The short answer
- Used for
- Account creation and sign-in
- Google products
- No access to Gmail, Drive, Contacts, Calendar, Photos, or files
- Password
- Never shared with Leadiy
Fields received and stored
| Field | Why it is used |
|---|---|
| Google subject ID (sub) | Stable identifier for the Google account |
| Verified email | Account address, communication, and admin-role recognition for the designated owner email |
| Display name | Profile identity inside Leadiy |
| Profile-picture URL | Optional avatar in the workspace |
The ID token is verified against Leadiy’s Google Web Client ID using Google’s server-side authentication library. The raw token is not stored in the Leadiy database.
Sign-In button and One Tap
The dedicated sign-in screen can load Google Identity Services when you request authentication. On public pages, proactive Google One Tap loads only after you choose “Accept all” in the cookie controls.
Google may set functional or security values such as g_state or g_csrf_token. Details and controls are listed in the Cookie Policy.
What happens after sign-in
After Google identity is verified, Leadiy creates its own random session token, stores only a SHA-256 hash of that token, and sends the browser an HttpOnly, SameSite=Lax cookie that is Secure in production. A normal session can last up to 30 days and ends earlier when you sign out.
The first successful sign-in starts the two-hour trial for a new user. The designated operator email is recognised as admin through the same Google sign-in flow; users are not asked to choose a role.
Revoking Google access
You can review or remove Leadiy in your Google Account’s connected-app settings. Removing access means a future Google sign-in may require consent again.
Revocation does not automatically delete data already stored by Leadiy, and it may not immediately end an existing Leadiy session. Sign out in Leadiy to end the current session, then request account deletion if you also want stored data removed.
Unlinking and deleting
Because Google is the only current sign-in method, a Google account cannot be unlinked while keeping an independently accessible Leadiy profile. To remove the profile, email oleh.halahan@zanzarra.com or use the contact form from the account email.
Verified account deletion is targeted within two business days, with access-restricted backups rotating out within seven daily cycles.