Le Quoc Tuan ("we", "I", or "the developer") builds and publishes applications on the Apple App Store, including a two-factor authentication (2FA) authenticator app (the "App"). This Privacy Policy explains what information the App handles, where it is stored, which third-party services are involved, how long data is kept, and how you can delete it.
By using any application published by the developer, you agree to the practices described in this policy. We may update this policy at any time; changes are reflected on this page together with a new "Last updated" date above.
1 Summary
- Your 2FA secrets, one-time codes, saved passwords and PIN are stored only on your device, in the iOS Keychain. We do not operate a server that receives them and we cannot see or recover them.
- Optional iCloud Backup uploads an encrypted copy of your data to your own iCloud account, never to us.
- Optional Email Recovery stores your email address with Firebase Authentication (Google) so you can reset a forgotten PIN. You can delete it in the App at any time.
- We use Firebase Analytics, Firebase Crashlytics, Adjust and the Facebook SDK for anonymous usage statistics, crash reports and install attribution. These services never receive your 2FA secrets, passwords or email.
- We do not sell your data, and the App shows no third-party advertisements.
2 Scope
This policy applies only to applications and services published by Le Quoc Tuan. It does not apply to:
- Third-party application stores (such as the Apple App Store), which maintain their own privacy policies.
- The online services you protect with the App (for example Google, Facebook or Binance). The App only generates codes for them; it has no relationship with those services.
- Websites, services, or applications owned and operated by third parties, including websites you visit through the in-app browser.
3 Information stored on your device
The App stores the following data in its sandbox and in the iOS Keychain:
- 2FA accounts: issuer, account name, shared secret, algorithm, number of digits, period, folder, notes and backup codes you enter.
- Password Keeper entries: service, username, password, backup code and notes.
- Security settings: your PIN (stored in the Keychain) and whether Face ID / Touch ID is enabled. Biometric authentication is performed by iOS; the App never receives your face or fingerprint data.
- Wi-Fi Security: the list of networks you marked as trusted and your scan history (network name, security result, time).
- Preferences: language, premium status, onboarding and tutorial state.
None of this data is transmitted to the developer. It stays on your device unless you choose to back it up or export it as described below.
4 Home-screen widget
If you add the App's widget, the data needed to display your codes (account names and secrets) is shared with the widget extension through a private App Group container on your device. This data does not leave your device.
5 iCloud Backup (optional)
When you enable Cloud Backup, the App exports your 2FA accounts, folders and Password Keeper entries, encrypts the file with AES-256 on your device, and uploads it to the App's private container in your iCloud Drive. Backups are created when you tap "Backup", or automatically after you change data if Auto Backup is on.
Backups are protected by your Apple ID and governed by Apple's iCloud terms. The developer has no access to your iCloud account or to your backup files. You can view, restore and delete individual backups inside the App (Settings → Cloud Backup), or remove all App data from iCloud in iOS Settings → Apple ID → iCloud → Manage Storage.
6 Email Recovery (optional)
To let you reset a forgotten PIN, you may register a recovery email address. The App creates an authentication record containing that email with Firebase Authentication (Google LLC) and sends you a verification message. Your email is used solely to verify ownership and to allow PIN reset. It is never used for marketing and never combined with your 2FA data, which remains on your device.
You can remove the recovery email at any time in Settings → Email Recovery. Removing it permanently deletes the authentication record from Firebase. You may also request deletion by email (see Contact); such requests are completed within 30 days. Firebase's own data handling is described at firebase.google.com/support/privacy.
7 Camera, Photos and Files
The camera is used only to scan QR codes. Photo Library and Files access is used only to read a QR image or an import file that you select through the system picker. Images are processed on the device and are not stored or uploaded by the App.
8 Location and Wi-Fi information
The Wi-Fi Security feature asks for the "Location While Using the App" permission because iOS only reveals the Wi-Fi network name (SSID/BSSID) to apps with location access. The App reads the network name, local IP address and gateway to tell you whether you are on a trusted network and to run connectivity, DNS and HTTPS-interception checks against well-known public hosts (Google, Cloudflare, Apple) and a public IP-lookup service (httpbin.org), which receive your public IP address in the same way any website you visit does.
Your geographic location is never determined, stored, logged or sent to the developer. You may decline this permission; only the Wi-Fi Security feature will be unavailable.
9 Private Browser
The in-app browser renders websites using Apple's WebKit engine. Browsing data, cookies and cache are kept on your device and cleared when you close a tab. Websites you visit are operated by third parties and collect data under their own privacy policies.
