Privacy Policy

Last updated: October 6, 2026

1. Who we are

Enveloc, Inc. provides Authy Authenticator: 2FA & MFA and is responsible for the processing described in this policy. This policy covers the app, its Apple Watch app, widgets, verification-code AutoFill extension, and support communications.

Contact: gisellesinclair@icloud.com

2. No separate app registration

You do not need to create a separate Authy login account, provide an email address, or set an app account password to generate verification codes.

The app automatically generates a persistent technical identifier and initializes subscription and analytics services when launched, including before you finish onboarding or make a purchase. These services use technical identifiers and service profiles, rather than a separate Authy login account. We use them to manage subscriptions, restore purchases, understand app usage, and diagnose problems. The identifier is stored using Apple's Keychain and may persist across app reinstalls or synchronize through iCloud Keychain, depending on device settings.

3. Data used for app features

OTP entries: The app processes setup secrets, entry labels, code-generation settings, folders, favorites, and related usage information to generate and organize verification codes. Code generation takes place on your device. App data may also be stored and synchronized through Apple's iCloud/CloudKit services, depending on your device and iCloud configuration.

App lock: Face ID and device-passcode authentication use Apple's system authentication interfaces. The app receives the authentication result, not your biometric templates or device passcode.

Widgets, Apple Watch, and AutoFill: The app and its extensions access the data needed to display or provide your verification codes. AutoFill also uses the website domains you associate with entries and supplies a selected code to the compatible app or website through Apple's credential-provider APIs. Enabling a widget can make codes visible on your screen; consider your device's lock-screen settings.

QR content and images: The app processes the text, links, Wi-Fi details, contact-card details, SMS content, and images you select or enter to scan, create, save, or share QR codes. The app processes selected images and QR contents on the device. Sharing or exporting sends the chosen content to the destination you select.

Backups: You can create password-encrypted backup files or choose a plain-text export. Plain-text exports contain setup secrets and allow anyone with the file to generate your verification codes. Exported files and copies stored in other apps or cloud drives are outside the app's storage.

We do not proceed your data anywhere, we do not have any servers.

4. Technical data and purposes

User ID: The app-generated technical identifier is used for app functionality and analytics, including maintaining premium access and measuring app usage. It is not a username or an account that you register.

Product Interaction: We use app interaction events for analytics, such as launches, onboarding progress, screen and button interactions, and use of code-access and QR features.

Crash Data: We use crash reports for analytics to identify failures and improve app reliability.

Support: If you email us, we receive your email address, message, and any attachments you choose to send. Do not send OTP setup secrets, passwords, recovery codes, or complete backup files.

5. Why we process this information

We process information to provide verification-code, QR, synchronization, and AutoFill features; manage purchases and premium access; respond to support requests; diagnose failures; measure feature and subscription usage; and protect the service or meet legal obligations.

We use app analytics for the operation and improvement of this app and its subscriptions. We do not use the app data described above for cross-app targeted advertising or advertising measurement, and we do not sell it to data brokers.

Where applicable law requires consent for a processing activity, that consent must be separate from accepting the Terms of Use. Other processing may be necessary to provide a feature you request, administer a purchase, or meet legal obligations. Contact us with questions about the basis for a particular activity or to exercise an applicable right to object or withdraw consent.

6. Service providers and disclosures

We use Apple for platform services, iCloud/CloudKit, credential-provider functionality, and App Store payments; Adapty for subscriptions; Amplitude for product and subscription analytics; Google Firebase for analytics, remote configuration, and diagnostics; and Logo.dev for service icons.

Providers processing data on our behalf must protect it consistently with this policy and applicable law. Apple and other providers may also process information independently for their own services under their applicable terms and privacy policies. We may disclose information when required by law or to address fraud or security issues. If responsibility for the app changes, relevant records may pass to the new operator subject to applicable law and notice obligations.

Provider information:

Apple: https://www.apple.com/legal/privacy/

Adapty: https://adapty.io/privacy/

Amplitude: https://amplitude.com/privacy

Firebase: https://firebase.google.com/support/privacy

Logo.dev: https://www.logo.dev/legal/privacy

7. Retention, deletion, and your choices

Active entries remain in app storage until you delete them. Moving an entry to Recently Deleted does not permanently erase it. The current app provides a 30-day recovery window and removes expired entries when it runs the relevant cleanup. You can erase an entry earlier using Delete Permanently in Recently Deleted. Changes to data synchronized through Apple services may propagate according to Apple's synchronization behavior. Exported files and copies in other apps must be deleted separately.

We retain technical profiles for the period needed to operate the app, maintain premium access, handle support requests, and meet applicable legal obligations. Analytics events and crash reports are subject to the retention settings of the services we use and are deleted or de-identified when no longer needed for their stated purposes. Contact us for information about the retention applicable to your request.

Deleting the app prevents that installation from generating new app events, but it does not automatically delete all previously collected SDK records, iCloud data, Keychain records, exported backups, or an Apple-managed subscription.

You can control camera, photo, biometric, iCloud, and AutoFill permissions through the relevant device settings. These settings do not necessarily disable SDK analytics. The current app does not have an in-app analytics opt-out switch. To request access, correction, deletion, restriction, portability, or to object to processing or withdraw consent where applicable, email gisellesinclair@icloud.com. We may need information to locate the technical profile and verify the request. Do not include secrets or verification codes. We will explain any records we must retain and any data controlled separately by Apple or another provider. You may also have the right to complain to your local data-protection authority.

8. Security and international processing

We use platform security features and encrypted network connections where supported by the services we use. Password-encrypted backup export is a separate feature. This policy does not promise that all local or cloud-synchronized app data is end-to-end encrypted. No storage or transmission method can eliminate all security risks.

Our service providers may process data outside your country. Where required, we use applicable contractual and other safeguards for international transfers. Contact us for information about the safeguards applicable to your data.

9. Children

The app is not directed at children under 13. If you believe a child provided personal information to us, contact us so we can investigate and handle the information as required by applicable law.

10. Changes and contact

We may update this policy when the app or our practices change. We will update the date above and provide additional notice or obtain consent when required.

Enveloc, Inc.

gisellesinclair@icloud.com