Privacy Policy
Nanjing Xiayuyue Network Technology Co., Ltd.
Effective Date: January 2026 · Last Revised: October 2026
1. Scope & Core Principles
This Privacy Policy explains how Nanjing Xiayuyue Network Technology Co., Ltd. (hereinafter referred to as "we", "us", or "our") processes and protects your information when you use the Authenticator application (hereinafter referred to as "the App"), adhering to the Personal Information Protection Law, GDPR, and international privacy standards.
Please read this policy carefully. Your use of the App signifies your understanding and agreement with the practices described herein.
2. What Information We Process
2.1 Data Kept Exclusively on Your Device (Inaccessible to Us)
The following core data is generated, computed, and encrypted purely on-device. We cannot view, access, or decrypt it:
- 2FA Account Seeds & OTPs: All account names, issuers, secret keys, and calculated dynamic one-time passcodes;
- Biometric Data: Face ID / Touch ID authentication is performed 100% locally by Apple's secure biometric hardware. The App only receives a verification success/failure result and never accesses biometric templates;
- Password Vault Records: Usernames, passwords, and custom notes are encrypted locally via AES-256 GCM in the local Keychain;
- WebDAV Private Cloud Credentials: Server endpoints, usernames, and passwords are saved strictly in the local Keychain. Synchronization flows directly between your device and your personal server;
- AES Encrypted Exports: Offline backup archives encrypted with your custom master passphrase, leaving full decryption authority in your hands.
2.2 Device Permissions & Minimization
Permissions are requested strictly on demand and can be revoked at any time via System Settings:
- Camera (iOS / iPadOS): Invoked only when you explicitly tap "Scan QR Code". Video frames are decoded in milliseconds in memory and destroyed immediately without recording or saving;
- Screen Recording / Capture (macOS): Invoked on-demand when you explicitly trigger "Scan Screen QR Code" on Mac desktop. The screen frame is captured solely for QR code parsing and discarded immediately;
- Photo Library: Invoked only when you choose "Import QR Code from Photos" to parse a single user-selected image;
- Network: Used exclusively for time synchronization (ensuring TOTP calculation accuracy), user-initiated iCloud/WebDAV sync, and anonymous telemetry. Never used to intercept or transmit your vault contents.
2.3 Clipboard & Local Loopback Bridge Compliance
- Clipboard Usage: When tapping "Copy" next to an OTP code or during desktop extension pairing, the App writes the 6-digit PIN to the system clipboard. We never monitor in the background, poll, or read unrelated clipboard history;
- Local Loopback Bridge (127.0.0.1:52820): For Chrome / Edge desktop extension communication, data is exchanged strictly within the local memory loopback channel on your Mac. 100% offline, zero external transmission, and extensions never log your browsing history.
2.4 Third-Party SDK Integrations
To identify crashes, improve stability, and validate App Store subscription receipts, the App integrates vetted SDKs:
| SDK Name | Purpose | Data Collected | Privacy Policy |
|---|---|---|---|
| UMeng SDK (UMCommon / UMAPM) | Analytics & Performance APM | De-identified device parameters (OpenUDID, GUID, IP, model, OS version, network type) | UMeng Privacy |
| Adapty SDK | In-App Subscription Validation | Device parameters (IDFV, model, OS version, IP, language, timezone), App Store purchase receipts | Adapty Privacy |
3. Data Storage & Cross-Border Transfers
3.1 Core Vault Storage: Your 2FA codes and passwords remain strictly on your physical devices. No central database exists on our servers.
3.2 Domestic Storage: Anonymous performance metrics collected by UMeng SDK are stored within compliant domestic data centers and purged upon fulfillment of purpose.
3.3 Cross-Border Processing Compliance: To validate StoreKit in-app purchase receipts across platforms, Adapty SDK transmits de-identified device IDs and transaction tokens to Adapty Inc.'s secure cloud data centers abroad in strict compliance with applicable international transfer regulations.
4. Your Data Control Rights
| User Rights | How to Exercise |
|---|---|
| Access & Review | View all saved 2FA tokens and password items directly in the App at any time |
| Rectify & Edit | Modify account labels, assigned folders, or notes inside the App |
| Erase Local Data | Swipe to delete individual entries, or uninstall the App (erasing all sandbox contents immediately) |
| Revoke Permissions | Turn off Camera, Photos, or Network permissions via device System Settings |
5. Children's Privacy
The App is intended for general audiences. If you are under the age of 14, please use the App only under the guidance and consent of a parent or guardian. We do not knowingly collect personal information from children.
6. Policy Updates
We may update this Privacy Policy periodically. Notice of revisions will be posted prominently on our website and in the App with an updated revision date. Continued use constitutes acceptance of revised terms.
7. Contact Information & Data Protection Officer
For questions regarding our privacy practices or data rights, contact our security team:
- Entity: Nanjing Xiayuyue Network Technology Co., Ltd.
- Privacy Email: service@xiayuyue.com
- Website: http://authenticator.xiayuyue.com/en/