10 Export and sharing
When you export accounts as a QR code or CSV file, the App creates the file on your device and hands it to the iOS share sheet. Anything you share is under your control. Exported files contain your secrets in a form that other authenticator apps can read, so treat them as sensitive and delete them when no longer needed.
11 Analytics, crash reporting and attribution
We use the following third-party services. They receive technical, pseudonymous data: device model, iOS version, App version, language, IP address at the time of the request, random install identifiers, screen and event names, and crash stack traces. They do not receive your 2FA secrets, passwords, recovery email or Wi-Fi history.
- Firebase Analytics & Crashlytics (Google LLC) – usage statistics and crash reports. Privacy
- Adjust (Adjust GmbH) – install and subscription attribution, so we know which campaign led to an install or purchase. Receives the App Store transaction identifier, product, price, currency and storefront; never your Apple ID or payment details. Privacy
- Facebook SDK (Meta Platforms, Inc.) – app-install and conversion measurement for campaigns run on Meta platforms. Privacy
- Apple App Store / StoreKit – purchases and subscriptions, handled entirely by Apple. Privacy
Each provider is bound by its terms to protect your data at least as strictly as this policy and to use it only to provide its service to us.
12 Tracking and the advertising identifier
On first launch, iOS asks whether you allow the App to track you (App Tracking Transparency). If you allow, the device advertising identifier (IDFA) is shared with Adjust and the Facebook SDK for attribution only. If you decline, these SDKs operate without the IDFA and rely solely on Apple's privacy-preserving SKAdNetwork. You can change your choice at any time in iOS Settings → Privacy & Security → Tracking. The App displays no third-party advertisements.
13 In-app purchases and subscriptions
Purchases are processed by Apple. We receive a signed transaction (product, price, period and status) but never your name, Apple ID or payment card details. Your subscription status is stored on your device to unlock Premium features.
14 Data we do not collect
We do not collect your name, phone number, contacts, precise location, health data, photos or browsing history, and we do not sell, rent or trade any information about you.
15 Data retention and deletion
- On-device data is kept until you delete it. Delete individual accounts, passwords or Wi-Fi history inside the App at any time. Uninstalling the App removes its sandbox, and any Keychain items are wiped the next time the App is installed fresh.
- iCloud backups remain in your iCloud until you delete them in the App (Settings → Cloud Backup) or in iOS Settings → iCloud → Manage Storage.
- Recovery email is deleted from Firebase immediately when you remove it in Settings → Email Recovery, or within 30 days of a request by email.
- Analytics and crash data is pseudonymous and retained by Google, Adjust and Meta under their own schedules (Firebase Analytics defaults to 14 months). It cannot be linked back to your 2FA data.
To erase everything: delete your accounts and passwords in the App, delete your iCloud backups, remove your recovery email, then uninstall. Because we hold no copy of your secrets, this process is entirely under your control and does not require contacting us.
16 Data security
The developer applies the following measures:
- Secrets, passwords and PIN stored in the iOS Keychain, protected by the device passcode and Secure Enclave.
- Backups encrypted on the device before being uploaded to your iCloud.
- HTTPS/TLS for all network communication.
- Screenshots and screen recording blocked on screens that display codes.
- Optional App lock with PIN and Face ID / Touch ID.
No method of electronic storage or transmission is completely secure. Please keep a backup and your PIN safe: we cannot recover them for you.
17 Links to other sites
The App may contain links to other websites or services. When you open a third-party link, you are redirected to that destination. The developer does not operate those sites and recommends that you review their privacy policies before providing any information. The developer is not responsible for the content or privacy practices of any third-party site or service.
18 Children's privacy
The applications are not directed to anyone under the age of 13 (16 in the European Economic Area) and do not knowingly collect Personal Information from children. If the developer discovers that a child has provided personal information, that information will be promptly deleted from our systems. If you are a parent or guardian and become aware that your child has provided information, please contact us by email so we can assist.
19 Your rights
You have the right to:
- Request information about the data we hold about you.
- Request correction or deletion of your personal data.
- Withdraw any consent previously given, including tracking consent in iOS Settings.
- Lodge a complaint with a data-protection authority where applicable.
Residents of the European Economic Area, the United Kingdom, California and other jurisdictions may have additional rights, such as access, portability and objection. Because almost all data stays on your device, most requests can be fulfilled directly within the App. For anything else, contact us and we will respond within 30 days.
20 Changes to this policy
This policy may be updated from time to time. You are encouraged to review this page periodically for any changes. Updates will be posted on this page and will take effect immediately upon publication.
21 Contact
If you have any questions, feedback or deletion requests regarding this Privacy Policy, please reach out: