Privacy Policy
Effective September 22, 2026. These terms apply to Valadium Protect, the Cloudflare Worker sign-in service, the mobile app, and related Google Workspace accounts provided by The Scholars Den.
1. Data we handle
Valadium Protect processes what is needed to create and sign in accounts:
- Email address and password (password is sent to Firebase / Google; we do not store raw passwords in the Worker after the request)
- Name and optional profile fields you enter at create time (recovery contacts, phones, job, address, employee ID, birthday note)
- Google Workspace user records in the pandora OU (and related Admin fields)
- Firebase Authentication records in project valadium-protect-account
- App account identifiers (username mapped to an address such as name@valadium.account)
- Device and bind records in Cloudflare KV (which mailbox is attached to which app account)
- Pending login-approval tickets (email, coarse device hash, user-agent, timestamps)
- Standard request logs on Cloudflare (IP, user-agent, URL, time)
2. Why we use it
To authenticate you, create or locate the Workspace user, complete SAML to Google, optionally wait for an app Yes/No, keep kiosk accounts auto-signing, and let administrators run the domain.
3. Who sees it
The Scholars Den administrators. Google (Workspace Directory and SAML). Firebase/Google Cloud for Auth. Cloudflare for hosting the Worker and KV. We do not sell this data. We do not use it for advertising.
4. Cookies and tokens
A session cookie (valadium_session) and a short-lived SAML state cookie are set as HttpOnly Secure cookies. The mobile app stores a session token on the device after username/password sign-in.
5. Retention
Workspace and Firebase users remain until an administrator deletes them. Approval tickets expire (about 15 minutes). Session cookies last up to 12 hours, or longer for kiosk sessions. Cloudflare logs follow Cloudflare's platform retention.
6. Your choices
You cannot generally edit Workspace profile fields from Valadium after create. Ask the domain administrator to correct data, delete an account, or detach an app bind. Protect cannot be bound to an app account.
7. Children
Accounts are issued by The Scholars Den. Use by minors is only under that organization's rules and parental or school authority, not as a public signup product.
8. Contact
Privacy questions go to the Workspace administrator for The Scholars Den. The processing locations are Cloudflare's network, Google Cloud, and Google Workspace.