Privacy policy

Who we are

Legal.id is an identity service operated by Lextronica, Inc. ("we"). It lets you hold a Legal.id handle and sign in to other applications ("relying parties") using OpenID Connect.

What we collect

• Your email address, and whether you've verified it.
• A handle you choose, and an optional display ("holder") name.
• Authentication credentials: a password hash (never the password), and/or passkey public keys, and/or a Google account identifier if you link one.
• A per-account decentralized identifier (DID) and its key material.
• Security logs: sign-ins, consents, token grants and revocations, verification changes — with IP address and browser user-agent, for account safety.

What we do NOT collect

We do not store passwords in the clear. For the Verified tier we record only the fact and date of an I-9 employment-eligibility check and who attested it — never your identity documents, document numbers, or Social Security number.

What relying parties receive

When you sign in to an app with Legal.id, that app receives only the claims within the scopes you approve: your subject identifier (an opaque UUID), and — with your consent — your name, handle, assurance tier, DID, email and its verification status. Apps never receive your password, your passkeys, or your Google tokens. You can review and revoke any connected app from your dashboard.

Retention

We keep account data while your account exists. Security log entries are retained for up to 24 months. If you delete your account we remove your profile and credentials; minimal records required for legal or fraud-prevention purposes may be retained as required by law.

Your choices

You can enable privacy mode to hide your name from your card and the public verify page, revoke connected apps and other sessions, and request account deletion by contacting us.

Contact

Privacy questions: privacy@legal.id · Lextronica, Inc.