Your account vault stays on your device. Optional icon requests are the exception to offline operation, and you choose whether to enable them.
The short version
Authora is a local authenticator. You do not create an Authora account. Your enrollment keys, account labels, notes, tags, and preferences are stored on your device. Authora does not operate a cloud vault, analytics service, advertising service, or remote code-verification service.
There is one optional network feature: downloading service icons. It is off by default. If you turn it on, the icon provider receives the requested service name and network information such as your IP address. Your enrollment keys and generated codes are not included in those requests.
What this policy covers
This policy covers the Authora app and this website. “We” refers to the Authora developer. It does not cover the services whose verification codes you store, your operating system, an app store, a file-storage provider you choose, or the optional icon provider. Those parties have their own privacy policies.
Information kept on your device
Authora processes the information needed to manage your enrolled accounts: authentication secrets, provider and account names, code settings, account order, notes, tags, and accounts in Trash. Legacy account PINs may be stored if you explicitly choose that option. Appearance, language, security settings, and unlock preferences are also saved locally.
Your vault password protects access to the encrypted account key. Routine unlock may use a locally saved database-key credential according to your selected unlock method. An app PIN and related verification state are held in secure storage. These credentials are not part of exported account backups.
On Android, iOS, and macOS, Authora encrypts the account database. Biometric protection and secure-storage capabilities vary by platform. The app PIN is an app-access check; it does not cryptographically bind the database key to the PIN. Enabling biometric and PIN unlock together also enables a separate secure-storage credential for the PIN fallback.
Camera, files, biometrics, and clipboard
- Camera: used when you scan an enrollment QR code. QR processing takes place on your device; Authora does not upload camera frames.
- Selected images and files: processed when you choose an image, open a backup, import accounts, or save an export. Authora reads the selected content locally.
- Biometrics: your operating system handles fingerprint or face authentication. Authora receives an authentication result or access to a protected credential; it does not receive your biometric template.
- Clipboard: when you choose to copy a code, it is placed on your system clipboard. Other apps, keyboards, clipboard histories, or device features may access clipboard content according to your operating system’s rules.
You can manage permissions in device settings. Disabling a permission may prevent the related feature from working.
Optional online service icons
Online icons are disabled by default and can be changed during onboarding or in Settings → Privacy. If enabled, Authora downloads provider logos from The SVG. The request identifies the requested service or icon, and the provider receives your IP address and ordinary HTTP connection information.
Authora does not send your account email, notes, tags, enrollment secret, vault password, app PIN, or generated verification code with an icon request. The provider may keep its own request logs. Disabling online icons stops new logo requests; local initials are used instead. It cannot remove logs already held by that provider.
Backups, exports, and sharing
Encrypted .authora backups contain account information protected by the backup password. JSON, SQL, text, and HTML exports are readable and may expose the secrets needed to generate your codes. Exported backups omit accounts in Trash and stored legacy account PINs.
Exports are written to a location you choose. If that location is synchronized by a cloud-storage app or shared with someone, the chosen service or recipient handles the file. Authora does not control those copies. Keep encrypted backups and their passwords safe, and delete readable exports when you no longer need them.
Keeping and deleting data
Your account data remains on your device until you delete it. Moving an account to Trash keeps it recoverable inside the vault. Permanently deleting it from Trash removes it from the app’s active storage; it does not revoke its secret at the account provider or remove copies in older backups.
You can remove local app data through your operating system. Uninstalling typically removes the app’s local database, but secure-storage/keychain retention varies by platform. Saved exports, provider recovery codes, clipboard histories, and copies held by other services must be managed separately. Authora cannot guarantee secure erasure of all device memory or previously saved copies.
Visiting this website
This website does not include analytics, advertising trackers, cookie-based personalization, external font services, or account-registration forms. Its fonts, icons, and scripts are served with the site. Your selected website appearance is saved only in your browser’s local storage so it can be remembered on your next visit.
The hosting provider may process your IP address, request details, and ordinary server logs to deliver and secure the website. Retention depends on the hosting provider. If you follow an external link, the destination’s privacy policy applies.
Contacting us
If you contact the developer, you choose what information to share. A support or email provider may process your message. Use fictional or redacted account details when reporting a problem. Never send enrollment secrets, live verification codes, vault passwords, app PINs, or unencrypted account backups.
The developer’s public contact details will be added before release.
Children’s privacy
Authora is not directed at children under 13, or a higher minimum age where local law requires one. It has no account-registration or profiling system, and we do not knowingly request personal information from children. If you believe a child has sent personal information to the developer through support, contact us so the matter can be addressed.
Your choices and privacy rights
You can keep online icons disabled, change unlock methods, revoke camera or file access, delete accounts, and manage local app data and exported backups. Because Authora does not keep a server-side account vault, the developer cannot retrieve or delete your local vault remotely.
If you have sent the developer information through support, you may ask about access, correction, or deletion of that information. Applicable privacy rights and lawful retention requirements depend on your location and the information involved.
Changes to this policy
We may update this policy when the app or its data practices change. The updated version will appear on this page with a new date. Material changes will be communicated through the app or its distribution information where appropriate. Review this policy when you update Authora.