1. Data we collect
When you create a Msrfteam ID, we collect:
- Your username and display name
- Your recovery email address (for verification and account recovery)
- Your password (stored as an argon2id hash — we never see the plain text)
- IP addresses and device info (for security audit logs)
- Linked Google/GitHub account IDs (if you connect them)
2. How we use your data
- To authenticate you across Msrfteam platforms (OIDC/OAuth2)
- To send verification codes and security alerts
- To detect and prevent abuse (rate limiting, audit logs)
- To provide email service at @msrfteam.cc.cd (Faza 4)
3. Data security
- Passwords: argon2id hashing (never plain text)
- TOTP secrets: AES-256-GCM encrypted at rest
- OIDC tokens: RS256 signed, PKCE enforced
- All connections: HTTPS with HSTS
- Database backups: encrypted, stored off-site
4. Your rights (GDPR)
You have the right to:
- Access — request a copy of your data
- Rectification — correct inaccurate data
- Erasure ("right to be forgotten") — request complete deletion of your account, including all sessions, consents, audit logs, and your @msrfteam.cc.cd mailbox
- Portability — export your data in a machine-readable format
- Object — to specific data processing
To exercise these rights, contact privacy@msrfteam.cc.cd.
5. Data retention
- Sessions: 30 days (refresh token expiry)
- Audit logs: 90 days, then archived
- Email content: stored on disk (Maildir), not in the database
- Deleted accounts: removed within 30 days, including backups
6. Contact
Questions about privacy? Email privacy@msrfteam.cc.cd.