Guide
Privacy policy for Auth0 apps
What a privacy policy should say when your app uses Auth0, based on how that service shows up in a browser scan.
What Auth0 does on a live site
Auth0 is in the auth and database category. On sites we scan, it shows up through auth0.com. Its role is to authenticate users through an Auth0 tenant.
Data that may be processed: Login identifiers, session cookies, and profile fields requested from the identity provider. The vendor describes the location as: The Auth0 tenant region you select. Their public privacy or data-processing terms are at https://www.okta.com/privacy-policy/.
A privacy policy for a Auth0 app should name Auth0 directly and say what your own product sends to it. A phrase like "third-party tools" is not enough once this service is on the page.
Auth0's SPA SDK is served from a tenant on auth0.com. Name Auth0 (Okta) as the login provider and list the profile fields you request from any social connection.
What you still have to type
The scan cannot know your company name, the country you operate from, or the support email you want on the page. Those go in a short form after the scan. The legal clauses around them are fixed template text, marked as a draft until a lawyer reviews them.
TermsPack generates templates from what we detect on your site. This is not legal advice and does not create an attorney–client relationship. Have a lawyer review documents for your situation.