01 Overview
This policy explains how Auth Code: 2FA Authenticator and this website handle information. The app support contact is [email protected]. This policy applies to our app and support website; services whose accounts you protect have their own policies.
02 Authenticator accounts
Codes are generated on your device. Authenticator secret keys are stored in Apple Keychain; account metadata is stored locally using Core Data. Our app does not use a custom server to store your authenticator accounts. Do not share secret keys, current codes, recovery codes or backup passwords with support.
03 Optional sync, backups and widgets
If you enable iCloud sync, encrypted vault data is stored in your private Apple CloudKit database and the encryption key uses synchronizable Keychain. Apple handles iCloud under its own terms. Password-protected exports contain an encrypted copy of your vault; you control where you save or share them. Selected account information may be shared with the app’s widget extension on your device to display your chosen accounts. Consider your device and widget visibility settings.
04 Camera and device protection
Camera access is used to scan QR codes when you choose this feature. Photo access may be used when you import a QR image. Biometric authentication uses Apple system services; the app does not receive your fingerprint or face template. You can manage these permissions in iOS Settings.
05 Purchases, analytics and attribution
Apple StoreKit and Apphud support purchases, subscription status and related app identifiers. The app uses Amplitude and Firebase Analytics for usage events, screen interactions, device/app information and an app user identifier. Apple AdServices may provide advertising attribution. Where permission is required for tracking, the app uses the Apple permission flow. Authenticator secret keys, generated codes and backup passwords are not intended as analytics event data. Providers process information under their own policies.
06 Contact form data
When you submit the website form, we process your name, email address, topic, message and consent to respond to your request. The message is delivered to our support Telegram chat using the Telegram Bot API. Telegram and email providers process this information on their infrastructure, potentially outside your country. The website uses a necessary session cookie for form security and temporarily stores hashed network identifiers and request counters to limit spam. Hosting providers may record ordinary access logs, including IP address and request details. The website uses Google Analytics to understand visits and interactions. Google Analytics may use cookies and process online identifiers, device and browser information, pages viewed and usage events. Google processes this information under its privacy policy. Do not include secrets or private information in page URLs.
07 Purpose, retention and choices
We use support data to respond and resolve issues, purchase data to provide paid features, and usage data to understand and maintain the app. Where applicable, processing relies on providing requested services, legitimate interests in security and improvement, or your consent. Support messages are kept only as long as needed for the request and applicable recordkeeping duties. Rate-limit records expire after one hour and are removed during subsequent requests; session lifetime depends on server settings. Provider retention is governed by their policies. You may request access, correction, deletion or withdrawal of consent by contacting support; legal exceptions may apply.
08 Removing your information
You can remove accounts in the app and manage iCloud data through your Apple settings. Deleting the app may not remove Keychain, iCloud, exported backup files or provider records. Remove exported files and cloud data separately when needed. Contact us about support or analytics data requests; include enough non-sensitive details to identify your request.
09 Security and children
We use platform security features and encrypted vault exports, but no system guarantees absolute security. Protect your device, backup password and recovery codes. The app and website are not directed to children under 13. If a child has provided personal information, contact us to request appropriate action.
10 Service providers and updates
Relevant providers include Apple, Apphud, Amplitude, Google/Firebase and Telegram. We may update this policy as the product changes; the date above identifies the current version. For privacy questions, email [email protected].