2FA Authenticator App - MFA Privacy Policy

At a glance

No account, no sign-in and no personal information required.
No analytics or tracking. On iPhone and iPad no data is collected at all. On Android, Google's on-device QR scanner (ML Kit) sends Google limited diagnostic data about the scanner itself, never your codes or passwords (section 10).
Your setup keys, codes and passwords are encrypted on your device and never sent to us.
Optional iCloud Sync & Backup (iPhone and iPad) stores your vault in your own private iCloud, end-to-end encrypted. We cannot read it.
We never sell or share personal information.

1. Who we are & scope

2FA Authenticator App - MFA (the "App", shown on your device as "Authenticator App") is developed and published on the Apple App Store and Google Play by Truong Mai, who publishes apps under the studio name MxT APP ("we", "us" or "our"). You can reach us at maixuantruongcvdev@gmail.com.

This Privacy Policy explains how the App handles information. It applies only to the App. The general MxT APP Privacy Policy covers our other apps; where the two differ, this policy applies to the App.

2. What we collect

We do not collect any personal data through the App. The App has no account system, no analytics, no crash reporting service and no tracking. We do not operate any server that receives your data. On iPhone and iPad this matches the App's "Data Not Collected" privacy label on the App Store.

On Android, the QR scanner is Google's ML Kit, which sends Google diagnostic data about the scanner. We never receive that data. Section 10 explains what it is, and the App's Data safety section on Google Play lists it.

The only information that can reach us is what you choose to send in a support email (see section 9).

3. Data stored on your device

Everything you add to the App stays on your phone or tablet:

2FA accounts — service name, account name, setup key, code settings, backup codes, and the folders you create.
Passwords — service name, website, username, password and notes you enter.
Settings — such as appearance, clipboard timeouts, the password scan switch, browser bookmarks and whether biometric unlock is on.

Setup keys, backup codes and the website, username, password and notes of each login are encrypted with AES-256-GCM using a key kept on your device in the iOS Keychain or, on Android, the Android Keystore. Service names, account names and folder names are stored on the device without this extra encryption and are protected by the operating system. Your app PIN is never stored in readable form. Codes and passwords you copy stay on this device (on iOS they are not shared through Universal Clipboard; on Android they are marked sensitive so the clipboard preview hides them) and are cleared from the clipboard after the timeout you set. On Android the vault is also excluded from cloud backups and device-to-device transfers, because its key never leaves the device; move to a new phone with an encrypted backup file instead. The Password risks check on the Passwords tab looks for weak, very common or reused passwords and runs entirely on your device; your passwords are never sent anywhere to be checked, and they are not compared with online breach databases.

4. iCloud Sync & Backup

iCloud Sync & Backup is available on iPhone and iPad only, and is off by default. If you turn it on in Settings › Backup & sync:

Your vault is saved in the private CloudKit database of your own iCloud account, using Apple's iCloud service. It is not stored on our servers and we have no access to it.
The vault contents are stored in iCloud encrypted fields, which Apple encrypts end-to-end with keys tied to your Apple Account.
To show sync status, the record also holds the name of the device that last synced and the number of accounts and passwords. These details are protected by iCloud's standard encryption.

iCloud is provided by Apple and governed by Apple's Privacy Policy. Turning sync off stops future uploads; the copy already in iCloud is kept until you delete it (see section 12).

5. Backups and exports you make

Encrypted backup file — protected by a passphrase you choose (AES-256-GCM, key derived with PBKDF2-SHA256). We never receive the file or the passphrase.
Exports to another authenticator app — transfer QR codes, images and CSV files contain your setup keys. Images and CSV files are not encrypted. They are created only when you ask, and go only where you send or save them using the system share sheet.

6. Device permissions

The App asks for each permission only when you use the related feature. You can change any of them in your device settings.

Permission	Used for	Leaves your device?
Camera	Scanning setup QR codes	No — processed on device, never recorded or uploaded
Photos (picker)	Reading a QR code from an image you choose	No — only the image you pick is read
Face ID / Touch ID (iOS), fingerprint or face unlock (Android)	Unlocking the App	No — handled by the operating system; the App only gets a yes or no answer

The App does not use your location, contacts, microphone or notifications. Websites you open in the private browser cannot use your camera, microphone or location.

