Privacy Policy
Last updated: October 1, 2026
Authenticator is an offline-first TOTP authenticator. This policy explains how it handles information when you use the app.
Data stored on your device
Your authenticator account labels, issuers, and TOTP secret keys are stored locally in your browser's IndexedDB storage. The app generates codes locally. Biometric unlock, if enabled, uses your device's platform authenticator; the app does not receive or store your fingerprint, face data, or device PIN.
Google Drive backup
If you choose to sync or restore a backup, Authenticator requests the Google Drive drive.appdata permission. This permission is used only to create, read, and update the app's own hidden application-data backup file. The app does not request access to your normal Google Drive files.
Your vault is encrypted on your device with your vault password before a backup is sent to Google Drive. Your vault password is not sent to Authenticator, Netlify, or Google.
How Google data is used
Google Drive data is used only to provide the encrypted backup and restore features you request. Authenticator does not sell, rent, share, or use Google user data for advertising. The app does not use Google data for analytics, profiling, or training.
Data sharing and retention
Authenticator has no separate application server that stores your vault. Encrypted backups remain in the Google account you authorize until you replace or remove them. Local data remains in your browser until you remove it, clear site data, or restore another vault.
Your choices
You can stop using Google Drive backup at any time, remove local site data through your browser settings, and revoke the app's Google Drive access from your Google Account permissions. Revoking access prevents future Drive access; manage any existing backup through the app or your Google Account's connected-app settings.
Security
Keep your vault password private and use a strong, unique password. Anyone with both an encrypted backup and its vault password may be able to restore that backup. No website can fully protect data on a compromised device.
Contact
For privacy questions or support, contact [email protected].