Privacy Policy

1. Information we collect

• Account information — your email address, and for developers, your name and organisation details.
• Authentication material — device push tokens, paired-device records, and the server-side secrets needed to deliver push approvals and verify one-time codes.
• Encrypted vault data — the TOTP seeds and other secrets an end user stores in the app are encrypted on the device with a key we never receive. We store only ciphertext.
• Billing information — subscriptions are processed by DollarMates via Stripe (or the app stores for in-app purchases). Card details are handled by the payment processor; we do not store full card numbers.
• Technical and usage data — IP address, device and app information, the approximate location shown on a sign-in prompt, and security logs (such as approvals, denials, and API activity) needed to operate and secure the Service.

2. How we use your information

• To deliver push approvals, verify codes, and provide the developer SDK and API.
• To operate billing, enforce plan limits, and prevent abuse.
• To secure the Service — detecting fraud, investigating incidents, and keeping audit logs.
• To communicate with you about your account, security, and service changes.

We do not sell your personal information.

3. Push and verification data

Unlike the end-user vault, the material needed to route a push approval to your device and to verify one-time codes is not zero-knowledge — it necessarily lives on our servers so the Service can function. We keep this data to the minimum needed to deliver authentication and protect it with encryption in transit and at rest.

4. App vault encryption

Secrets an end user stores in the app (such as TOTP seeds) are encrypted on the device with a key derived from the user’s credentials and never transmitted to us. Because we hold only ciphertext, we cannot read these secrets, and neither we nor a developer can recover them if the user loses their device and recovery material.

5. Sharing and third parties

We share information only with service providers who help us run the Service, under contract and only as needed:

• Stripe — payment processing and subscription billing.
• Push providers — Apple Push Notification service and Firebase Cloud Messaging deliver approval prompts to your device.
• Infrastructure and email — hosting, storage, and transactional email providers that operate the Service.

We may also disclose information where required by law, or to protect the rights, safety, and security of our users and the Service.

We do not run third-party website analytics on auth.u2secured.com: no Google Analytics, no advertising or tracking pixels. Audience measurement runs only on our root domain, u2secured.com, and is described in the privacy policy published there.

6. Data retention

We keep personal information for as long as your account is active and as needed to provide the Service, then delete or anonymise it within a reasonable period, except where we must retain it to meet legal, accounting, or security obligations. Security and activity logs are retained on a plan-based schedule.

7. Your rights

Depending on where you live, you may have rights to access, correct, or delete your personal information, and to object to or restrict certain processing. You can delete your account yourself in the app, under Settings; for anything else, contact us and we will respond as required by applicable law.

8. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.

9. Security

We protect your information with encryption in transit and at rest, least-privilege access controls, and audit logging. No system is perfectly secure, but the zero-knowledge design of the app vault means the most sensitive secrets are never exposed to us in the first place.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the “last updated” date above and, where appropriate, notify you. Continuing to use the Service after changes take effect means you accept the updated policy.

11. Contact

Questions about your privacy or this policy? Contact us at support@u2secured.com.