Privacy Policy
Effective October 23, 2026
Delegate is a common sign-in service. Websites that use Delegate (we call each one a domain) send you here to sign in, and Delegate tells the domain who you are and shares only the details you agree to share. Delegate is operated by Engine9, Inc. (“engine9,” “we,” “us”). This policy covers Delegate at delegate.network. It does not cover the domains you sign in to; each domain's own privacy policy governs what it does with the information it receives.
Information we collect
When you sign in
You sign in with Google, with Facebook where a domain offers it, or with a link we email to you. We use Google Firebase Authentication for this. We receive your email address, whether the provider confirmed it, which provider you used, when you signed in, whether you used two-step verification, and a user identifier from Firebase. We never see your Google or Facebook password. Google or Facebook may give Firebase other profile details, such as your name and photo; Delegate does not store them unless you enter them yourself.
Details you choose to add
You may add your name, more email addresses, a phone number, and other details you want to share with domains. You can see and change them on your Delegate page.
Your permissions for domains
When you allow a domain to receive your details, we record which domain, which details it asked for, which you agreed to share, which email address you chose for it, the identity level, and when the permission was given, last used, and revoked. We also keep a short record of identity events (the domain, the identity level, and the time).
Identifiers and cookies
Delegate sets only the cookies it needs to work. We do not use advertising or analytics cookies.
| Cookie | Purpose | Lasts |
|---|---|---|
unid | A random identifier for your browser, so Delegate recognizes it and links it to your sign-in. | 2 years |
dsession | Keeps you signed in to Delegate. | 24 hours |
unid_merged | Remembers your browser's earlier identifier after you sign in, so domains can link your visits from before you signed in. | 90 days |
The sign-in page also keeps short-lived notes in your browser's local storage (to return you to the right page or finish linking a Facebook sign-in, for at most an hour), and Firebase keeps your sign-in state there.
Security and technical records
- When Delegate first creates an identifier for a browser, we record the IP address, approximate location (country and city), browser and device type, language, referring page, and network details provided by Cloudflare.
- Our hosting provider, Cloudflare, logs each request (time, address requested without its query string, response, IP-derived network details) for 7 days.
- When we refuse a request, such as one from an unregistered domain, we record the IP address, browser, network details, and the domain requested.
- To limit abuse of sign-in emails, we count requests per email address (stored as a one-way hash) and per IP address for one hour.
How we use information
- To sign you in and keep you signed in.
- To give each domain the details you agreed to share with it.
- To send sign-in emails you ask for.
- To protect Delegate, the domains that use it, and you: to detect and stop fraud, abuse, and attacks.
- To comply with the law.
We do not sell your personal information, share it for targeted advertising, or use it to build advertising profiles.
If you are in the European Economic Area or the United Kingdom, our legal bases are: performing our agreement with you (signing you in), your consent (sharing details with a domain), our legitimate interests in keeping Delegate secure, and legal obligations.
What domains receive
When you sign in to a domain, Delegate sends it a signed Identity Token. It contains an identifier made just for that domain, your identity level, and only the details you agreed to share. Each domain gets a different identifier, so domains cannot use Delegate's identifiers to match you across domains. You can revoke a domain's permission on your Delegate page. Revoking stops future sharing; it does not remove what a domain already received. Ask the domain to delete that.
Service providers and other disclosures
We use these companies to run Delegate. They process information for us under their terms and only to provide their services:
- Cloudflare, Inc.: hosting, databases, storage, email delivery, and logs.
- Google LLC: Firebase Authentication and Sign in with Google.
- Meta Platforms, Inc.: Facebook Login, only if you choose it.
We may also disclose information if the law requires it, to protect the rights, safety, or property of you, others, or engine9, or as part of a merger, acquisition, or sale of assets, in which case this policy continues to apply to it.
How long we keep information
- Your details, email addresses, and domain permissions: until you remove them or ask us to delete your Delegate data.
- Sign-in sessions: 24 hours. Cookies: as listed above.
- Request logs: 7 days. Sign-in email counters: 1 hour.
- Identifier-creation and refused-request records: as long as we need them to investigate abuse and secure Delegate, and then deleted.
Your choices and rights
On your Delegate page you can see and change your details and email addresses, and see and revoke each domain's permission. To get a copy of your data, or to delete it, email privacy@delegate.network. We will verify the request comes from you and answer within 30 days.
Depending on where you live, including the EEA, the UK, and US states such as California, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict how we use it, and to withdraw consent. We will not treat you differently for using these rights. If we decline a request, you may appeal by replying to our answer. You may also complain to your local data protection authority.
Children
Delegate is not for children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has used Delegate, contact privacy@delegate.network and we will delete it.
International transfers
engine9 is based in the United States, and Cloudflare serves Delegate from data centers around the world. Your information may be processed outside your country, with safeguards such as standard contractual clauses where the law requires them.
Security
We use encryption in transit, signed tokens, and limited access to protect your information. No service is perfectly secure; tell us at privacy@delegate.network if you think your information was exposed.
Changes
When we change this policy we will update the date above. If a change is significant, we will tell you on Delegate's sign-in pages before it takes effect.
Contact
Engine9, Inc.
28 Taylor Hill Ln, Bluemont, VA 20135, USA
privacy@delegate.network