7. Network connections

The App works offline. It connects to the internet only:

On iPhone and iPad, to check Apple's App Store (itunes.apple.com) for a newer version of the App. Only the App's public App Store ID is sent; as with any internet request, Apple receives your IP address. If a newer version exists, the App offers the update, and you can choose to update later.
To sync with iCloud, if you turned it on (iPhone and iPad).
On Android, by Google's ML Kit QR scanner, which sends Google diagnostic data about the scanner (section 10).
To load websites you open in the private browser (section 8).
When you tap a link to our website, the App Store, Google Play or a service's website, which opens outside the App or in an in-app browser view.

Service logos shown in the App are built into the App; it does not download them.

8. Private browser

Websites you visit receive information directly from your device, as in any browser (for example your IP address and what you type on their pages). Their own privacy policies apply.
Text you type in the address bar that is not a web address is sent to Google Search, governed by Google's Privacy Policy.
The App does not keep browsing history, cache, cookies or site data; they are erased when you close a tab or the App. Cross-site cookies are blocked. Bookmarks you save are stored only on your device.
We do not see, collect or store anything you do in the browser.

9. Support emails

If you tap Contact us, your mail app opens a draft that includes your device model, iOS or Android version, App version and language, to help us answer. You can read and edit the draft and choose whether to send it. We use your email only to reply to you and keep it for up to 2 years. Please never send us your setup keys, codes or passwords.

10. Android: QR scanning by Google ML Kit

On Android, the App reads QR codes with Google ML Kit, which runs on your device. The camera images and the codes it reads stay on your device. Separately, ML Kit sends Google diagnostic and usage data about the scanner itself, as Google describes in its ML Kit data disclosure:

device information (such as manufacturer, model and Android version) and the App's package name and version;
performance metrics, scanner settings, event types and error codes;
a per-installation identifier that is not intended to identify you or your device.

Google says this data is encrypted in transit and not transferred to third parties. It never includes your setup keys, codes, passwords or the content of the QR codes you scan, and we never receive it. Google's handling is governed by Google's Privacy Policy. The iPhone and iPad App uses Apple's built-in scanner and sends nothing.

11. Third parties

We do not share or sell personal information to anyone, and the App contains no analytics or tracking code of ours. The only outside services involved are: Apple (App Store, iCloud, Face ID / Touch ID) on iPhone and iPad; Google Play and Google ML Kit (section 10) on Android; the websites you open in the private browser; and Google Search when you search from the browser.

12. Deleting your data

Because we do not hold any of your data, you stay in control of all of it:

On your device — delete individual accounts or passwords in the App, or delete the App to remove everything stored by it on that device. On Android you can also clear the App's storage in the system settings.
In iCloud (iPhone and iPad) — turn off iCloud Sync & Backup in the App, then remove the App's iCloud data in Settings › [your name] › iCloud › Manage Account Storage (or Manage Storage) on your iPhone or iPad.
Backups and exports — delete any backup or export files you saved.
Support emails — ask us at maixuantruongcvdev@gmail.com and we will delete your messages within 30 days.
ML Kit diagnostics (Android) — this data is held by Google, not by us; see Google's Privacy Policy for your choices.

13. Your rights

Depending on where you live (for example under the GDPR, UK GDPR, CCPA/CPRA, LGPD or Vietnam's personal data protection law), you may have the right to access, correct, delete or restrict the processing of your personal data, to withdraw consent and to complain to a data protection authority. Since the App does not send us personal data, most requests can be handled directly in the App or in iCloud as described above. For anything else, email us and we will respond within 30 days.

14. Children's privacy

The App is not directed at children under 13 (or the minimum age in your country) and does not knowingly collect personal information from anyone, including children.

15. Changes to this policy

If the way the App handles data changes, we will update this page with a new "Last updated" date before the change takes effect and, for material changes, tell you in the App's release notes.

16. Contact us

MxT APP (Truong Mai)
Email: maixuantruongcvdev@gmail.com
We reply within 30 days, usually much sooner.