We collect nothing.
Effective 10 September 2026. This policy is short because Vault2FA has no server, no analytics, no advertising, no accounts and no network access of its own.
Everything you put into Vault2FA stays on your iPhone unless you deliberately export it. The App Store privacy label reads "Data Not Collected" because that is exactly the case.
What the app stores, and where
- Authenticator secrets are stored in the iPhone Keychain with the device-only protection class. Apple does not copy these to iCloud Keychain, and they are not included in iCloud or computer backups of the device.
- Account names, notes, favourites and ordering are stored in a local database inside the app's own container on the device.
- Preferences — code size, sort order, security toggles — are stored in the app's local settings.
What leaves the device
Nothing, automatically. Two features move data off the device, and only when you start them:
- Encrypted backup. When you choose Export encrypted backup, the app encrypts your accounts with a passphrase you choose (AES-256-GCM, key derived with PBKDF2) and hands the resulting file to the iOS share sheet. Where it goes from there — Files, AirDrop, mail — is your choice, and Vault2FA never sees it again. The passphrase is not stored anywhere.
- Reveal secret / show QR. Displays a single account's secret on screen so you can move it to another app. It goes nowhere unless you copy or scan it.
Permissions the app asks for
- Camera — only to scan QR codes when you tap Scan. Frames are processed on the device and never stored.
- Photos — only to read a screenshot you pick when importing a QR code.
- Face ID — to unlock the app and to reveal a secret. Biometric data is handled entirely by iOS; the app only learns whether authentication succeeded.
Third parties
There are none. The app includes no third-party SDKs, trackers or analytics.
Crash reports
If you have opted in to sharing analytics with app developers in iOS Settings, Apple may forward anonymised crash reports through App Store Connect. These contain diagnostic information about the crash and never include your authenticator secrets or account names.
Children
Vault2FA is a general utility and does not knowingly collect information from anyone, of any age.
Changes
If this policy changes, the new version will be posted here with a new effective date.