AuthPrivacy policy
In short: we don't collect any personal data. Your accounts and codes stay on your device, encrypted under a password only you know. We have no servers that receive them, no analytics and no ads. The one exception we know of is described under QR scanner on Android.
Who we are
Auth is a two-factor authenticator published at rscflow.com. In this policy, “we” means its developer. Questions about privacy go to privacy@rscflow.com.
What stays on your device
Everything you put into Auth is stored only on the device where you entered it:
- Your vault: account names, issuers, the secret keys that generate codes, groups and notes. It is one file in the app's private storage, encrypted with XChaCha20-Poly1305 under a key derived from your master password with Argon2id. Without your password or recovery code it cannot be read — by anyone, including us.
- Settings: preferences such as the theme or the auto-lock delay. They contain nothing secret and are stored next to the vault.
- Quick unlock: if you turn on fingerprint, keychain or PIN unlock, a copy of the vault key is kept by your operating system's secure keystore, protected by the device. It never leaves the device.
We never receive any of this. There is no account and no server for it to go to.
Network access
The Auth apps make no network requests of their own. On Android this is enforced: the app does not request the internet permission, so the operating system does not let it connect. Codes are calculated from your device's clock and need no connection.
Camera
Auth asks for the camera only when you choose to scan a QR code, and you can refuse and type or paste accounts in instead. Camera frames are processed on the device to find the code and are never saved or sent anywhere.
QR scanner on Android
In the current Android version, QR codes are read with Google's ML Kit barcode scanning, which is delivered by Google Play services on your phone. Scanning happens on the device; neither the image nor the account in the code is sent to us.
Google states that ML Kit may send Google diagnostic and usage information: the device model and Android version, the app's package name and version, a per-installation identifier, and performance metrics. Google says this data is used for diagnostics and usage analytics, is encrypted in transit, and is not transferred to third parties. It is sent by Google Play services, not by Auth, and we never see it. See Google's ML Kit data disclosure.
We are replacing this scanner with one built into Auth that involves no third party, and we will update this section when that version ships.
Clipboard
When you copy a code, Auth clears it from the clipboard after 30 seconds by default. You can change the delay in Settings. Some systems keep their own clipboard history, which Auth cannot clear.
Backups and exports
- Backup files you export are encrypted under a password you choose and saved where you choose. What happens to them afterwards is up to you.
- Plain-text exports, which you can make after a clear warning, are not encrypted. Treat them like a password.
- Android device backup: Android may include the app's data in your device backup (for example to your Google account) and in transfers to a new phone. The vault stays encrypted under your master password while it is there. Quick-unlock keys are tied to the original device and cannot be used elsewhere.
This website
The site uses no cookies, no analytics, no web fonts and no third-party scripts. Our web server is not set up to keep access logs, so we don't record who visits or which pages they read.
Sharing and selling
We don't sell, rent or share personal data, because we don't have any. We would disclose data only if the law required it, and we hold none from the apps to disclose.
Children
Auth is a general-purpose security tool and is not directed at children under 13. It collects no data from anyone, children included.
Future features
We plan to offer an optional, paid sync between devices. It will be end-to-end encrypted, so our servers would hold only data we cannot read, and it will need an account with an email address. It is not available today. Before it launches, this policy will be updated to say exactly what it stores and for how long, and nothing will change for people who don't turn it on.
Your rights
Because we hold no personal data from the apps, there is nothing for us to access, correct, export or delete on your behalf. You are in full control: you can export your data at any time, and uninstalling Auth removes the vault from the device. If you have any question about privacy, write to privacy@rscflow.com.
Changes to this policy
If we change this policy, we will post the new version here with a new effective date. If a change affects what the apps collect, we will say so in the app's release notes before it takes effect.