PocketAuth
Privacy Policy & Terms of Use
The short version
- PocketAuth generates your two-factor codes on your phone. It works fully offline, and you do not need an account.
- No analytics, no crash-reporting SDK, no ads and no tracking.
- Your 2FA secrets are stored in an encrypted database on your device. They never leave it unencrypted.
- Cloud backup is optional. If you turn it on, your codes are end-to-end encrypted on your phone before upload. We store only ciphertext that we cannot read, and the only personal data we hold is your email address.
- You can delete your cloud backup and your account from inside the app at any time.
1. Who we are
PocketAuth (the “App”) is a free, open-source two-factor authentication (2FA) app for Android, developed and published by Dipayan Choudhury, an independent developer based in India (“we”, “us” or “our”). It is available in two editions:
- Google Play edition, which includes optional cloud backup and sign-in with Google; and
- Libre edition (for example, on F-Droid), which contains no Google or Firebase code and no cloud backup. For the Libre edition, Sections 3 and 6 do not apply.
This document explains what information the App handles, why, and the rules that apply when you use it. By installing or using the App, you agree to this Privacy Policy and the Terms of Use below. If you do not agree, please do not use the App.
2. Using PocketAuth without an account
When you use PocketAuth without signing in, which is the default, none of your data is sent to us or to anyone else. Everything stays on your device:
- the accounts you add (issuer, account name, secret key, algorithm, digits, period or counter), together with folders, sort order and icon choices, are stored in a local database encrypted with SQLCipher, using a key protected by the Android Keystore;
- your settings, such as biometric lock, auto-lock, hide codes and screenshot blocking, are stored locally on your device; and
- codes are generated on your device according to the TOTP and HOTP standards, and work without any network connection.
The App disables Android's automatic cloud backup for its data, so your vault is not copied to your Google account by the operating system. When you export your codes, the export file is encrypted with a password you choose, or shown as a QR code for transfer to another authenticator app. The export is created entirely on your device and is never sent to us. You are responsible for keeping export files and their passwords safe.
3. Optional end-to-end encrypted cloud backup
If you choose to turn on cloud backup and sync (Google Play edition only), you sign in with Google, and the App uses Firebase Authentication and Cloud Firestore to store an encrypted copy of your vault.
3.1 What we store
| Data | Form in which we store it | Purpose |
|---|---|---|
| Email address and Google account ID | Plain text, held by Firebase Authentication | To identify your account and let you sign in on a new device |
| Your 2FA entries (issuer, account name, secret, settings, folders, icons) | End-to-end encrypted with AES-256-GCM. Each entry is stored as an opaque encrypted blob under a random ID, with a revision number and a timestamp. | Backup, restore and sync between your devices |
| Device list (names of your signed-in devices) | End-to-end encrypted, with registration and last-seen timestamps and a revoked flag | To let you see and revoke devices |
| Key material (wrapped master key, recovery blob, key-derivation salt and parameters, authentication verifier) | Encrypted keys, plus non-secret salts and parameters | To let you unlock your backup with your passphrase or recovery key |
| Sync timestamps | Plain text | To sync only what has changed |
3.2 What end-to-end encryption means here
Your data is encrypted on your device with keys derived from your backup passphrase, using Argon2id, before it is uploaded. Your passphrase, your master key and your 24-word recovery key are never sent to us. As a result, we, Google and anyone who gains access to our servers cannot read your codes, issuers, account names or device names. For the same reason:
- we cannot recover your backup if you forget both your passphrase and your recovery key; and
- when you ask us for a copy of your data, we can provide only your email address and the encrypted blobs. Your 2FA secrets are, by design, not data we are able to read, produce or correct.
3.3 When sync happens
Sync runs when you request it and, if you enable automatic backup, at most once a day in the background while your device is charging and connected to an unmetered network. You can sign out, turn off automatic backup, or delete your cloud backup at any time. Your codes keep working on your device regardless.
3.4 Legal basis
We process your email address and encrypted backup to provide the backup service you requested, which is the performance of our agreement with you, and on the basis of your consent, which you can withdraw at any time by deleting your backup or account.
