App: “Authenticator App - 2FA & MFA” on Google Play (authenticator.app.two.factor.otp.mfa.code), called Authix in this policy · Developer: KLapp
Effective date: October 7, 2026
This policy explains what data the Authix Android app and our support mailbox collect, use and share, and what you can do about it. "We" means KLapp, the developer of Authix.
Authix is published on Google Play by the developer KLapp, which decides how the data described here is used (the "controller"). Privacy contact and support: applarik+authix@gmail.com
Authix is an independent app, not made, sponsored or endorsed by any service whose accounts you add to it. You never create an account with us, and we run no server that stores your 2FA accounts or keys (except anything you put in a message to us, section 7, which you should never do). We keep copies of support e-mails (section 7). App analytics and purchase records stay with Google and Apphud (section 6); we keep no copy of our own.
The app does not send your 2FA keys, codes, account names or issuers (the service that gave you the key, such as your bank) to us, to ad networks, or to analytics, crash-reporting or subscription services. They leave the phone only in the ways you choose (section 3) or in anything you write to us yourself (section 7). Codes are calculated on the phone.
Only in the ways you choose. Two are encrypted: Google Drive sync (section 5) and a backup file, locked with your password and kept wherever you save or send it until you delete it, even after you uninstall Authix. Nobody, including us, can recover a lost backup or sync password, and anyone who obtains such a file can try to guess its password, so choose strong ones. You can also show one account's key, or a QR code of it, on the screen to copy or scan it yourself; that copy is not encrypted, so keep it private.
Service icons are built into the app and never downloaded, so adding an account sends no request to the service concerned.
These parties receive data from the app or in connection with it, as each service's published disclosure lists. Apart from your encrypted sync files (section 5) and what you write to us (section 7), none receives your keys, codes, account names or issuers.
Google's consent tool (User Messaging Platform)
Google Analytics for Firebase
Google Ads
Firebase Crashlytics
Firebase Remote Config and Cloud Messaging
Apphud Inc.
Google Play
Google Drive
Gmail and support tools
Telegram
Time check
Authorities
We do not sell your data for money. Google Analytics and Google Ads use data from the app to measure our ads and build audiences for them (section 6.2), which some US state laws call "selling" or "sharing" (section 15).
The app shows no ads and contains no ads software. At each launch the app asks Google's consent tool whether a consent message applies where you are (for example the EEA, the UK or Switzerland) and shows it if so; your answer decides how Google Analytics and Google Ads may use data from the app for advertising (section 6.2). How Google uses data from apps that use its services: https://business.safety.google/privacy/.
Events we record: setup steps; offers shown, trials, purchases (value, currency, transaction ID), restores, renewals, expiries and refunds, some reported by Apphud's servers; how each account was added (for example by scan, backup or sync), never which account; feature demonstrations and waits; backups turned on; consent choices; notification permission choices, notification opens and reminder settings; whether you have a paid plan; the app's language; which version of an offer test you see; whether a trial is still active an hour after it starts; crashes and errors. Trial events may carry a value we estimate for ad measurement, which is not an amount you paid. Your answers to the onboarding question about which accounts you use stay on the phone.
User ID. At every launch the app sets the Analytics user ID to the random user ID Apphud assigns, and Apphud receives the Analytics app-instance ID.
Consent. Where the consent message applies, Analytics treats ad storage, use of your data for advertising and ad personalisation as not allowed until you answer, then follows your answer. Where no consent is required, they are allowed unless you chose otherwise earlier. Analytics starts collecting once the consent tool has answered whether a message applies (or after a few seconds if it does not answer), without waiting for your answer to the message; crash reporting runs from the first launch.
Google Analytics Advertising Features. We link Analytics with Google Ads and Google Play, with personalised advertising on, and Google signals is on for our Analytics property. Google Ads uses this to tell which ads led to installs, trials and purchases, and to build remarketing audiences, for example to show our ads again to people who used the app. To do so, Google Analytics and Google Ads use the first-party identifiers set in the app (app-instance ID, user ID) together with Google's advertising identifier (the advertising ID). With Google signals on, for people signed in to Google who have turned on Ads Personalization, Google can associate this activity with its own account data to enrich aggregated Analytics reports. To opt out: Settings → Privacy settings in Authix where the consent message applies, the advertising ID controls in section 9, or Google's Ad Settings (https://adssettings.google.com).
No copy of our own. We do not export Analytics events to a database of our own. We read them in Google Analytics, and compare totals with Apphud and with Google Play's financial reports to check revenue and measure our ads. If we start keeping such a copy, we will add it to this policy first.
Apphud Inc. runs our subscriptions: what you are entitled to, purchases and restores, offers (which can depend on your country and on earlier trials and purchases) and their tests, and Google Play's notices of renewals, payment problems, cancellations and refunds. It receives random Apphud user and device IDs; the device's Android ID, to recognise purchases on this phone; your IP address; phone and app details (manufacturer, model, Android and app version, language, country, time zone, install date and the store the app came from); purchase details (order ID, product, price, currency, period, Play purchase token, time, offer); when an offer is shown and when you start or cancel a purchase; the Analytics app-instance ID; a notification token; and diagnostics for its software. It does not receive your advertising ID or app set ID. Apphud's servers also send subscription events to Google Analytics.
