Authenticator — Privacy Policy

AUTHENTICATOR PRIVACY POLICY

Last Updated: October 24, 2026

1. WHO WE ARE

This Privacy Policy applies to the Android app Authenticator: 2FA Codes ("Authenticator", "the app"; package com.billionx.authenticator), published by BILLIONX LABS LIMITED (BillionX, "we", "us"). BILLIONX LABS LIMITED is the controller of the personal data described here. Contact: support@billionx.co or billionx.co.

2. WHAT THE APP DOES ON YOUR PHONE

The app keeps your two-factor (2FA) codes, your saved passwords and your private browser data on your phone. Your 2FA secrets and passwords are never sent to us in a readable form. They leave your phone in a readable form only if you choose to export or share them, or to fill a login into another app (see below).

Your 2FA secrets and passwords

Stored encrypted on your phone. The secret behind each 2FA code and every saved password are kept in a database that is encrypted with a key held in the Android Keystore.
Not in Android backups. The app turns off Android's cloud and device backup for its data (allowBackup is off), so your secrets do not end up in a Google backup.
Hidden from screenshots. The code, PIN and QR export screens are hidden from screenshots and the recent apps view.
Not readable by us. Unless you choose to export or share them (for example a QR export or the share sheet) or to fill them into another app with Autofill, your secrets and passwords do not leave your phone in a readable form. The only copy that leaves it by itself is the optional encrypted sync described below.
App lock. You can lock the app with a PIN and, if your phone supports it, fingerprint or face unlock (Android biometric prompt; we never receive your fingerprint or face data). If you forget your PIN, resetting it erases the data stored on that phone.

Sync (optional)

Sync is off until you sign in with Google. If you turn it on, your codes and passwords are encrypted on your phone, using a key derived from your PIN or password, before anything is uploaded. This is end-to-end encryption: the BillionX server (Cloudflare) stores only the encrypted data and your account details (the email address, name and account ID from your Google sign-in). We cannot read your codes or passwords. If you forget your PIN we cannot recover your data: without your key, the synced copy cannot be decrypted by you or by us. Keep your own export or backup of important codes.

Leaked password check

The "Leaked data" check asks whether a password appears in known data breaches. This check is part of Premium and is off until you turn it on. Before it starts, the app shows what leaves your phone and asks you to tap Agree. When it is on, the app computes a SHA-1 hash (a one-way fingerprint) of the password on your phone and sends only the first 5 characters of that hash, straight from your phone to the public breach-check service at api.pwnedpasswords.com (Have I Been Pwned). Our server never receives it. The service returns the list of fingerprints that start with those 5 characters, and your phone compares them locally. The password itself and the full hash never leave your phone. The service is operated by a third party that we do not control; like any web request, the request reaches it together with your phone's IP address, and it has its own privacy practices. You can turn the check off at any time.

Autofill

If you enable the Authenticator Autofill service in Android settings, the app fills a saved login into the other app only when you choose its suggestion, so that login is handed to that app at your request. It does not read the content of other apps beyond the fields Android offers to the autofill service for that request, and it sends nothing to us.

Private browser

The built-in browser keeps history, bookmarks and tabs on your phone only. We do not receive your browsing history, and it is not part of sync.

Camera and photos

The camera permission is asked for only when you choose to scan a QR code, after an explanation screen. The camera image is read live on your phone to find the QR code and is not saved or uploaded. "Upload screenshot" uses Android's own photo picker: the app receives only the image you pick, reads the QR code in it on your phone and does not keep it. "Import from file" reads only the file you choose. The app does not ask for access to your whole photo library.

Other features

Sharing a QR export or a code opens Android's share sheet and sends it only to the app you choose. "Contact us" in Settings opens your email app with a draft that includes your phone's make, model and Android version and the app version; nothing is sent until you send the email.

3. INFORMATION SENT TO GOOGLE SERVICES (FIREBASE)

The app uses Firebase from Google LLC (Google Analytics for Firebase, Crashlytics, Remote Config and Firebase Installations) for usage statistics, remote settings and crash reports. Google acts as our processor. This data never includes your 2FA secrets, codes, passwords, account names, browsing history or file names.

App interactions: which steps and screens you reach (onboarding page, permission prompts and whether you allowed them, code added by scan, manual entry, screenshot or file, folder used, lock turned on, sync turned on, password created, leaked-data check used, browser opened, subscription screen shown or closed, restore result), plus your plan (free, trial or Premium) and the week you installed. Why: to understand how the app is used and improve it.
Purchase events: product, price, currency and transaction ID when you buy or start a trial. Why: to measure revenue and the results of our own ads.
Crash logs and diagnostics: stack traces, device model, OS version and app state at the time of a crash (Crashlytics, release builds). Secrets and passwords are never attached. Why: to find and fix crashes.
Device and app identifiers: Firebase installation ID, app instance ID, app version, device model, OS version, Crashlytics installation ID, language, time zone, country, and an approximate location derived by Google from your IP address (the IP address itself is masked). Why: to count users, deliver remote settings and tests, and support you.
Advertising ID: a resettable ID from Google Play services (the app declares the AD_ID permission). Why: to measure whether our ads led to a purchase, and for usage statistics.
Install source: the Firebase measurement library may read the install referrer from Google Play (which campaign led to the install). Why: to measure our ad campaigns.

