Privacy policy
Last updated 10 November 2026
Gate.haus keeps your identity in one place, so we take looking after it seriously. This explains what we collect, why, who sees it, and the choices you have.
1. Who we are
Gate.haus is run by DACCAA Ltd, a company registered in England and Wales (company number 14639674), 11 Othello Close, Stafford, ST17 9ZN, England. DACCAA Ltd is the controller of the personal data described here, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This policy covers the Gate.haus website and dashboard at gate.haus and the sign-in service at api.gate.haus. Apps you sign in to with Gate.haus have their own privacy policies for what they do with your details.
2. What we collect
Information you give us
- Account details: first name, surname, username, email addresses (your primary address and any others you add), country, and a profile picture if you upload one.
- Sign-in methods: your password (stored only as a one-way hash), passkey public keys, your authenticator app secret (encrypted), and backup codes (stored only as hashes).
- Mobile number, if you choose to add and verify one.
- Support messages you send us.
Information created when you use Gate.haus
- Connected apps: which apps you have allowed, the permissions you approved, and when they last used your account.
- Sign-in and security activity: when you sign in and how, your IP address, browser details, an approximate location worked out from your IP address, and changes to your security settings.
- Remembered browsers: if you choose "Stay signed in", the browser description and IP address of that device.
- Notifications that connected apps send you through Gate.haus, and whether you have read them.
- Device tokens for push notifications, if you use a Gate.haus app on an Apple device.
- Error and usage diagnostics from the dashboard (see section 4).
Information from sign-in providers
If you sign in with or link Google, Apple, Facebook or Steam, we receive your account ID with that provider and, where the provider shares them, your name, email address and whether that email is verified. Steam does not share an email address. We never receive your password for those services.
3. How we use it, and why we are allowed to
| What we do | Lawful basis |
|---|---|
| Create and run your account, sign you in, and sign you in to apps you choose | Contract |
| Share the details you approve with each connected app | Contract, at your request |
| Verify email addresses and send codes, password resets and account emails | Contract |
| Protect accounts: bot checks, rate limits, sign-in alerts, detecting suspicious activity | Legitimate interests in keeping accounts and the service secure |
| Find and fix faults in the dashboard | Legitimate interests in running a reliable service |
| Answer support messages | Legitimate interests, or contract where it concerns your account |
| Keep records the law requires, and respond to lawful requests | Legal obligation |
5. International transfers
Some providers above process data outside the UK. Where they do, we rely on UK adequacy regulations (for example for the EU, and for US companies certified under the UK extension to the EU-US Data Privacy Framework) or on the UK International Data Transfer Agreement or Addendum, so that your data stays protected to UK standards.
6. How long we keep it
- Your account and its details: for as long as your account is open. When you ask us to close it, we delete or anonymise your personal data within 30 days, except where we must keep something by law.
- Email verification codes: 10 minutes. Password reset links: 1 hour. Email confirmation links: 24 hours.
- Remembered browsers: up to 30 days, or until you sign them out.
- Connected app access: until you remove the app or close your account.
- Notifications: until you delete them or close your account.
- Server logs (including IP addresses): normally no more than 30 days, unless needed to investigate a security incident.
- Support messages: up to 2 years after we resolve them.
7. How we protect it
Passwords and backup codes are stored only as one-way hashes. Authenticator secrets are encrypted. Access tokens are stored as hashes, connections are encrypted with HTTPS, and sign-in is protected by rate limits and bot checks. You can add passkeys and two-step verification, or switch off password sign-in entirely. No system is perfectly secure; if a breach affects you, we will tell you and the regulator where the law requires it.
9. Your rights
Under UK data protection law you can ask us to:
- give you a copy of your personal data;
- correct anything that is wrong (you can edit most details yourself in the dashboard);
- delete your data, or close your account;
- restrict or object to how we use it, including anything we do on the basis of legitimate interests;
- give you your data in a portable format.
You can also remove any app's access and change your sign-in methods yourself at any time. We will respond to requests within one month. If you are unhappy with how we handle your data, please contact us first; you can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
10. Children
Gate.haus is not for children under 13, and we do not knowingly create accounts for them. If you think a child under 13 has an account, please contact us and we will delete it.
11. Changes to this policy
We will update this policy when what we do with data changes. If a change is significant, we will email you before it takes effect. The date at the top shows when it last changed. Our terms and conditions explain the rest of our agreement with you.
12. Contact us
For anything about your data, use the support page in your Gate.haus dashboard, or write to DACCAA Ltd, 11 Othello Close, Stafford, ST17 9ZN, England.