What NearAuth.ai Knows About You (and What It Doesn't)
Any tool that checks on you all day should be able to say exactly what it collects. This page is that list, in plain English. The legal version is our Privacy Policy.
The one question we ask
Most "continuous" security tools learn more about you than they need to: screen recordings, keystroke patterns, location history. We think that's the wrong trade. Knowing that two devices you own are a few feet apart is enough to decide whether to keep you signed in, and it says nothing about what you're working on or where you are. (We wrote more about this in Presence Without Surveillance.)
What our apps send, and why
| What | Why we need it | How long we keep it |
|---|---|---|
| Proximity check results: the time, and whether your phone and computer were near each other | This is the sign-in decision itself. | 90 days |
| Bluetooth signal strength between your paired phone and computer | To tell "next to the computer" from "across the building." | 90 days |
| Device details: random device IDs, device name, operating system, app version, public keys, push notification tokens | To recognize your devices, check their signatures, and send sign-in requests. | Until the device is removed |
| Network details: IP address, an approximate location derived from it, and the Wi-Fi network name | To spot sign-ins that don't fit, such as a new network or an impossible jump between cities. | 90 days |
| Account details: name, work email, company, role, and group memberships from Google Workspace or Microsoft Entra ID | To know who you are and which rules apply to you. | Until your account is removed |
| Phone number | Only if your company turns on text-message codes. | Until removed |
What we never receive
- Passwords. You keep signing in to Google or Microsoft as usual. Your password never touches us.
- Biometrics. Face ID, Touch ID and fingerprint checks happen inside your phone. Your phone tells us only "passed."
- Private keys. Each phone and computer keeps its key in its own secure hardware (the iPhone's Secure Enclave, Android's hardware keystore). It never leaves the device.
- What you do. No keystrokes, screenshots, screen contents, window titles, files, emails or messages.
- GPS location. Android requires location permission to scan for Bluetooth devices and read the Wi-Fi name. We use it for that, and we don't read your GPS position.
Who can see it
- You. You can see your own sign-in history.
- Your company's NearAuth.ai administrators. They see when each computer was signed in, when access ended, and from which network. That's the security record they use to investigate a problem.
- NearAuth.ai staff. Only named staff, signed in with two-factor authentication, can reach production systems.
- Nobody else. We don't sell personal information or use it for advertising. The companies that help us run the service are listed on our subprocessors page.
Where it's stored and how it's protected
- Service data is stored in Google Cloud in the United States (us-central1, Iowa). Account emails are sent through Mailjet in the European Union.
- All connections use TLS, and data is encrypted at rest. Private keys we hold are encrypted a second time under a key protected by Google Cloud KMS.
- Every request from our apps is signed by the device's hardware key, so a copied request from another machine is refused.
What this means in practice, honestly
Because we record IP addresses and Wi-Fi names, an administrator could tell roughly which network or city a sign-in came from. Location from an IP address is usually city-level and often wrong, and we never collect GPS. Administrators can also see when you stepped away, because "access ended when the phone left" is exactly the event that matters in an investigation. We think that's the right amount of information for a security tool, and we'd rather tell you up front than have you find out later.
Your choices
- Your administrator can remove your devices and account at any time.
- You can ask us to delete your NearAuth.ai data at secure.nearauth.ai/deleteMyData.
- Questions? Email privacy@nearauth.ai. We answer within 30 days.
Common questions
Does NearAuth.ai track my location?
No GPS. We record your devices' IP address, an approximate location derived from it, and the Wi-Fi network name,
for security decisions only.
Can it see what I type or what's on my screen?
No. It only learns whether your registered phone is next to your registered computer.
Does it collect my fingerprint or Face ID?
No. That check happens inside your phone, which tells us only that it passed.
Can my employer see when I leave my desk?
Your administrators can see when your computer was signed in and when access ended. They can't see what you
were doing. You can see your own history too.
See also: Privacy Policy • Subprocessors