Privacy Policy

TwoFac is built with a privacy-first mindset. This policy explains how we handle your data (or rather, how we don't).

No Data Collection

The TwoFac application (including mobile, desktop, CLI, and wearable versions) does not collect, store, or transmit any personal data, usage statistics, or crash reports to any central server. We do not even have a central server for the core functionality of the application.

Local-First Architecture

All two-factor authentication (2FA) code generation happens entirely offline on your device. Your secrets (the keys used to generate codes) are stored locally on your device and are encrypted with a passkey of your choosing.

Sync and Backups

TwoFac supports end-to-end encrypted sync and backups. When you use these features, your data is encrypted on your device before it is transmitted. Nobody—not even the developer—can read your secrets.

Waitlist Collection

On our website (twofac.app), we provide a form to join a waitlist for updates. If you choose to sign up, we collect your name and email address. This information is used solely to send you occasional updates about TwoFac and is never shared with third parties.

Open Source

TwoFac is fully open source. You are encouraged to review the source code on GitHub to verify our privacy and security claims.

Contact

TwoFac is developed by Arnav Gupta. If you have any questions about this privacy policy, you can reach out via GitHub.