We collect: username + password (PAM auth), email (OTP verification),
OAuth profile data (name, email from Forgejo/Google).
Data is stored in Redis with automatic expiry. Passwords are bcrypt-hashed.
Sessions last 24h. You can view your data at
/users/me,
export it at
/users/me/export, or delete it at
/users/me (requires re-auth).
Full privacy policy:
/auth/privacy.