4. Device permissions
- Camera: used only to scan QR codes when you add or import accounts. Images are processed on your device, either by Google ML Kit's on-device barcode scanner (Google Play edition) or by ZXing (Libre edition), and are never stored or uploaded.
- Biometrics: used to unlock the App if you enable biometric lock. Fingerprint and face data are handled entirely by Android. The App never receives them.
- Internet (Google Play edition only): used only for optional sign-in and cloud backup.
The home-screen widget and the Quick Settings tile display codes only on your device. If you enable “Hide codes”, they respect that setting.
5. What we do not collect
PocketAuth contains no analytics SDK, no crash-reporting SDK, no advertising SDK and no tracking, and it does not use an advertising ID. We do not collect your location, contacts, files, usage behaviour or device identifiers for tracking. We do not sell, rent or share your personal data. If you choose to send us crash reports through Google Play, Google provides them to us in aggregated, anonymised form as part of Google Play Console.
6. Third-party services
The Google Play edition uses the following services, only when you turn on cloud backup:
| Service | Purpose | Privacy policy |
|---|---|---|
| Google Sign-In (Credential Manager) | Signing in with your Google account | policies.google.com/privacy |
| Firebase Authentication | Managing your account | firebase.google.com/support/privacy |
| Cloud Firestore and Cloud Functions for Firebase | Storing encrypted backups, and deleting them when you delete your account | firebase.google.com/support/privacy |
Google ML Kit's barcode scanner runs on your device and does not send images to Google. Google's servers may be located outside India. Because your vault is end-to-end encrypted, Google cannot read it.
7. Data retention and deletion
- Local data stays on your device until you delete entries, clear the App's storage, or uninstall the App.
- Cloud backup is kept until you delete it. Deleted entries are kept as encrypted “tombstones” for up to 90 days, so that the deletion reaches all your devices, and are then removed.
- Account: when you choose Settings → Delete account in the App, your Firebase Authentication account is deleted, and an automated function permanently removes your entire backup, including entries, devices, key material and metadata. Deleted data may remain in Google's encrypted backups for a limited period before it is overwritten.
To delete your cloud backup but keep your account, use Delete backup in the sync sheet. If you no longer have access to the App, email pocketauth@dipync.com from the email address you signed in with, using the subject “Account deletion”, and we will delete your account within 30 days.
8. Security
Security is the core of PocketAuth. Measures include an encrypted local vault (SQLCipher with a key protected by the Android Keystore), optional biometric lock and auto-lock, screenshot blocking, end-to-end encryption of backups (Argon2id and AES-256-GCM), encrypted transport (TLS), and server-side rules that limit each account to its own encrypted data. The source code is open for anyone to review.
No system is perfectly secure. Your codes are only as safe as your device, your device's screen lock, your backup passphrase and your recovery key. Please keep them secure. To report a vulnerability, email pocketauth@dipync.com with “SECURITY” in the subject line.
9. Your rights
Subject to applicable law, including India's Digital Personal Data Protection Act, 2023, and, where it applies to you, the EU/UK General Data Protection Regulation, you have the right to access, correct and delete your personal data, to withdraw consent, to object to or restrict processing, to nominate another person to exercise your rights, and to complain to us or to your data-protection authority. Most of these rights can be exercised directly in the App, by signing out, deleting your backup or deleting your account. For anything else, write to pocketauth@dipync.com. We will respond within 30 days. As explained in Section 3.2, the only personal data we are able to produce is your email address and your encrypted backup.
10. Children
PocketAuth is a general-audience security tool and is not directed at children under 13. We do not knowingly collect personal data from children. Users under 18 should turn on cloud backup only with the involvement and consent of a parent or legal guardian.
11. Terms of Use
11.1 Acceptance
These Terms of Use (“Terms”) form a binding agreement between you and us. By using the App, you confirm that you are legally able to enter into a contract under the laws that apply to you or, if you are a minor, that a parent or guardian has agreed to these Terms on your behalf.
11.2 Open-source licence
The PocketAuth Android app is free software, licensed under the GNU General Public License, version 3 (GPLv3). Your rights to use, study, modify and redistribute the source code are governed by that licence, and nothing in these Terms limits them. These Terms apply to your use of the App as distributed by us, and of our cloud backup service. The PocketAuth name and logo are not covered by the GPLv3, so modified versions should use a different name. Third-party components are used under their own licences, which are listed in the App.
