Privacy Policy

1. Scope and contact

This policy covers Auth. - Authenticator 2FA for iPhone and iPad (bundle identifier com.authenticatorpro.ios), this website, and related support. “Auth.”, “we”, “us” and “our” refer to the app’s publisher, identified in its App Store listing, who is responsible for the processing described here. This policy does not cover other apps or platforms.

Contact us at help.inshot@gmail.com for privacy questions or requests. There is no Auth. login or online vault account to create or delete. Accounts you add are local authenticator entries for third-party services.

2. Information on your device

The app stores the service names, account labels, secret keys, categories and favorites you add manually or import from a QR code, selected image or file. It uses these to organize accounts and generate time-based verification codes on your device. Theme, app-lock and backup preferences are also stored locally.

Auth. does not upload your secret keys, generated codes, QR contents, account labels or local backup contents to us, Apple, RevenueCat or an analytics service. There is no cloud vault, server-side account recovery, or AI processing of your authenticator data.

3. Permissions and device features

Camera

With permission, the camera scans setup and transfer QR codes. Frames are processed on your device, without an Auth. upload. Manual key entry is available if you decline camera access.

Photos and files

The system picker gives Auth. access to the images or files you select for import. The app does not request unrestricted access to your photo library.

App lock

Apple’s Local Authentication system checks Face ID, Touch ID or your device passcode. Auth. receives the result, not biometric templates or your passcode.

Clipboard

A code is copied only when you request it. Auth. marks it for the local device clipboard with an expiration at the end of the code’s validity period. Content you paste into another app is then handled by that app.

Notifications

If you opt in, Auth. schedules local daily reminders and security tips. Choose one, two or four per day in Settings → Daily Reminders; the default is one. iOS also asks for notification permission. Reminders contain no account information, run during daytime hours in your local time, and can be turned off in the app or iOS Settings. Delivery is subject to iOS and Focus settings. The app does not register a remote push token or use a notification server for these reminders.

You can revoke available permissions in iOS Settings at any time. Disable app lock or automatic backups in Auth.’s settings if you no longer want those features. Revoking a permission prevents future use of that feature; it does not erase entries already imported.

4. Storage, security and backups

Your vault and in-app snapshots use AES-256-GCM encryption through Apple’s CryptoKit. Their key is stored in the iOS Keychain using device-only, while-unlocked access. Vault and snapshot files use iOS file protection and are excluded from iOS system backups.

These measures reduce risk, but no device, storage system or transmission is completely secure. Protect your device and passcode, install security updates, and avoid sharing sensitive screenshots.

5. Exports and transfers

When you request an Android-compatible JSON export, it includes unencrypted secret keys. Auth. warns you before exporting. A file or sharing destination you choose may store or upload it to its own service; that service’s terms and privacy practices apply. QR codes containing setup or transfer data are also sensitive.

You control those copies. Store them securely, verify a transfer before removing the original accounts, and delete unneeded exports, saved QR images and destination backups separately. Deleting an entry in Auth. does not delete copies elsewhere.

6. Purchases and RevenueCat

Apple processes payments. RevenueCat’s SDK validates and restores purchases, manages Premium access and provides subscription analytics. It connects when the app starts or refreshes subscription access, including for installations that have not purchased.

RevenueCat processes an automatically generated app-user identifier, purchase history and receipts or transaction identifiers, product and subscription status, app activity timestamps, and technical app, device, operating-system and storefront information. Network services also receive connection information such as an IP address to handle requests. Auth. does not supply a name, email, advertising identifier or personal customer attributes to RevenueCat.

Subscription records are used for functionality, purchase validation, fraud prevention and subscription analytics. They are not used by Auth. for cross-app advertising tracking. We do not receive your payment-card details. If you voluntarily give support a purchase reference, we use it only to address your request.

RevenueCat processes end-user subscription data on our behalf under its Data Processing Addendum; its privacy information explains that role. Apple separately handles Apple Account, payment and App Store information under Apple’s Privacy Policy. Our policy governs how we use your information.

7. Website, support and analytics

This website uses Google Firebase Hosting. Hosting processes request information, including IP addresses, to serve pages, detect abuse and analyze hosting usage. See Firebase’s privacy information and Google’s Privacy Policy.

The website has no advertising cookies, analytics scripts, browser storage, account registration, contact forms or checkout. Fonts and images are served from this website. Links to external sites open services with their own privacy practices.

If you email us, we receive your email address, message and any attachments you choose to send. We use this information to respond, troubleshoot and handle privacy requests. Our email provider is Google. Never send setup keys, verification codes, recovery codes, vault files or unredacted screenshots of them.

Optional app analytics

On first use, Auth. offers separate choices for usage analytics and crash reports. Both are off by default. Declining does not reduce Basic or purchased Premium features. You can change either choice at Settings → Privacy Choices. We do not send events from before you opted in.

If you enable usage analytics, Google Analytics for Firebase and Yandex AppMetrica receive a fixed set of feature events: app opens, onboarding steps, account-setup and scan outcomes, code-copy actions, backup/import/export outcomes, Premium screens, purchase/restore outcomes, and reminder choices or opens. Event parameters use predefined categories, never free-form account information. This helps us measure which steps people complete or leave and improve reliability and usability.

