Lyrarma ID System Policy

1. Purpose of Lyrarma ID System

Lyrarma ID System is the account system used by Lyrarma Cloud for registration, sign-in and determining assigned user plans. The operator is Svyatoslav Kirillovich Shchekaturov, Russian Federation, address for formal notices: Moscow, Yuzhnobutovskaya Street, house 72, building 3, apartment 27. Contact: support@lyrarma.com

This policy sets out account usage and related data processing conditions. It applies together with the Lyrarma Cloud Privacy Policy, which separately describes files, public links, content inspection and infrastructure

2. Registration and required information

Creating an account requires a username, email address and password, plus a valid beta key where beta registration restrictions are enabled. Both policies must be accepted separately. Missing required information or acceptance of either document prevents registration

The account database stores an identifier, username, email address, bcrypt password hash and list of assigned plans. The cloud profile is linked to the account by its identifier. Plaintext passwords are not stored in the database; assigning a plan does not mean this system processes payment details

Users must provide an address they are entitled to use and must not impersonate another person. The presence of an email address in an account does not itself establish verification of that address or legal identification of its owner

3. Sign-in and account security

During sign-in, the system compares the password with its stored hash and issues a JWT token valid for 24 hours from issuance, according to JWT_TTL=24h in the current .env file. The API accepts an authorisation token, while the web interface uses auth-session for the token and auth-session-username for the username. Both cookies expire with the token, no later than 24 hours after sign-in, and are removed when signing out in the current browser

The actual sign-in cookie settings are Path=/, HttpOnly=true, SameSite=Lax and Secure=true. The Secure attribute marks cookies for transmission over secure HTTPS connections. The language cookie lyrarma_lang lasts 365 days and uses Path=/, SameSite=Lax and Secure=true without HttpOnly; for lyrarma.com and its subdomains the code sets Domain=.lyrarma.com. localStorage and the interface browser cache have no general application-defined expiry and may be cleared by the browser or user

Users must keep passwords and tokens confidential, avoid sharing them with others and report suspected unauthorised access to support@lyrarma.com. Do not reuse the password on other services

Signing out removes cookies in the current browser, but should not be treated as guaranteed revocation of all previously issued tokens on other devices. The current implementation does not provide self-service email password recovery or mandatory two-factor authentication; contact support for assistance, subject to verification of your authority

4. Purposes, grounds and recipients

Data is used to create and maintain accounts, verify access, apply plans and quotas, support users and protect the service. The system automatically stores, retrieves, checks and transfers necessary information between authentication and cloud components; enquiries are handled by authorised personnel

User-initiated registration, account provision, plan administration and service-related support rely on Article 6(1)(5) of Russian Federal Law No. 152-FZ: processing necessary to enter into and perform a contract with the user. Protection against unauthorised access, diagnostics and incident investigation rely on Article 6(1)(7), only to the extent necessary and without infringing data subjects' rights and freedoms. Meeting specific statutory obligations and handling requests prescribed by law rely on Article 6(1)(2)

For other processing that requires consent and has no other ground, consent is obtained separately under Article 6(1)(1) and Article 9. Accepting this policy is not consent to advertising, arbitrary account disclosure or all additional processing. Source: Article 6 of Law No. 152-FZ

The authentication database is hosted separately from the cloud application. Application servers and servers running the databases are provided by Timeweb Cloud — ООО «ТАЙМВЭБ.КЛАУД» (TIMEWEB.CLOUD LLC), INN 7810945525. These servers process account identifiers, usernames, email addresses, password hashes, plans, cloud profile information and technical logs. Authorised administrators and the provider may have access to hosted systems as necessary to deliver and support the services, while competent authorities receive data upon lawful requests

Support email is hosted by Timeweb — АО «ТаймВэб» (Timeweb JSC), INN 7810353960, processing addresses, message contents, attachments and delivery information. File S3 storage is provided by Bucket.ru — ООО «Студия 24» (Studiya 24 LLC), INN 2463088895; it stores uploaded files and object metadata, including internal identifiers in object keys, rather than performing account sign-in. Provider addresses and data allocation are detailed in section 5 of the Privacy Policy

According to the operator, the servers, databases, S3 storage and support email infrastructure are hosted in the Russian Federation; no CDN is used to serve the application or user files. The absence of a user-file CDN does not mean there are no external connections: the interface loads Google Fonts from fonts.googleapis.com and fonts.gstatic.com. Browsers transmit technical network information to that external provider

