Authenticator · by arifz
Privacy Policy
This policy covers Authenticator, listed on Google Play as 2FA Guard Authenticator, package xyz.arifz.authenticator, developed by arifz (“we”, “us”). It explains how the app handles your information and the choices available to you.
1. Information used on your device
When you scan a setup QR code or enter a setup key, Authenticator processes the secret key, account label, service or issuer name, and code settings (algorithm, number of digits and time period). Labels may contain personal information, such as an email address, if you enter it or it appears in the QR code.
These details are saved in the app’s private local database so it can generate time-based one-time passwords (TOTP). Secret keys are encrypted before storage. Account labels, issuer names and code settings are not individually encrypted by the app. Codes are generated on your device; we do not receive your setup keys, account list or generated codes.
The app also stores preferences, including theme, dynamic color, screen security, onboarding status and a dismissed update version. Search is performed locally. There is no developer-operated account, cloud sync or remote vault.
2. Camera access and QR codes
Camera permission is requested when you choose to scan a setup QR code. CameraX supplies camera frames and ZXing decodes them on the device. The app does not save camera photos or videos, or upload frames or scanned setup information to us.
A supported QR code fills the account form for you to review and save. You can decline camera access and enter the setup key manually, or revoke permission in Android Settings. The app does not request access to your photo library, contacts, microphone, SMS or location.
3. Copying codes
When you tap to copy a code, the app places that code on the Android clipboard so you can paste it into the service you are signing in to. The clipboard entry is marked as sensitive to hide its preview on supported Android versions.
Copying makes the code available outside Authenticator through the system clipboard. Clipboard access, previews and retention depend on Android and other software on your device. The app does not implement its own clipboard auto-clear timer. Only paste codes into the service you intended to use.
4. How local information is protected
Secret keys are encrypted with AES-256-GCM using a key held in Android Keystore. Android’s app storage isolation also protects local files from ordinary access by other apps. This is encryption of stored secrets, not encryption of every database field.
Screen security is enabled by default. It asks Android to block screenshots and screen capture and hide the app’s contents in recent-app previews. You can change this in Settings. This feature is not an app password or biometric lock, and protection depends on the operating system and device.
No device or storage method is completely secure. Keep your phone protected with a screen lock and current software. We cannot recover your setup keys if access to the device or its encryption key is lost.
5. Google Play, network use and third-party services
Authenticator has no advertising SDK, Firebase Analytics or integrated automatic crash-reporting SDK. We do not operate a server that receives your authentication records or track which accounts you use.
The app uses Google Play’s in-app update service. Google Play handles update checks, downloads and installation. Google documents the use of device metadata, app version, and installed module and asset-pack information to determine update availability and size. Google states that this data is encrypted, is not transferred to third parties by that feature, and is removed after a fixed retention period; the documentation does not specify its length. This update process does not require the app to send your OTP secrets or account labels.
Code generation works offline. Google Play’s own services can use the network for updates, and opening this privacy policy uses an external browser. Network-state access may be included by the update library. The absence of an app-operated server does not mean that Google Play or your browser never processes information.
When you visit this website, the browser and hosting infrastructure receive ordinary request information such as your IP address, browser information and requested URL to serve the page. This policy page contains no analytics scripts or advertising trackers.
6. Backup, device transfer and recovery
In version 1.1.0, the account database is excluded from Android cloud backup and device transfer through the app’s backup rules. Preferences may still be backed up or transferred according to your Android settings. The encryption key is tied to the device, and the app provides no account export or cloud recovery feature.
Older versions may have used different backup rules. Updating does not necessarily remove older backup copies; manage them through your device or backup provider. Do not rely on reinstalling or restoring a phone backup to recover your authentication accounts.
Keep the recovery codes supplied by each service somewhere safe. Before deleting accounts, clearing storage or changing phones, make sure you have another way to sign in or can set up two-factor authentication again with that service.
7. Retention, deletion and your choices
Your authentication records remain in local storage until you remove them. You can:
- Rename the service and account labels from an account’s menu.
- Delete an individual account from its menu, or use Settings → Delete all accounts to remove all saved authentication entries.
- Use Android Settings → Apps → Authenticator → Storage → Clear storage/data, or uninstall the app, to remove its local records and preferences. Android menu names vary.
- Manage camera permission, screen security and Android backup settings separately.
Deleting all accounts in the app removes authentication entries, but does not reset preferences or erase a code already copied to the system clipboard. Deletion is a normal database removal, not a promise of forensic secure erasure. Existing system backups are handled separately.
Removing an entry does not close your account at the original service or turn off its two-factor authentication. Manage those settings with that service. Because we do not hold a copy of your local vault, we cannot remotely access, restore or delete it for you.
8. Contact, support and privacy requests
Authenticator is developed by arifz. For questions or privacy requests, email [email protected].
If you contact us, we receive your email address, message and anything you attach. We use these to respond and handle follow-up, and retain them only as needed for that purpose or applicable legal obligations. Our email provider processes that correspondence. You can ask us to delete support correspondence, subject to those obligations.
Please do not send passwords, setup keys, live codes or recovery codes. Depending on applicable law, you may have rights to access, correct or delete personal information we hold. Contact us to exercise those rights. We do not sell personal information; we may disclose information we actually hold when required by law or necessary to protect legal rights.
9. Children’s privacy
The app does not ask for an age or create an online user profile. Its local data handling is the same for all users. If a parent or guardian has a concern about information sent to us in a support message, they can contact us using the address above.
10. Changes to this policy
We may update this policy when features or data practices change. The revised date will appear here. Where required, changes that need a separate notice or consent will also be addressed in the app.