Privacy Policy

HackProof Authenticator ("the App," "we," "our") is a privacy-first security toolkit for iPhone and iPad. This Privacy Policy explains what data the App accesses, how it is used, and — critically — what we do not collect or share.

By using the App you agree to this policy. If you do not agree, please discontinue use and delete the App from your device.

• No name, email address, phone number, or any personally identifiable information
• No browsing history, app usage analytics, or behavioral data
• No device identifiers (IDFA, IDFV, serial numbers)
• No location data, even approximate
• No contact lists, photos, or any other media
• No health or financial data
• No crash reports sent to our servers
• No advertising identifiers of any kind

Photo Vault stores all protected media exclusively on your device using iOS-level encryption. No images, thumbnails, or metadata are ever transmitted to our servers or any third party.

📷 Camera — Intruder Detection

When you lock HackProof Authenticator with a passcode or biometrics, the App can silently capture a photo of anyone who enters the wrong PIN — a feature designed to catch unauthorized access attempts on your device.

• The camera is activated only on a failed unlock attempt — never in the background or without your prior consent
• Captured intruder photos are saved locally on your device only, inside the App's protected storage
• No intruder photo is ever uploaded, transmitted, or accessible to us
• You can view, download, or permanently delete these photos at any time from within the App
• iOS will display a camera permission prompt the first time this feature is enabled — you remain in full control

🖼️ Photo Library — Hide & Protect Media

Photo Vault lets you move photos and videos from your iOS Photo Library into a private, encrypted vault inside the App so they no longer appear in your standard gallery.

• Access to your Photo Library is requested only when you choose to import or export media — never automatically
• You select exactly which photos or videos to protect; the App never scans or reads your full library
• iOS grants access only to items you explicitly select, using Apple's privacy-preserving photo picker
• Once imported, media is encrypted at rest and stored inside the App's sandboxed local storage
• No media file, thumbnail, or EXIF metadata is ever sent off your device
• You can restore media back to your Photo Library or delete it permanently from the vault at any time

Deleting the App permanently removes all vaulted media from your device. We strongly recommend exporting any photos or videos you want to keep before uninstalling.

HackProof Authenticator offers an optional encrypted iCloud backup for your TOTP accounts, so you can seamlessly restore and use your 2FA codes across all your Apple devices (iPhone, iPad, Mac) without manually re-scanning QR codes.

• iCloud backup is strictly opt-in — it is off by default and you must explicitly enable it in Settings
• All TOTP secret keys are end-to-end encrypted on your device before being written to iCloud — we never see the plaintext keys
• The encryption key is derived from your device credentials and never leaves your Apple account's secure enclave
• iCloud sync is governed by Apple's iCloud privacy policy — we have no access to your iCloud storage
• Only your 2FA account names and encrypted secrets are backed up — no passwords, vault media, or personal information are included
• You can disable iCloud backup and delete the backup data at any time from Settings → 2FA Backup → Disable & Delete

Even with cloud backup enabled, your 2FA secret keys are mathematically inaccessible to us. The encryption happens entirely on your device. We cannot restore, read, or share your backup even if compelled to do so.

When you use the Breach Check tool, the App may use an email address you provide to query a third-party breach database (such as Have I Been Pwned).

• Your email address is hashed or anonymized before the query is sent — the raw address is never transmitted over the network
• The email is used solely and only for the single breach lookup you initiate
• We do not store, log, or retain your email address on any of our servers
• Your email is never used to contact you, market to you, or identify you
• You are in complete control — you choose when and whether to run a breach check

The breach database API receives only an anonymized partial hash of your email — never the full address. This is a well-established privacy-preserving technique (k-Anonymity) used by leading security services.

Certain features of the App store data on your device to function:

Delete your data anytime. You have full control. Go to Settings → Delete Account inside the App to permanently erase all locally stored information. Deleting the App from your device also removes all data.

The App may request the following iOS permissions. Each is used only for the feature described — never for tracking:

All permissions are optional and can be revoked at any time from iOS Settings → HackProof Authenticator. Revoking a permission simply disables the related tool — the rest of the App continues to work normally.

HackProof Authenticator uses a minimal set of third-party services, listed below. None of them receive personal information about you:

We do not use any advertising SDKs, analytics platforms, or third-party tracking libraries. There are no ad networks, no cross-app trackers, and no data brokers involved with this App.

HackProof Authenticator is not directed at children under the age of 13. We do not knowingly collect any personal information from children. Because the App collects no personal information from anyone, it inherently does not collect information from minors. If you believe a child has provided information to the App, please contact us and we will investigate promptly.

Because we collect no personal data, most data-rights requests are satisfied automatically. For completeness:

• Access. All data the App holds is stored on your own device — you already have full access.
• Deletion. Use Settings → Delete My Data in the App, or simply delete the App from your device.
• Portability. Your 2FA accounts and passwords are stored in standard formats — you can export them from Settings.
• Opt-out of notifications. Revoke notification permission at any time in iOS Settings.
• GDPR / CCPA. We do not collect personal data, so there is nothing for us to process, sell, or disclose. These regulations are satisfied by design.

All sensitive data (2FA keys, passwords) stored locally is protected by iOS Keychain encryption and device-level security (Face ID / Touch ID / passcode). The App does not implement its own cryptographic storage — it relies on the battle-tested security architecture built into iOS and iPadOS.

Because no data is transmitted to or stored on our servers, there is no server-side attack surface that could expose your information.

If we ever make material changes to this Privacy Policy, we will post the updated policy at this URL and update the "Effective" date at the top of the page. We encourage you to review this page periodically. Continued use of the App after a change constitutes acceptance of the updated policy.

Our commitment to not collecting your data is a core design decision, not a setting — any change to that principle would require explicit notice and would be a fundamental change to the App's identity.