosting providers may process operational logs under their own policies.