Google Analytics and Google's consent tool collect the Android advertising ID. We use it for advertising (measuring our ads and building audiences in Google Ads, section 6.2), including ad fraud prevention, and for analytics, where Analytics records it with an app-instance ID and a random user ID that Apphud assigns and the app sets in Analytics (section 6.2). We honour Android's "opt out of ads personalisation" setting; you can reset or delete the ID in Settings → Privacy → Ads. Resetting or deleting it does not change the random user ID the app uses for Analytics and Apphud (section 6.2), so earlier analytics and purchase records stay linked to that ID.
We do not receive the app set ID; Google's consent tool collects it (section 6). We do not use it for ads personalisation or ad measurement, or connect it to the advertising ID or to personal data for advertising.
Codes, the time check, and the sync and backup you choose; subscriptions and purchases; backup reminders you allow; support
Storing or reading information on your phone for advertising; ad personalisation; measuring our ads in Google Ads and building audiences
Analytics, crash reports, tests of our offers, fraud prevention
Tax and accounting records; data requests and lawful requests
We keep personal data only for as long as we need it for the purposes in this policy. On your phone, accounts stay until you delete them, use "Delete all data" or uninstall; deleted accounts stay in "Recently deleted" for at least 7 days unless you delete them permanently. After an account is deleted for good, the app keeps a deletion record (a one-way fingerprint of its key, deletion and revision details and a random ID of the phone, never the key), and deleted folders stay as records too, so that sync does not bring them back. Current deletion records and deleted folders also travel in your encrypted sync files; older deletion records stay only on the phone until the app's data is cleared or Authix is uninstalled. Sync files and backup files stay where they are until you delete them. We keep support e-mails and the notifications about them until you ask us to delete them. We set Google Analytics to keep event-level data for 14 months; this does not limit Google's aggregated reports, and we keep no copy of our own (section 6.2). Crashlytics keeps crash reports for 90 days before Google starts deleting them. Data held by Google (https://policies.google.com/privacy) and Apphud (https://legal.apphud.com/privacy) is kept under their own policies.
On your phone. "Delete all data" (Backup → "Delete all data", never behind a payment) deletes your accounts and keys, "Recently deleted", locked copies kept after a forgotten PIN, links and pictures waiting to be added, and, if the phone is online and signed in to that Google account, this phone's sync file in Google Drive; if it cannot delete that file, the app tells you. It does not delete other phones' sync files, backup files you exported, the app's other settings and records on the phone (such as your subscription status and reminder, rating and notification settings) and the identifiers and consent choices the services in section 6 keep there, or data those services or we already hold. Uninstalling removes everything the app keeps on the phone, but not your backup files or sync files.
Neither deleting data nor uninstalling cancels a subscription. Cancel it in Google Play's subscriptions, which the "Subscription" row in the app's menu opens.
Data we and our service providers hold. Write to applarik+authix@gmail.com to access or delete your data. We delete what we can associate with you (for a purchase, include the Google Play order number; for other records we tell you what we need to find them) and reply within one month. Google keeps its own purchase records under its policies.
Accounts sit in a Keystore-protected encrypted database; backup and sync files are always encrypted with your password, which we never have. The app's own connections, to Google Drive and to the web server it uses to check the time, are encrypted (HTTPS); the app never checks the time over the unencrypted network time protocol (NTP). Access to our Analytics data and support e-mails is limited to us and our service providers. No method is perfectly secure: without a backup, sync or another phone, nobody, including us, can recover your accounts.
Authix is meant for adults and is not directed to children under 13. We do not knowingly collect personal data from children. If you believe a child has used the app or sent us personal data, write to us and we will delete what we can find.
Google (Analytics, Ads, Firebase and its consent tool), Apphud, Telegram and our support tools process data in the United States and other countries. Google relies on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, and Apphud on the 2021 Standard Contractual Clauses and UK Addendum; support messages and their notifications are transferred as needed to answer you. You can ask us for information about these transfers and a copy of the safeguards at applarik+authix@gmail.com.
EEA and UK: you can ask to access, correct, delete, restrict, object to or port your personal data, withdraw consent at any time, and complain to your data protection authority. You can object at any time to our use of your data for direct marketing, including related profiling, by writing to us; we then stop that use. United States: depending on your state, you may have the right to know, access, correct and delete your personal information, and to opt out of its "sale" or "sharing" for targeted advertising, without being treated differently. To opt out, use Settings → Privacy settings where our privacy message applies to you, or write to us; Android's advertising ID controls (section 9) are additional and do not by themselves exercise these rights. To use your rights or appeal our decision on a request, write to applarik+authix@gmail.com; where the law allows, an authorized agent may ask for you. We reply within one month.
We post each new version here with a new effective date. Before the app uses your Google Drive data in a new way, it asks for your agreement.
KLapp, developer of Authix: applarik+authix@gmail.com.