Privacy Policy

Last updated: October 22, 2026

This policy covers the Authenticator app and authenticator.devinworks.app. For privacy questions or requests, contact DevinWorks at devinworks2026@outlook.com.

Local account data

Service names, account labels, TOTP secret keys, groups, and preferences are stored on your device. The local vault is encrypted with AES-256-GCM; its data key is held in device secure storage. Codes are generated locally. Local-only use does not send your vault to our sync server.

Optional cloud sync

If you activate sync, our server processes an encrypted vault snapshot, authorization and entitlement records, vault and device identifiers, device public keys, pairing requests, and version and request timestamps. Vault contents are encrypted on the client before upload; the server is not given plaintext TOTP secrets or your recovery private key. Device PINs and local backup history are not synced.

Camera, photos, and biometrics

Camera and selected photo access are used to read QR codes when you choose those actions. QR decoding is performed on the device, and images are not uploaded by this feature. Biometrics use the operating system’s authentication result; the app does not receive biometric templates. Permissions can be managed in device settings.

Exports and clipboard

Exported JSON is not password protected and contains readable secret keys. Files you export or share may be accessible to their recipients and storage providers. Copying a code places it on your system clipboard. Keep exports private and use trusted destinations.

Support and operational information

When you email us, we process the contact details, message, and attachments you choose to send. Service infrastructure may process IP addresses, request times, and error information to operate and secure the service. Hosting and email providers may process this information in other countries. This website embeds no advertising, analytics scripts, or chat widgets. Contact: devinworks2026@outlook.com.

Use, sharing, and retention

We use information to provide requested functionality, manage sync authorization and devices, respond to support, and maintain service security. We do not sell your personal information. Service providers process information as needed for hosting, email, and security; disclosure may also be required by applicable obligations. Local data stays until you remove it; synced records and support correspondence are kept as needed to provide the service and address requests, security issues, and applicable obligations.

Your choices and deletion

You can use local-only mode, manage permissions, revoke synced devices, and remove local accounts. See Account & Data Deletion for local and cloud deletion requests. We may need to verify control of a vault before processing a cloud request; never send secret keys.

Children and updates

The app is a general-purpose security tool and is not specifically directed to children. If you believe a child has provided personal information to us, contact us. Changes to this policy will be published here with an updated date.