11.3 Your responsibilities
PocketAuth stores the second factor for your other accounts, so losing access to it can lock you out of those accounts. You are responsible for:
- keeping a backup of your codes, whether through encrypted cloud backup, an encrypted export, or the recovery codes provided by each service;
- keeping your backup passphrase and 24-word recovery key safe. We cannot reset or recover them, and without them your cloud backup cannot be decrypted;
- keeping your device secure, with a screen lock and up-to-date software; and
- using the App only for accounts that you own or are authorised to manage.
11.4 Acceptable use of the backup service
You agree not to misuse the cloud backup service. In particular, you must not use it to store data other than the App's own encrypted backup, attempt to access other users' data, overload or disrupt the service, or use it for any unlawful purpose. We may suspend accounts that do so.
11.5 Price
PocketAuth is free. It contains no ads and no in-app purchases, and no features are restricted behind a payment.
11.6 Service continuity
PocketAuth works offline. If cloud backup is ever discontinued, the App will keep generating your codes and will keep letting you export them. Nothing stops working. If we ever discontinue cloud backup, we will give at least 12 months' notice in the App, by email to signed-in users, and on this website. Exporting your codes never depends on our servers, so you can move to another app at any time. Because the App is open source under the GPLv3, the community can continue to maintain and distribute it even if we are no longer able to.
11.7 Changes to the App
We may update, change or remove features of the App or the backup service, subject to the commitment in Section 11.6. We do not guarantee that the backup service will always be available or free of interruptions.
11.8 Termination
You may stop using the App at any time and delete your account from within it. We may suspend or end your access to the backup service if you breach these Terms or if we are required to do so by law. If that happens, the App will continue to work offline on your device. The sections on disclaimers, limitation of liability, indemnity and governing law continue to apply after termination.
11.9 Disclaimer of warranties
The App and the backup service are provided “as is” and “as available”, without warranties of any kind, whether express or implied, including any implied warranties of merchantability, fitness for a particular purpose or non-infringement, to the fullest extent permitted by law. As stated in the GPLv3, the program is provided without warranty.
11.10 Limitation of liability
To the fullest extent permitted by law, we will not be liable for any indirect, incidental, special, consequential or punitive damages, or for any loss of data, loss of access to third-party accounts, or loss of profits or goodwill, arising from your use of, or inability to use, the App or the backup service, including any loss caused by a forgotten passphrase or recovery key, or by a lost or compromised device. Our total liability for any claim relating to the App will not exceed INR 1,000.
Nothing in these Terms excludes or limits any liability that cannot be excluded or limited under applicable law, or your statutory rights as a consumer.
11.11 Indemnity
You agree to indemnify us against any claims, losses or expenses, including reasonable legal fees, that arise from your breach of these Terms or your misuse of the backup service.
11.12 Governing law and disputes
These Terms are governed by the laws of India. Before starting any formal proceedings, please contact us so that we can try to resolve the issue informally. Subject to any mandatory consumer protection laws in your country of residence, the courts of India have exclusive jurisdiction over any dispute arising from these Terms or the App.
11.13 General
If any provision of these Terms is found to be unenforceable, the remaining provisions will remain in full effect. Our failure to enforce any right is not a waiver of that right. You may not transfer your rights under these Terms. We may transfer ours to a successor who agrees to honour them, including the commitment in Section 11.6. These Terms, the Privacy Policy above and the GPLv3 are the entire agreement between you and us about the App. We are not responsible for delays or failures caused by events beyond our reasonable control.
12. Changes to this document
We may update this Privacy Policy and these Terms from time to time. When we do, we will change the “Last updated” date at the top of this page and, for significant changes, notify you in the App. We will not make any change that reduces the protection of your end-to-end encrypted data without giving you clear notice in advance. If you keep using the App after a change takes effect, you accept the updated version.
13. Contact and grievances
If you have any questions, requests or complaints about this document or the App, please contact:
Dipayan Choudhury — Developer and Grievance Officer
Email: pocketauth@dipync.com
Website: dipync.com
Please include a clear description of your request. We will acknowledge grievances within 48 hours and aim to resolve them within 15 days.