Privacy & Cookies

The short version

EggInc.tools is the front door to a suite of Egg, Inc. fan tools, and one sign-in works across all of them. This covers the hub and the shared identity service behind that sign-in. Only the identity data needed to recognise you and apply your role or perks is stored. There is no advertising, no third-party tracking, and no analytics, and payment data is never handled here. Each tool has its own privacy policy covering the data that tool stores.

What the hub stores

Nothing about you. The hub keeps no account records, no analytics, and no per-visitor logs beyond the transient request logs any web server writes.

Signing in

Sign-in runs through the shared identity service at id.egginc.tools. It sits between you, an OAuth provider you choose (Discord, Google, Microsoft, or GitHub) via a self-hosted Authentik instance at auth.egginc.tools, and the tool you are signing into. Your password is never seen or stored here; the provider and Authentik handle it entirely.

What the identity service stores

When you log in, a single account record is created or updated holding:

• An internal account id.
• Your Discord user id, username, and avatar, if you have linked Discord.
• The role assigned to your account (for example viewer, contributor, or admin) on whichever tool you are using.
• When the account was created and when you last logged in.

If you link more than one provider to the same account, each linked provider's id and the username and avatar it reports are stored too, so you are recognised on any of them. Linking anything beyond the first provider you log in with is optional. A custom avatar uploaded through your profile (up to 2 MB, PNG/JPEG/WebP) is stored keyed to your account id and served back by the identity service.

Single sign-on cookie

Logging in to any tool in the suite sets one shared session cookie, scoped to the parent egginc.tools domain, so you do not have to log in again on the others. That cookie is also how the header can show your name instead of a sign-in link. It holds a signed token containing your account id, role, and a session id; it does not carry your password or provider tokens. The Sign out link in the header clears it everywhere, and the session id is revoked server-side so a copy of an old cookie cannot be reused. If you revoke access from the OAuth provider's own settings, the provider notifies Authentik directly and your session on every tool ends the same way.

Cookies and local storage

The hub sets no cookies of its own, and only strictly-necessary storage is used across the suite. There are no advertising or tracking cookies, so there is no consent banner to click through.

• eggidentity_session. The shared sign-in cookie described above. HttpOnly, scoped to egginc.tools, removed on logout or expiry.
• eggidentity_idhint. A short-lived, HttpOnly cookie used only to support clean logout and account re-linking with the OAuth provider. Not used to identify you anywhere else.
• Antiforgery token cookie. Present on admin pages only, protects form submissions against cross-site request forgery. Does not identify you.

Supporter sync (GitHub Sponsors)

If you link a GitHub account and sponsor the operator through GitHub Sponsors, your sponsorship status is checked against the GitHub API, or received instantly through a signed GitHub webhook, and whether you are currently a sponsor is stored along with when that was last checked. This grants a Discord role and the related supporter perks in the tools. No payment details are ever seen here; GitHub Sponsors handles all billing.

What the hub asks other services

To show the version each tool is running, the server asks the shared deploy agent on a timer. Those requests come from the server, not from your browser, and carry nothing about you.

Data retention

Account data is kept while your account is active. Expired or revoked sessions are cleared automatically. Deleting your account removes your linked identities and any stored avatar along with it.

Removing your data

To remove the data stored about you:

• Revoke access from your Discord, Google, Microsoft, or GitHub account's authorized-apps settings to cut the connection at the provider.
• Clear cookies for egginc.tools sites to remove the local session.
• Contact the operator through the GitHub organization or the project Discord server to request deletion of your stored account record.

Changes and contact

This policy may change as the suite changes. The date at the top is the last revision. The hosted instance is run by an individual, David Cole, not a company. Source is at github.com/EggIncTools. See also the Terms of Service.