The Firebase library also adds the Android permissions ACCESS_ADSERVICES_ATTRIBUTION and ACCESS_ADSERVICES_AD_ID (Android ad-measurement services); we do not use them for anything beyond that measurement.

No ads in the app. The app shows no ads. We may run ads for the app elsewhere (for example Google Ads), and the data above is used to measure those campaigns. We do not use it to build advertising profiles of you inside the app, and we do not sell your data. You can reset or delete your Advertising ID in Android settings (Settings, Privacy, Ads); if you delete it, apps receive zeros.

Remote settings. The app downloads settings from Firebase Remote Config (for example how many codes are free). Google receives the identifiers above to do this. New settings apply the next time the app starts.

Firebase's own description of what these libraries collect: firebase.google.com/docs/android/play-data-disclosure and support.google.com/analytics/answer/11582702.

4. YOUR ACCOUNT AND THE DATA WE HOLD

If you sign in with Google, we receive your email address, name and Google account ID, used to create your account, find your encrypted sync data and answer support requests. We hold the encrypted sync data (which we cannot read) and basic records needed to run the service, such as when it was last updated, and subscription status from Google Play. We also keep a list of the devices signed in to your account for sync: a random ID the app creates on each install and the phone model name, so you can see and remove your devices. Signing in is optional: without it, nothing about you is stored on our server.

5. PURCHASES

Subscriptions (weekly, with a 3-day free trial for eligible users, or yearly) are sold and paid through Google Play. Google handles your payment details; we never see your card number. The app asks Google Play whether you are subscribed (status, plan, renewal) and keeps a cached copy on your phone so Premium features unlock; if you are signed in, our server also receives subscription status updates from Google Play so Premium works on your other phones. Manage or cancel in Google Play (see our Terms of Use). The in-app rating box, if shown, is Google Play's: we do not receive your rating or text from it.

Consent form. If you are in the European Economic Area, the United Kingdom or Switzerland, the app asks for your consent the first time you open it, using Google's User Messaging Platform (the consent form provided through Google AdMob; the app shows no ads). Google determines whether the form applies to you, mainly from your approximate location based on your IP address, and stores your choice on your phone in the standard IAB TCF format.

What your choice controls. We pass your choice to Google Analytics for Firebase as follows: consent to "store and/or access information on a device" allows usage statistics; together with consent to "measure advertising performance" it allows ad-measurement data; consent to "create and use a personalised ads profile" allows ad personalisation. If you do not consent, close the form without choosing, or the form cannot be loaded, these signals stay off for you. Crash reports stay on, because we need them to keep the app working and secure. Sync and the leaked-password check do not depend on this choice: they work only when you use them (the leaked-password check only after you turn it on).

Changing your choice. You can change or withdraw your consent at any time in the app: Settings, Privacy choices.

Everywhere else, the consent form is not shown, and usage statistics and ad measurement are on.

Legal bases (GDPR / UK GDPR): your consent (Art. 6(1)(a)) for usage statistics and ad measurement in the regions above; our legitimate interest (Art. 6(1)(f)) for crash reports needed to run and secure the app; performance of a contract (Art. 6(1)(b)) for your account, sync and purchase handling.

7. HOW LONG DATA IS KEPT

On your phone: until you reset the app after a forgotten PIN, clear the app's storage or uninstall.
Account, device list and encrypted sync data on our server: until you delete your account (Section 8).
Google Analytics for Firebase: event-level data is deleted automatically after the retention period set in our project, which is never longer than 14 months (Google's retention options).
Crashlytics: 90 days for crash traces and the associated IDs, then removal from Google's live and backup systems (firebase.google.com/support/privacy).
Firebase installation ID (also used by Remote Config): kept until deletion is requested; Firebase then removes the data within 180 days (same page).
Purchase records: kept by Google Play under Google's terms.

8. DELETING YOUR ACCOUNT AND YOUR DATA

Deleting your account. In the app: Settings, Account, Delete account. This deletes your account, your device list and your encrypted sync data from our server and signs you out. You can also write to support@billionx.co with the subject "Delete my account" from the email address you signed in with; we complete it within 30 days. Deletion steps and what is kept are on our account deletion page (billionx.co/authenticator-account-deletion/). Deleting your account does not erase codes already on your phones and does not cancel a subscription.

Data on your phone. Uninstalling the app removes everything it stores on that phone. Resetting the app after a forgotten PIN also erases its data on that phone. Data already received by Google follows Section 7.

Your rights: access, deletion, objection, withdrawal of consent and the right to complain to your data protection authority apply where your local law gives them.

9. CHILDREN

The app is for people 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has used the app, contact support@billionx.co and we will act on it.

10. SECURITY AND INTERNATIONAL TRANSFERS

Data sent to Google and to our server is encrypted in transit (HTTPS/TLS). Your secrets are additionally encrypted on your phone, and synced data is end-to-end encrypted, but no system is completely secure and we cannot promise it. Google and Cloudflare may process data in countries other than yours under their own transfer safeguards.

11. CHANGES

We may update this policy. The new date appears at the top; for material changes we will show a notice in the app.

12. CONTACT

For privacy questions or requests, contact BILLIONX LABS LIMITED (BillionX) at support@billionx.co. See also our Terms of Use and account deletion page.