Sent to your email. Valid for 10 minutes.
We store your email, an opaque session id, and timestamps. Read the security posture.