# Secure MFA Privacy Policy Effective date: August 5, 2026 Developer: `[Insert the developer's or legal entity's public name before release]` Privacy contact: `[Insert a public contact email before release]` This Privacy Policy explains how Secure MFA Authenticator ("Secure MFA" or the "App") accesses, processes, stores, and shares information. ## 1. Core principles Secure MFA does not provide a user account, product-operated cloud vault, or background cloud synchronization service. MFA secrets, one-time passwords, and account labels are stored locally on the user's device. We do not operate a server that receives, synchronizes, or recovers this data. The App includes the Google Mobile Ads SDK to display app open advertising. Advertising requires network access and may involve Google's processing of device and advertising-related data as described below. ## 2. MFA data processed locally When a user adds or imports MFA information, the App may process TOTP secrets, current one-time passwords, issuer and account names, user labels, TOTP parameters, local organization settings, encrypted backups and backup passphrases, and temporary QR transfer data and transfer codes. This information is used only to generate codes, manage the local vault, create or restore encrypted backups, and perform user-initiated device transfers. It is not provided to the advertising SDK and is not uploaded to a product server operated by us. ## 3. Local storage and security - MFA records are stored in encrypted form on the device. - Android Keystore protects the local vault key. On supported devices, users may enable system biometric or device-credential protection. - Android processes biometric templates, device PINs, patterns, and passwords. Secure MFA does not read or store those authentication materials. - Encrypted backups are created only when initiated by the user and are protected by an independent backup passphrase. - The user controls where exported backup files are stored. Secure MFA does not automatically upload backups. - Chrome-to-Android QR transfers are encrypted before display. Transfer codes are not embedded in QR codes or persistently stored. No security measure can guarantee absolute security. Users should protect their devices, backup files, vault credentials, and backup passphrases. ## 4. Camera, files, and clipboard - The camera is used only when the user initiates QR scanning. Images are processed locally and are not uploaded or retained by us. - File access is used only for encrypted backup files selected by the user for import or export. - When a user copies a one-time password, the code is placed on the system clipboard. The operating system or other authorized software may be able to access clipboard contents. ## 5. Advertising and third-party processing Secure MFA uses the Google Mobile Ads SDK to display dismissible app open ads. The advertising SDK does not receive MFA secrets, one-time passwords, account names, labels, backup contents, backup passphrases, transfer codes, or vault status. According to Google's disclosure for the Google Mobile Ads SDK, the SDK may automatically collect and share with Google: - IP addresses, which may be used to estimate general location; - product interactions such as app launches, ad impressions, taps, and video views; - diagnostic information about app and SDK performance; and - Android advertising IDs, App Set IDs, and other applicable device or account identifiers. Google may use this data for advertising, measurement, analytics, service improvement, and fraud or abuse prevention. Advertising data is encrypted in transit. Google's processing, retention, and international transfers are governed by its own policies: - Google Privacy Policy: https://policies.google.com/privacy - Google advertising technologies: https://policies.google.com/technologies/ads Where required by law, the App will provide applicable consent choices before loading personalized ads or accessing related advertising storage. Users can reset or delete the Android advertising ID through Android privacy settings and may adjust choices through applicable consent interfaces. ## 6. Processing we do not perform Other than advertising-related processing by the Google Mobile Ads SDK, we do not create Secure MFA user accounts, upload MFA data to our servers, sell vault contents, use MFA data for advertising profiles, read contacts or browsing history, or use third-party product analytics or remote crash-reporting services. ## 7. Retention and deletion Local MFA data remains until the user deletes records, clears the App's data, or uninstalls the App. Exported backup files remain under the user's control. Temporary transfer data and transfer codes are retained only as needed for the current operation and are cleared on cancellation, failure, timeout, or completion. Advertising data processed by Google is handled under Google's retention policies and the user's advertising settings. Because Secure MFA has no product account or server, we cannot remotely access or delete the local vault. Users can delete local records, clear Android app data, or uninstall the App. ## 8. Children's privacy Secure MFA is not specifically designed for children. We do not knowingly collect children's personal information through core features. Target-audience and advertising settings will comply with Google Play Families policies, age-appropriate content requirements, and applicable law. ## 9. International processing When Google provides advertising services, advertising-related data may be processed on servers outside the user's country or region. See the Google Privacy Policy for information about processing locations and safeguards. ## 10. Changes to this policy We may update this policy when features, third-party SDKs, laws, or store requirements change. We will update the effective date and publish the latest version through the App, store listing, or public policy page. Where required, material changes will receive additional notice or consent choices. ## 11. Contact - Developer: `[Insert the developer's or legal entity's public name before release]` - Privacy contact: `[Insert a public contact email before release]` - Address: `[Insert before release if applicable]`