AuthletAuthlet Privacy Policy
In short: Authlet does not collect, share or sell any data. Your accounts and codes stay on your device. The app has no user accounts, no analytics, no advertising, no crash reporting and does not send anything over the internet.
Who we are
Authlet is a two-factor authentication app that generates one-time codes (TOTP) for your online accounts. It is developed by Himmet Kaan Salihoğlu ("we").
Data we collect
None. We do not collect, receive, store on our servers, share or sell any personal or usage data. Authlet does not contain analytics, advertising or tracking software, and it makes no network requests.
Data stored on your device
To work, the app keeps the following on your device only:
- Your accounts: the service name, account name and secret key of each account you add, plus the code settings (algorithm, number of digits, period).
- Your app settings, such as whether app lock is on.
This data is kept in the operating system's secure storage (the iOS Keychain or the Android Keystore). It can only be read while your device is unlocked. It is excluded from iCloud and Android cloud backups and from device-to-device transfers, so it does not leave your device unless you export a backup yourself.
Camera
The camera is used only to scan QR codes when you add an account. Images are processed on your device to read the code; they are never saved or sent anywhere.
Face ID, Touch ID and fingerprint
If you turn on app lock, the app asks the operating system to verify your identity. Biometric data is handled entirely by your device; Authlet never receives it.
Clipboard
When you tap a code, it is copied to your device's clipboard so you can paste it. By default, the app removes the code from the clipboard after 30 seconds if it is still there.
Encrypted backups
You can export your accounts to a backup file. The file is always encrypted with a password you choose (AES-256-GCM with a key derived from your password). The password is not stored. You decide where the file is saved or sent; if you save it to a cloud service or send it by email, that service's own privacy policy applies. Importing a backup, or accounts from Google Authenticator's export QR codes, happens entirely on your device.
Deleting your data
You can delete any account in the app at any time. Deleting the app removes its data on Android. On iOS, the system may keep Keychain items after an app is deleted; to be sure all accounts are removed, delete them in the app before uninstalling.
Children
Authlet is not directed at children. Because we collect no data, we do not knowingly collect data from anyone, including children.
Changes to this policy
If this policy changes, we will update this page and the "Last updated" date above. If a future version of the app were to collect any data, this policy would be updated before that version is released.
Contact
Questions about this policy: authlet@himmetkaan.com