Effective date: 25 July 2026
Authenticator data
The isolated authenticator processes the Base32 secret, selected algorithm, digit count, period, and current device time locally in the browser. These values are not intentionally sent to our servers or stored in browser storage. The page does not include advertising or behavioural analytics.
Basic infrastructure records
Our hosting and security providers may process limited request information needed to deliver and protect the service, such as IP address, date and time, requested path, response status, user-agent information, and security-rule events. The secret must never be placed in a URL, and the application does not do so.
Advertising and cookies
Content pages may display Google AdSense after the site is approved and configured. Third-party vendors, including Google, may use cookies to serve ads based on a visitor's previous visits to this and other websites. Google's use of advertising cookies enables it and its partners to personalise ads where permitted and consented.
Visitors can manage personalised advertising in Google's Ads Settings. Where required, a Google-certified consent-management platform will request and communicate choices before personalised advertising is served. See our cookie policy for exactly what storage is used and how to change your choice at any time.
Messages you send
If you contact us, we process the email address, message, and attachments you choose to send in order to respond, protect the service, and maintain a reasonable record of the conversation. Do not send authentication secrets, passwords, backup codes, or identity documents unless an applicable verified process specifically requires them.
Retention and rights
Infrastructure records should be retained only as long as reasonably needed for security, troubleshooting, and legal obligations. Contact records are retained according to operational need. Depending on location, visitors may have rights to access, correct, delete, restrict, or object to processing of personal information.
Operator details and changes
Before launch, the site owner must add the legal operator name, postal contact, applicable jurisdiction, data-retention schedule, and a monitored privacy email. Material policy changes will be reflected by updating the effective date.