AuthNest Privacy Policy

Last updated: 2026-09-14

AuthNest (“we”) respects your privacy. This policy explains how we handle information related to the AuthNest mobile app.

Encryption and local-first design

• Authenticator secrets (TOTP) and password vault plaintext stay in the device secure area (iOS Keychain / Android Keystore) with local encryption.
• When cloud backup is enabled, the client packs data and encrypts it with AES-256-GCM before upload.
• The cloud stores ciphertext only. Our servers do not decrypt secrets, parse secrets, generate OTPs, or read password plaintext.
• App-lock PINs are stored locally as hashes and are never uploaded.

Information we process

• Account: email or third-party sign-in identifiers (e.g. Apple / Google) for cloud backup and membership.
• Backup ciphertext: encrypted snapshots and metadata (version, checksum, entry counts) after you opt in to cloud backup.
• Optional settings mirror: theme / language / lock timeout — off by default; synced only if you enable it.
• Subscription status: synced via Apple App Store / Google Play and RevenueCat for entitlements and quotas.
• Optional diagnostics: crash logs, if enabled, are redacted and never include secrets, OTPs, PINs, or backup plaintext.

What we do not collect

• We do not collect or upload TOTP secrets, one-time passwords (OTPs), or vault passwords in plaintext.
• We do not ship third-party advertising SDKs by default and do not use ATT for ads.

Third parties

• Supabase: authentication and encrypted backup storage.
• RevenueCat and Apple / Google: subscriptions and receipt validation.

These providers process data under their own policies, limited to what is needed for AuthNest features.

Retention and deletion

• You control local data; uninstalling removes on-device data (unless retained by system backups).
• After disabling cloud backup or deleting an account, we stop retaining related cloud ciphertext per product flow and applicable law.
• Contact us via in-app Help & Feedback for account-related requests.

Children

AuthNest is not directed to children under 13. We do not knowingly collect children’s personal information.

Contact

Use in-app Help & Feedback for privacy questions. Do not send secrets, OTPs, PINs, or plaintext passwords.

Hosted copy for store metadata: see store/metadata/*/urls.privacy_url.