The SDKs also process installation identifiers, app and SDK versions, operating system and device characteristics, activity timestamps, network information such as IP addresses, and approximate region inferred from IP. These identifiers can distinguish an installation across sessions; they are not a name or email address, but we do not describe this data as fully anonymous. We do not attach a personal user profile, use advertising identifiers, enable location access, collect screen recordings, or automatically report deep links that could contain setup information. Advertising personalization and advertising tracking are disabled.

Optional crash reports

If you separately enable crash reports, Firebase Crashlytics receives crash traces and diagnostic app/device state with installation identifiers so we can investigate failures. If usage analytics is also enabled, predefined event breadcrumbs can help explain what preceded a crash. We do not add setup keys, account labels, codes, QR payloads, backups or free-form error details to these reports. Crash information may be temporarily stored on the device before sending. Turning crash reporting off stops future uploads and requests deletion of unsent reports.

Google explains these services in Firebase privacy and security information and Google’s Privacy Policy. See Yandex’s Privacy Policy and AppMetrica documentation for its processing. RevenueCat’s necessary subscription processing is separate from these optional controls. Apple may separately process App Store usage and device diagnostics under its own settings and policies.

8. Use, sharing and processing grounds

We use information only for the purposes described in this policy. We do not sell or rent personal information, share it for targeted advertising, or use your authenticator data to train AI models. We may disclose information we hold when legally required, to address fraud or security incidents, or to protect legal rights, using only what is necessary.

Service providers processing information on our behalf are required to provide the same or equal protection described in this policy and required by applicable privacy rules, including Apple’s privacy requirements. They must limit processing to authorized purposes and use appropriate confidentiality and security safeguards. Apple and destinations you independently choose also have their own responsibilities under their policies.

Where a legal basis is required, we rely on providing the features or subscription you request, legitimate interests in secure operation, fraud prevention and understanding subscription performance, and compliance with legal obligations. Optional usage analytics, crash reporting and daily reminders rely on your separate choices. Where consent is required, we rely on your consent. You can withdraw consent for future processing, without affecting prior lawful processing, using device controls or by contacting us. We do not make automated decisions with legal or similarly significant effects about you.

9. Retention and deletion

Local entries and snapshots

Remain until you delete them or remove the app’s data. Deleting an account from the vault does not remove it from older snapshots; delete those snapshots separately in Backup. Removing the app removes its local data, while iOS manages Keychain entries separately. Uninstalling is not a guarantee that every Keychain item is erased.

Exported copies

Remain at the destinations you chose until you remove them there. Cloud storage, email, device backups and recently deleted folders may retain separate copies.

Subscription records

Apple and RevenueCat retain records as needed to validate and restore access, prevent fraud, resolve disputes and meet legal obligations. Uninstalling does not automatically erase these records or cancel billing. Contact us for a request concerning records processed on our behalf; Apple controls its own payment records.

Optional analytics and diagnostics

Turning collection off stops future reporting; it does not automatically erase data already received. Firebase Crashlytics retains crash traces and associated identifiers for 90 days before starting removal from live and backup systems, as described in its privacy documentation. Usage-event retention follows the provider and project retention settings; aggregated reports may remain longer than individual events. We retain information only as needed for the stated purposes and applicable obligations. Contact us to request access, deletion or details of the current analytics retention settings. We may need a limited installation reference to locate records, but never a setup key or code.

Hosting information

Google states that Firebase Hosting retains IP data for a few months, as described in its privacy documentation.

Support correspondence

Kept for as long as needed to resolve your request and relevant follow-up, security, dispute or legal obligations. Information no longer needed for those purposes is deleted or anonymized.

For practical steps, see deleting local data and making a privacy request. We cannot access or erase data that exists only on your device or in an export destination you control.

10. Your rights and choices

Depending on applicable law, you may request access, correction, deletion, a copy or portability of personal information we hold; object to or restrict certain processing; withdraw consent; or complain to a privacy regulator. These rights may apply in the EEA, UK, Switzerland and other jurisdictions, with exceptions and procedures set by local law. We do not discriminate against you for exercising applicable privacy rights.

Email help.inshot@gmail.com and identify the app and your request. We may ask for limited information needed to verify the request and locate relevant records, but never authenticator secrets or passwords. We will respond within the period required by applicable law and explain any applicable limitation or required retention.

Manage optional usage analytics and crash reporting at Settings → Privacy Choices, and reminders at Settings → Daily Reminders. Changing these choices does not require a purchase. Permission controls apply to the corresponding device features. There is no advertising-consent setting because we do not run advertising tracking. For questions or objections concerning subscription analytics, contact us. Buying, refreshing or restoring Premium requires processing needed to verify the purchase; local codes do not need an internet connection.

11. International processing

Your vault is processed locally. Subscription services, optional analytics and diagnostics, hosting and email providers may process other information outside your country, including in the United States and other countries where Google, RevenueCat and Yandex/AppMetrica operate. Where applicable law requires a transfer safeguard, processing is subject to appropriate safeguards such as the provider’s contractual data-protection terms and standard contractual clauses. Contact us for information about safeguards relevant to your request.

12. Children

Auth. is a general-purpose utility, not a service directed to children under 13 or below a higher applicable age for independent consent. We do not knowingly seek personal information from children. A parent or guardian who believes a child has provided information to us can contact us so that we can address it and delete it where required.

13. Changes and questions

We will update this policy and its effective date when our practices change. Material changes will be communicated in the app or through another appropriate notice, and consent will be requested where required. Questions can always be sent to help.inshot@gmail.com.