Privacy

Last updated 2026-10-30. Gully ID (https://gullyid.xyz) is run by Gully Labs. Questions, requests and complaints: [email protected].

What we store

• Passkeys: the public key, the credential id and the device name your browser reports. The private key never leaves your device.
• Your Gully smart account address(es) on Gully Chain, and which passkey or device key controls them.
• Email addresses you add, and whether you verified them. One-time codes are stored only as hashes.
• Sign-in methods you link: wallet addresses (Sign in with Ethereum), Telegram id, username, name and photo link, Farcaster id, and for Google, X or Apple the account id, email, username, display name and avatar link they send us.
• Sessions (when they started and were last used; tokens are stored only as hashes), the apps you signed in to and when, wallet app connections and their spending limits, and the wallet actions you approved.
• A security log of sign-ins and account changes with the IP address they came from. IP addresses are cleared after 90 days.
• If you use the developer console: your OAuth clients and plan. Payments run through Gully Pay; we keep the invoice reference, never card or wallet credentials.

Why

To sign you in, keep your account safe (rate limits, the security log, account recovery), let the apps you choose see the profile you approved, and run your Gully wallet. We do not sell personal data, we do not show ads and Gully ID pages carry no analytics or tracking scripts.

Who else sees it

• Apps you sign in to with Gully ID: only the scopes you approved (for example your account address, email or .gully name).
• Resend sends our emails (your address and the message).
• Cloudflare carries all traffic to Gully ID (it sees IP addresses and request data) and, when switched on, runs the anti-abuse check on the email form.
• Telegram, Google, X, Apple or Farcaster, only when you choose to sign in with them.
• Gully Pay, for developer plan payments.
• Public blockchains: your smart account, its transactions and any .gully name are on Gully Chain, public and permanent. Nobody, including us, can delete on-chain data.

Cookies

Only cookies needed to run sign-in: __Host-gid (your session), __Host-gid_csrf (protects forms) and the __Host-gully_oauth2_* cookies of the sign-in protocol, plus short-lived ones during Google, X or Apple sign-in. They are first-party, strictly necessary and set without a banner. No advertising or analytics cookies.

Your rights: export and delete

• Export: signed in, open /v1/me/export to download everything above about you as JSON.
• Delete: signed in, open /account/delete (apps use POST /v1/me/delete). It removes your emails and every linked sign-in method, ends all sessions, revokes Apple tokens and disables the Gully ID. Your smart account and its passkey records stay, because they control funds on chain: without them the wallet could not be used or recovered.
• You can also ask us by email ([email protected]) to see, correct, export or delete your data, or object to how we use it. We answer within 30 days. You may complain to your data protection authority.

How long

As long as your Gully ID exists. One-time codes and challenges are deleted a day after they expire. Security log IP addresses are cleared after 90 days. Database backups are encrypted and kept up to 30 days, then deleted.

Security

Passkeys instead of passwords, TLS everywhere, secrets kept out of the code, encrypted off-site backups. Report a vulnerability: [email protected].

Children

Gully ID is not for children under 16.

Changes

We post changes here with a new date. Significant changes are announced in the Gully ID app before they apply.