Privacy Policy

Last updated: October 1, 2026

The short version: Your two-factor secrets, codes and saved passwords are stored encrypted on your device. We don't run servers that receive them, and we can't see them. There's no account and no sign-up. The only data that leaves your device is what Apple and RevenueCat need to handle in-app purchases, and, only if you turn it on, iCloud Keychain sync, which Apple encrypts end to end.

Your accounts and passwords stay on your device

The accounts you add (service name, account name and setup key), the codes generated from them, and the logins you save in the password vault are stored in the iOS Keychain, which encrypts them with keys protected by your device passcode. Codes are generated on your device and never sent anywhere.

iCloud Sync (optional). If you turn on iCloud Sync, items are stored in iCloud Keychain so they appear on your other Apple devices. iCloud Keychain is end-to-end encrypted by Apple; we have no access to it.
Backups (optional). If you export a backup, the file is encrypted with a password you choose (AES-256-GCM). Where you save it (Files, iCloud Drive, email…) is up to you. We never receive it.
Device backups. Keychain items can be included in your encrypted iPhone backups, so your accounts move to a new iPhone when you restore from one.

Camera and photos

The camera is used only while you scan a QR code, and only to read the code. Images are not saved or uploaded. When you choose a screenshot from Photos, only the image you pick is read on your device to find the QR code.

Face ID, Touch ID and PIN

App Lock uses Apple's LocalAuthentication framework. Your face or fingerprint data never reaches the app; iOS only tells it whether authentication succeeded. Your app PIN is stored as a salted hash in the Keychain on this device.

Private browser

The built-in browser uses a non-persistent WebKit data store: history, cookies and website data are kept in memory and discarded when you start a new session or close the app. Websites you visit receive the same information any browser sends (such as your IP address) and have their own privacy policies.

Purchases

Payments are processed by Apple. We never see your payment details. To check whether you have Premium, we use RevenueCat, a subscription service that receives your purchase history and an anonymous app user ID. It isn't linked to your identity or used for tracking. If you installed the app from an Apple Search Ads ad, Apple's attribution token (which campaign led to the install) may be shared with RevenueCat to measure the ad; it contains no personal information.

What we don't do

No analytics, advertising or tracking SDKs.
No account, email or phone number required.
We don't sell or share personal data.

Children

Authenticator isn't directed at children under 13 and doesn't knowingly collect data from them.

Changes

If this policy changes, we'll update the date above and, for significant changes, mention it in the app's release notes.

Contact

Questions? Email coduy96@gmail.com.