This version of the project uses the account for Lyrarma Cloud and does not provide universal sign-in to third-party applications. Connecting additional services that require further disclosure or consent must be accompanied by appropriate information and the necessary legal ground

5. Acceptable use

Accounts must not be used to gain unlawful access to data, bypass restrictions, disrupt the service, distribute harmful material or infringe others' rights. Users are responsible for the lawfulness of actions performed with their accounts within the limits of applicable law

The assigned plan determines available storage limits; actual plan conditions must be separately available to the user. This policy does not itself establish a price, payment obligation or charging procedure

6. Retention, ending use and rights

Account, cloud profile and plan data is retained while the account is serviced. Once the processing purpose is achieved, including when service ends, the operator must ensure processing stops and destruction occurs within 30 calendar days unless a ground under law or an applicable contract permits continued retention. For data processed under separate consent, withdrawal is governed by Article 21(5) of Law No. 152-FZ, with the same maximum period where the data is no longer needed and no other applicable ground exists

Security logs are retained for necessary diagnostics, protection and investigation of a specific incident; support enquiries and attachments until the issue and related substantiated claims are resolved. Once the relevant purpose is achieved, destruction must occur within 30 calendar days unless another lawful ground applies. Law No. 152-FZ does not establish a universal log or correspondence retention period in days or years; the absence of such a number does not permit indefinite accumulation

Backups must be cleaned up within the same applicable deadlines. Only where destruction within the deadlines of Article 21(3)–(5.1) is impossible must data be blocked and destroyed within six months under Article 21(6), unless federal law sets another period; this is not a general six-month backup retention allowance. Destruction is documented by a certificate and, for automated processing, an event log export under Roskomnadzor Order No. 179 of 28 October 2022; this evidence is retained for 3 years

To correct data, stop using the service or delete an account, contact support@lyrarma.com. The current interface does not offer self-service account deletion or account detail changes. Deleting an individual cloud file does not delete the account

Account deletion may affect access to all associated cloud data; clarify the consequences and save any files you need before closing the account. The operator proportionately verifies account ownership and the requester's authority; formal requests are subject to Article 14(3) of Law No. 152-FZ. Processing information and data access are provided within 10 working days of receiving a request, with a reasoned extension of no more than 5 working days under Article 20

Confirmed inaccuracies are corrected and data confirmed to have been obtained unlawfully or to be unnecessary for the stated purpose is destroyed within 7 working days of receiving the supporting information under Article 20. Unlawful processing must stop within 3 working days of discovery; where it cannot be made lawful, data is destroyed within 10 working days of discovery under Article 21(3)

A request to stop processing is acted upon within 10 working days of receipt, subject to a reasoned extension of no more than 5 working days and the exceptions in Article 21(5.1). Where another lawful ground requires continued processing, the operator explains it to the requester. Deletion covers the relevant records in both databases, associated objects and copies; restoring a backup must not reintroduce deleted data into live processing

These deadlines require organisational action by the operator: the application does not provide automatic account closure, log rotation or backup management. Category-specific criteria and destruction evidence procedures are detailed in section 7 of the Privacy Policy. Sources: Article 20 and Article 21 of Law No. 152-FZ

Users may exercise applicable legal rights to information, access, correction, restriction and destruction of data, withdrawal of separately provided consent and complaints before Roskomnadzor or a court

Residents of the United States may register from age 13; the minimum for residents of every other country, including the Russian Federation, is 16. A higher local age requirement takes precedence where it governs independent access to the service or processing of personal data without parental authorisation. Parental permission does not waive the service's minimum age

Reaching the minimum age does not establish full legal capacity or supply any necessary authorisation. Where the law requires a legal representative's involvement or consent for a contract or particular data processing, that requirement must be satisfied before the relevant action. In the Russian Federation, transactions by users aged 16–17 are governed by Article 26 of the Civil Code, subject to statutory exceptions and cases of full legal capacity acquired before adulthood. Accepting this policy does not replace a legal representative's consent required by law

7. Acceptance and policy changes

The registration checkbox confirms separate acknowledgement and acceptance of this policy. The current implementation validates both selections during registration but does not store a separate record of the document version and acceptance time

The current revision is available at /lyrarma-id/policy with its revision date. Material changes should be communicated before they take effect; additional consent, where legally required, must be obtained separately. Send enquiries to support@lyrarma.com