Q-Authenticator
Privacy Policy

1. Information We Collect

Q-Authenticator does not collect any personal information. The app operates entirely on your device without communicating with external servers.

The following data is stored locally on your device only and is never transmitted:

• TOTP account names and secret keys you add manually or via QR code scan
• A PIN-derived encryption key (never stored — re-derived on each unlock)

All stored data is encrypted using AES-256-GCM with a key derived from your PIN via PBKDF2 (100,000 iterations, SHA-256). Quatech cannot access this data under any circumstances.

2. Camera Access

The app requests camera permission solely to scan otpauth:// QR codes when you choose to add an account via QR scan. Camera frames are processed locally in real time and are never stored, transmitted, or used for any other purpose.

You may decline camera access and use manual key entry instead — the app's full functionality remains available.

3. Data Sharing

We do not share any data with third parties. Q-Authenticator contains no analytics SDKs, no advertising libraries, no crash reporting services, and no backend servers. The app functions fully offline.

4. Data Storage & Security

All account secrets are stored in your device's local storage, encrypted with AES-256-GCM. The encryption key is derived from your PIN at runtime and is never persisted to disk. Uninstalling the app permanently deletes all data from your device.

5. Children's Privacy

Q-Authenticator is not directed at children under 13. We do not knowingly collect any information from children. If you believe a child has provided information through the app, please contact us and we will take appropriate steps.

6. Changes to This Policy

If we make material changes to this privacy policy, we will update the effective date above and publish the revised policy at this URL. Continued use of the app after changes are posted constitutes acceptance of the revised policy.