Privacy Policy

VaultSpec Authenticator (“the App”) is an open-source two-factor authentication app for Android and for iPhone, iPad and Mac. This policy covers all of them; where they differ, it says so. The App works fully offline and does not require an account. Your authenticator secrets are encrypted on your device.

The App also offers an optional feature, VaultSpec Cloud backup. If you choose to use it, you create a VaultSpec account and the App stores an encrypted copy of your vault on our servers. This policy explains what stays on your device, what is sent if you turn that feature on, and who processes it.

We cannot read your authenticator secrets or codes, with or without cloud backup. The App contains no advertising, no analytics and no tracking.

TOTP secrets, account names and App preferences are stored on your device. Your vault password is never sent to us and is not stored on the device.

On Android, secrets are encrypted with AES-256-GCM using a master key protected by your vault password (derived with scrypt). Preferences are kept in Android's EncryptedSharedPreferences, backed by the hardware Keystore. The App is excluded from Android's automatic cloud backup, so this data is not copied to your Google account. Uninstalling the App deletes it.

On iPhone, iPad and Mac, your accounts are kept in a vault file encrypted with AES-256-GCM. Its master key is stored in the Apple Keychain, wrapped with a key derived from your vault password (PBKDF2-SHA256, 600,000 iterations), and, if you turn on Face ID or Touch ID, in a second Keychain item that only opens after biometric authentication. Both Keychain items are restricted to this device and are not synced to iCloud Keychain. The encrypted vault file can be included in your device's iCloud or computer backup, but it cannot be opened without the key that stays on this device. Preferences (such as Auto-Lock and Behavior settings) are stored in the App's standard settings and contain no secrets. Deleting the App deletes the vault file.

You only need an account for cloud backup. If you create one, we collect and store:

• Email address — to identify your account and to send sign-in codes and password-reset links. It is stored encrypted in our database, alongside a keyed hash used to look your account up.
• Account password — stored only as a salted Argon2id hash. This is a separate password from your vault password.
• Device name — recorded with each sign-in session, so you can recognise your signed-in devices, and stored encrypted. On Android this is the device model (for example “Pixel 9”). On iPhone and iPad it is the name the system reports, normally the model (for example “iPhone”); on a Mac it can be the computer's name.
• Session and verification data — sign-in tokens, emailed 6-digit codes and reset links are stored as hashes. Codes expire after 10 minutes and reset links after 1 hour.

Signing in requires your account password and a one-time code sent to your email address.

When cloud backup is on, the App encrypts your vault on your device with AES-256-GCM, using a key derived from your vault password, and uploads only the encrypted result. We store that ciphertext together with its size, the time it was created and an identifier for the key generation.

• We do not have your vault password or the encryption key, so we cannot decrypt your backups. If you forget your vault password, we cannot recover them for you.
• We keep your three most recent backups. Older ones are deleted automatically.
• When you change your vault password, the App uploads a new backup and all backups made with the previous password are deleted.

On Android, you can also create encrypted backup files in a folder you choose on your device. They are encrypted with AES-256-GCM using a separate backup password that you set, which is stored in the App's encrypted preferences so that scheduled backups can run. These files stay wherever you put them; the App does not upload them.

On iPhone, iPad and Mac, the App makes no network requests unless you use cloud backup. QR codes are decoded on your device by Apple's VisionKit, and accounts are shown with initials rather than downloaded icons.

On Android, without an account, the App makes network requests only for:

• Service icons. Icons for most services are bundled with the App and need no connection. For a service that is not in the bundled set, the App requests an icon from DuckDuckGo's icon service, which sends that service's domain name (for example “example.com”) to DuckDuckGo. No secrets, codes or account names are sent.
• QR scanning library. QR codes are decoded on your device with Google's ML Kit. Camera images are never uploaded. According to Google, ML Kit may send diagnostic and usage metrics about the library itself to Google.

With an account, the App also communicates with the VaultSpec Cloud API at api.vaultspec.in over HTTPS to sign you in and to upload or download your encrypted backups.

We do not sell or share your data for advertising. We use the following providers to run VaultSpec Cloud, and they process data only on our behalf:

• Railway — hosts our servers and database. It stores the account data and encrypted backups described above, and keeps server logs.
• Resend — delivers our emails. It processes your email address and the content of the messages we send you (sign-in codes and password-reset links), and keeps delivery records of those messages.

Our server logs record the IP address, time and path of each request for security and troubleshooting. They do not contain request bodies, passwords or backup contents. These providers may process data in countries other than your own.

On iPhone, iPad and Mac:

• Camera (iPhone and iPad) — only to scan QR codes when you open the scanner. Images are processed on your device and are not stored or transmitted.
• Face ID or Touch ID — to unlock the vault, if you turn it on. Authentication is handled by the system and the Secure Enclave; the App never sees your biometric data.
• Network — only for VaultSpec Cloud, if you use it. The App does not ask for notification, location, contacts or photo access.

On Android:

• Camera — only to scan QR codes when you open the scanner. Frames are processed on-device and are not stored or transmitted.
• Biometrics — fingerprint or face unlock through Android's BiometricPrompt. Biometric data is handled entirely by Android and the device's secure hardware; the App never sees it.
• Notifications — to tell you when an automatic backup has completed. Optional; backups work without it.
• Internet — for the requests listed under Network Requests.

We include no analytics, no crash reporting, no advertising SDKs and no tracking of any kind. The App does not use Google Analytics, Firebase Analytics or any similar service, and we do not build profiles of how you use it.

Account data and backups are kept until you delete them or your account. You can:

• Delete your account in the App: on Android under Settings → Cloud Backup → Delete Account, and on iPhone, iPad and Mac under Settings → Cloud Backup → Delete Cloud Account. This immediately and permanently removes your account, email address and every cloud backup from our servers. Instructions are also at api.vaultspec.in/delete-account.
• Sign out, which stops backups from that device but leaves existing backups in your account.
• Contact us from your account email address if you cannot access the App, to have your account deleted or to ask what data we hold about you.

Deleting your account does not affect the authenticator accounts stored on your device.

The App is not directed at children under 13, and we do not knowingly collect personal data from them.

Both apps are open source under the GPL-3.0 license, so you can audit how they encrypt and transmit data. The Android app is at github.com/VaultSpec/authenticator-android. The iPhone, iPad and Mac app is at github.com/VaultSpec/authenticator-ios.

If we change how the App handles data, we will update this page and the date at the top. Significant changes will also be noted in the App's release notes.

If you have questions about this privacy policy or your data, you can reach us at support@vaultspec.in or open an issue on our GitHub repository.