Privacy Policy
Updated: 2026-10-07
2FA Key is an authenticator app provided by Guocheng Tang. This policy explains how information is handled in the app, including its TestFlight versions. Contact: totalo@qq.com.
Authenticator data
Account names, issuers, shared secrets, groups and related records are stored on your device using Apple's Keychain. Codes are generated on your device with Apple's CryptoKit. We do not operate a server that receives your authenticator secrets or codes. App preferences, such as language and sync settings, are stored locally.
iCloud synchronization
The app's iCloud Keychain sync setting is on by default. When your device supports it and iCloud Passwords & Keychain is enabled, Apple synchronizes records between devices using your Apple Account. You can turn sync off in Settings. Turning it off stops the app's sync operations on that device; it does not erase records already in iCloud or on other devices. Apple's services are governed by Apple's privacy policy.
Camera, images and files
The camera is used only when you open the QR scanner and grant permission. Selected images and files are processed on your device to read authenticator QR codes. The app does not upload these images or camera frames to us. Importing a code does not delete the original image or file.
App lock and clipboard
Optional app lock uses Apple's device authentication. We do not receive biometric templates or your device passcode. Copying a code places it on the system clipboard for pasting into another app. The app requests expiry on iPhone/iPad and attempts to clear its unchanged clipboard content on Mac; operating-system behavior or app termination can affect clearing.
Purchases
Apple processes payments and provides StoreKit transaction information used to verify and restore lifetime access. We do not receive your payment card information. TestFlight purchases use Apple's sandbox and are not real charges or permanent production purchases.
Analytics, diagnostics and feedback
The app contains no advertising or third-party analytics SDKs and does not track you across other apps or websites. Apple may provide us with TestFlight/App Store diagnostics and usage reports according to its settings and terms. If you send feedback or email us, we receive what you choose to include, such as your email address, screenshots and device details. Never send shared secrets, QR codes for real accounts, recovery codes or active verification codes.
Retention and deletion
You control your authenticator records. Delete an account in the app to remove its active record; when sync is enabled, the deletion is shared with other connected devices. Minimal deletion markers remain to prevent deleted records from reappearing. Offline devices may retain old records until they sync. Uninstalling the app does not necessarily remove Keychain or iCloud data. We cannot retrieve or remotely erase your secrets. Feedback is retained only as needed to address the request and meet applicable obligations; contact us to request deletion of correspondence.
Children and changes
The app is not directed at children under 13, and we do not knowingly solicit personal information from children. Contact us if you believe a child has sent us personal information. We may update this policy when the app's behavior changes; the current version includes its update date.
Contact and your choices
For privacy questions, access or deletion requests concerning information you sent us, email totalo@qq.com. Depending on your location, you may have additional privacy rights. Device permissions and iCloud settings remain under your control. Apple's privacy information: https://www.apple.com/legal/privacy/.