Privacy Policy – Authenticator: Secure 2FA App

01Who we are

Authenticator: Secure 2FA App (the “App”) is developed and published by Piotr Kalita, Poland (“we”, “us”), who is the data controller responsible for the processing described in this policy. This policy also covers the website authenticator-secure.com. Contact: support@authenticator-secure.com.

02Your accounts, keys and passwords

The App stores the data you add to it: two-factor authentication (2FA) setup keys, account names, folders and icons, passwords and recovery codes (“Vault Data”).

On your device. Vault Data is stored on your iPhone and protected by iOS. You can additionally lock the App with Face ID.
iCloud sync. If you turn on sync, Vault Data is stored in your private iCloud account and handled by Apple under its terms. We cannot access it.
Export. When you export, the App creates a file that you control. Anyone who has that file may be able to generate your codes, so keep it private.

We never receive your Vault Data. Your 2FA keys, one-time codes, passwords and recovery codes are not sent to us or to any analytics or advertising partner.

03Camera, Photos and Files

The App asks for camera access to scan QR codes, and lets you pick an image from Photos or a file from Files to import a QR code. Images are processed on your device only to read the code and are not uploaded or stored by us. Face ID is handled by iOS; the App never receives your biometric data.

04Information we collect

Identifiers

A device identifier and an app-generated user identifier, and, only if you allow tracking, Apple’s Advertising Identifier (IDFA).

Usage data

Information about how you interact with the App, such as screens opened, features used and subscription screens viewed.

Purchases

Subscriptions are processed by Apple. We do not receive your payment card details. Apple tells us whether a subscription or trial is active.

Support emails

If you contact us, we receive your email address and your message.

Identifiers and usage data are not linked to your name or email address.

05How we use information

To provide the App and unlock subscription features;
To understand how the App is used and improve it (analytics);
To measure and improve our marketing and to show and measure advertising (advertising);
To answer support requests;
To comply with legal obligations.

06Tracking and your choice

We may use identifiers to track your activity across apps and websites owned by other companies, for advertising and measurement. iOS asks for your permission before the App can do this, through the App Tracking Transparency prompt. If you decline, the App does not access your IDFA and does not track you for these purposes. You can change your choice at any time in Settings → Privacy & Security → Tracking. Your choice does not affect any feature of the App.

07Who we share data with

Analytics and advertising partners: identifiers and usage data, to provide analytics, attribution and advertising services to us. They never receive Vault Data.
Apple: App Store distribution, purchases and, if you use it, iCloud sync.
Authorities: where required by law.

We do not sell your Vault Data and never share it with anyone.

08Legal bases

Under the EU General Data Protection Regulation (GDPR), and the UK GDPR where it applies, we rely on performance of our agreement with you (providing the App and subscriptions), your consent (tracking permission, camera access and other iOS permissions, which you control in Settings), our legitimate interests (analytics to improve the App, answering support requests) and legal obligations.

09Retention

Vault Data stays on your device and in your iCloud account until you delete it. We never store it.
Identifiers and usage data are kept by us and our partners only as long as needed for the purposes above, then deleted or aggregated.
Support emails are kept as long as needed to resolve your request.

10Security

Vault Data never leaves your control: it is stored on your device and, if you choose, in your iCloud account. Data sent to our partners travels over encrypted connections. No method of storage or transmission is completely secure, so we recommend keeping your recovery codes and exports safe.

11Children

The App is not directed to children under 13 (or under 16 where local law sets a higher age). We do not knowingly collect personal information from them.

12Your rights

Depending on where you live, you may have the right to access, correct or delete your personal information, to object to or restrict processing, to data portability and to withdraw consent. Residents of California and other US states may have the right to opt out of the “sale” or “sharing” of personal information for cross-context behavioral advertising: decline tracking in the iOS prompt or in Settings, or email us. To exercise any right, write to support@authenticator-secure.com. You may also lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland, or with the data protection authority in your country of residence.

13Changes

We may update this policy. The current version is always available at authenticator-secure.com/privacy, with the date at the top.

14Contact

Piotr Kalita, Poland · support@authenticator-secure.com