Keyora Authenticator

📋 1. Overview & Scope

Keyora Authenticator ("Keyora", "the App", "we", "us") is a privacy-first two-factor authentication (2FA) application. This Privacy Policy applies to the Keyora Authenticator Android application available on the Google Play Store.

Keyora is designed from the ground up to operate without any backend infrastructure. There are no user accounts, no registration process, no cloud storage, and no remote servers of any kind associated with this app.

🚫 2. Data We Do NOT Collect

Keyora does not collect, transmit, store remotely, or share any of the following:

• Personal identifiers (name, email address, phone number, IP address)
• Your 2FA / TOTP / HOTP secrets or one-time codes
• Account names, issuers, or labels you add to the app
• Device identifiers, advertising IDs, or fingerprints
• Location data (coarse or precise)
• Usage analytics, crash reports, or diagnostic data
• Contacts, photos, files, or any other media
• Biometric data of any kind
• Purchase or payment information

🔐 3. Data Stored On Your Device Only

To function as an authenticator, Keyora stores the following information exclusively on your device using Android's encrypted secure storage (backed by the Android Keystore system):

• 2FA account entries — issuer name, account label, secret key, algorithm (TOTP/HOTP), digits, and period.
• App settings — app lock preference, biometric unlock toggle, auto-lock timer, theme choice, clipboard auto-clear, and other UI preferences.

This data is encrypted at rest using AES-256 via Android's EncryptedSharedPreferences / Keystore. It is never written to external storage, iCloud, Google Drive, or any remote service.

The Android home-screen widget displays only masked account names (never live codes or secrets) and is populated from the same encrypted local store.

📱 4. Android Permissions Explained

Keyora requests only the permissions necessary for its core features:

📦 5. Third-Party Libraries & SDKs

Keyora uses open-source Flutter packages. None of these packages connect to external servers or collect personal data in the context of this app:

• flutter_secure_storage — encrypted local key-value storage (no network).
• mobile_scanner — camera-based QR code scanning (no network, no image retention).
• local_auth — biometric authentication via Android Biometric API (on-device only).
• otp — TOTP/HOTP code generation algorithm (purely mathematical, no network).
• home_widget — Android home-screen widget bridge (local IPC only).
• cryptography / cryptography_flutter — AES encryption for backup files (local only).
• connectivity_plus — monitors device network connectivity (does not transmit data).
• sensors_plus — accelerometer for shake-to-scan gesture (local sensor, no data stored).

We do not integrate any advertising SDKs, analytics platforms (e.g., Firebase Analytics, Crashlytics, Mixpanel), or social login providers.

💾 6. Backup, Export & Import

Keyora supports importing 2FA accounts from Google Authenticator, Aegis, and 2FAS. All import processing happens entirely on-device:

• Google Authenticator transfer QR codes are decoded locally — no data is sent externally.
• Aegis (.json) and 2FAS (.2fas) backup files are parsed locally.
• No backup or export is automatically uploaded anywhere. If you manually move an export file to a cloud storage service, that is governed by that service's own privacy policy.

👶 7. Children's Privacy

Keyora is not directed at children under the age of 13. We do not knowingly collect personal information from children. Since no personal data is collected from any user, there is no special risk to minors from using this app.

🛡️ 8. Data Security

All 2FA secrets are stored using Android's EncryptedSharedPreferences, leveraging AES-256-GCM encryption backed by the Android Keystore hardware security module where available.

Additional security features built into the app include:

• Optional App Lock with biometric or device-credential authentication.
• Auto-lock after configurable inactivity timeout.
• Lock-on-background — app locks immediately when sent to background.
• Screenshot protection (FLAG_SECURE) to prevent screen capture of OTP codes.
• OTP code masking (hidden by default, tap to reveal).
• Clipboard auto-clear after a configurable timeout.

Because no data is transmitted to external servers, there is no server-side data breach risk associated with Keyora.

⚖️ 9. Your Rights & Data Control

Because all data exists exclusively on your device, you have complete control at all times:

• Access: All your accounts are visible inside the app at any time.
• Deletion: Delete individual accounts within the app, or uninstall to erase all data permanently.
• Portability: Use the in-app export feature to back up your accounts.
• No opt-out needed: Since we collect nothing, there is nothing to opt out of.

We cannot access your data remotely, and we cannot recover it if you uninstall the app or lose your device. Please keep your own backup.

🔄 10. Changes to This Policy

We may update this Privacy Policy from time to time. The most current version will always be available at the URL linked in the Google Play Store listing. We will update the "Last updated" date at the top when changes are made.

Continued use of the app after changes constitutes acceptance of the updated policy. Material changes will be noted in the app's Play Store release notes.