Policy

Privacy policy

Effective: 29 August 2026

AuthFactor is an Android application for time-based and counter-based one-time passwords. You can use the application without a synchronization account.

Data stored on your device

AuthFactor stores authenticator secrets, account labels, notes, tags, icons, folders, settings, and encryption keys on your device. The application encrypts the vault. Android Keystore protects device keys. AuthFactor does not include advertising or analytics collection.

Data processed when you enable synchronization

If you enable synchronization, AuthFactor processes:

• Your verified email address and identity-provider identifier.
• Encrypted vault records and encrypted key slots.
• A device identifier, device description, session records, and security activity.
• A Firebase Cloud Messaging registration token when push synchronization is active.
• Network information required for delivery, abuse prevention, and service logs.

The device encrypts vault content before upload. The synchronization service does not receive the plaintext authenticator secret, generated one-time code, note, tag, or custom icon.

Service providers

• Firebase Authentication verifies email ownership and Google sign-in.
• Firebase Cloud Messaging sends data-only vault-change signals.
• Render operates the AuthFactor API service.
• Neon operates the PostgreSQL database used by the API.
• Firebase Hosting serves these public pages and Digital Asset Links.

Camera and biometrics

AuthFactor uses the camera only when you scan a QR code. Biometric verification uses the Android system interface. AuthFactor does not receive your fingerprint or face data.

Retention and deletion

Local data remains until you delete entries, wipe the application, or remove its data through Android. Synchronized data remains while the synchronization account exists. Use the in-app deletion control to delete the server account and its encrypted records. See the account-deletion instructions.

Security limits

No system can guarantee absolute security. Keep the recovery phrase offline. Do not send it to AuthFactor support or another person.

Questions

Use the support contact published with the AuthFactor application listing. Do not include an authenticator secret, recovery phrase, password, or one-time code in a support request.