Privacy Policy

Authenticator App

Last Updated: January 24, 2026

Welcome to Authenticator. We take your privacy seriously. This Privacy Policy explains how we handle your information when you use our two-factor authentication app.

1. Information We Don't Collect

We believe in true privacy. Authenticator:

• Does not collect any personal information
• Does not use analytics or tracking services
• Does not contain advertisements
• Does not share data with third parties
• Does not have a backend server

2. Data Storage

Local Storage

All your two-factor authentication accounts and secrets are stored locally on your device using Apple's secure Keychain technology. This data never leaves your device unless you enable iCloud sync.

iCloud Sync (Optional)

If you choose to enable iCloud sync:

• Your data is synced to your personal iCloud account
• Data is encrypted using AES-256-GCM end-to-end encryption
• Only you can access your data with your iCloud credentials
• We cannot access, read, or decrypt your synced data

3. Security Measures

Your security is our top priority. We implement the following measures:

• AES-256-GCM Encryption: Industry-standard encryption for all stored data
• PBKDF2 Key Derivation: 100,000 iterations for password-based encryption
• Secure Keychain: Secrets stored in Apple's hardware-backed secure enclave
• Biometric Protection: Optional Face ID/Touch ID authentication
• No Plain Text: Sensitive data is never stored unencrypted

4. Camera Usage

Authenticator requests camera access solely to scan QR codes when adding new accounts. Camera data is:

• Processed locally on your device in real-time
• Never recorded, stored, or transmitted
• Used only for QR code recognition

5. Biometric Data

If you enable Face ID or Touch ID:

• Biometric data is handled entirely by Apple's system
• We never access, store, or process biometric information
• Authentication happens through Apple's LocalAuthentication framework

6. Third-Party Services

Authenticator does not integrate with any third-party services, analytics platforms, or advertising networks. The only external service used is Apple's iCloud (CloudKit), which is governed by Apple's privacy policy and is entirely optional.

7. Data Retention

Since we don't collect any data, there is nothing to retain on our end. Your local data remains on your device until you:

• Delete individual accounts within the app
• Delete the app from your device
• Reset your device

8. Children's Privacy

Authenticator does not knowingly collect any information from anyone, including children under 13. The app contains no features that would require age verification.

9. Your Rights

You have complete control over your data:

• Access: All your data is visible within the app
• Deletion: Delete any account or all data at any time
• Portability: Your data stays with your iCloud account
• Control: Enable or disable iCloud sync at any time

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.