Privacy Policy
Effective date: October 19, 2026
Summary
This Privacy Policy explains how the Authenticator app for iPhone ("the App") handles information. The App is published by Rapid Dijital Hizmetler Limited Şirketi ("Rapid Mobile", "we", "us").
You do not need an account to use the App. We do not ask for your name, email address or phone number.
Verification codes are generated on your device. Your setup keys (secrets), accounts, notes and passwords are never sent to us.
Optional backups are encrypted on your device before they leave it, and we cannot read them.
We use Firebase Analytics for anonymous usage statistics and RevenueCat to process Authenticator Plus subscriptions. We do not show ads, do not sell your data and do not track you across other companies' apps or websites.
Information stored on your device
The following information is created by you and stays on your iPhone. We have no access to it.
Information
Where it is stored
Notes
Accounts (service name, account name, setup key, code settings, icon, tags, websites you add)
iOS Keychain on your device
Included in encrypted iOS device backups and Quick Start transfers to a new iPhone. Not synced to iCloud Keychain.
Secure notes (recovery codes, Wi-Fi passwords, logins, cards, notes)
App storage, encrypted with AES-256
The encryption key is kept in your iCloud Keychain so notes can be opened on your other devices that use the same Apple Account.
App passcode
iOS Keychain, as a salted hash
The passcode itself is never stored.
Settings, password generator history, QR code history
App storage on your device
QR history keeps Wi-Fi, contact, text and email codes only if you turn this on.
Verification codes are calculated on your device from the setup key and the current time (TOTP) or a counter (HOTP), following RFC 6238 and RFC 4226. To keep codes accurate, the App may compare your device clock with Apple's public time server (time.apple.com). This request contains no personal information.
Optional features
These features only run when you choose to use them.
iCloud backup (Authenticator Plus). Your accounts, notes and tags are encrypted on your device (AES-256-GCM) and stored in your own private iCloud database through Apple's CloudKit. We cannot access your iCloud data. A backup can be opened on another device that uses the same Apple Account with iCloud Keychain turned on. You can delete your backups in the App.
File backup and export. The App creates a file encrypted with a password you choose (PBKDF2 key derivation and AES-256-GCM). The file goes only where you save or share it. We never receive it and cannot recover a forgotten password.
Import and device transfer. You can import accounts from QR codes, photos, screenshots and files (for example from Google Authenticator, 2FAS, Aegis, Raivo or andOTP), and move accounts to another device with transfer QR codes. All of this is processed on your device.
AutoFill (Authenticator Plus). When you turn on AutoFill, the App gives iOS the account name and the websites you added to each account, so iOS can suggest the right code. Codes and setup keys are not given to iOS. The AutoFill extension reads your accounts from a protected Keychain area that only the App and the extension can access.
Widgets, Live Activities, Control Center and Siri Shortcuts. These system features never show or speak a verification code. They can show service and account names; you can replace names with "Account 1, Account 2" in Settings.
Password generator and QR code generator. Passwords and QR codes are created on your device and are not sent anywhere.
Clipboard. When you copy a code or password, it is placed on this iPhone's clipboard only (not Universal Clipboard) and can be cleared automatically after a time you choose.
Permissions
Permission
Why the App asks
What happens to the data
Camera
To scan QR codes when you add or import accounts
Images are processed on your device and are not stored or sent.
Photos
To read QR codes from a photo or screenshot you pick, and to save QR codes you create
Only the images you choose are read; nothing is uploaded.
Face ID / Touch ID
To unlock the App, notes and AutoFill if you turn this on
Handled by iOS. The App only receives a success or failure result and never gets your biometric data.
You can change these permissions at any time in iOS Settings.
Third-party services
The App uses a small number of services. None of them receives your accounts, setup keys, verification codes, notes or passwords.
Service
Purpose
Data involved
Privacy policy
Google Firebase Analytics
Anonymous usage statistics that help us improve the App
A random app instance ID, app version, device model, iOS version, language, approximate country or region, and general usage events (for example app opens, screens viewed, purchases started)
RevenueCat
Processing and restoring Authenticator Plus subscriptions
A random user ID created by the App, purchase and subscription status, device and app version information
Apple (App Store, iCloud, StoreKit)
Payments, subscriptions, iCloud backup and app update checks
Payments are handled by Apple; we never see your payment details. The update check sends only the App's identifier and your country code to Apple's App Store lookup service.
lookup service.
Analytics data is not linked to your identity and is not used for advertising. The App contains no advertising SDKs and does not use Apple's advertising identifier (IDFA).
Retention and deletion
Data on your device stays until you delete it. Deleted accounts and notes stay in Recently Deleted for 30 days, then they are removed permanently.
Settings › Erase All Data deletes all accounts, notes, settings and this iPhone's iCloud backup. Deleting the App also removes its data from the device, except Keychain items, which iOS may keep until you erase them in the App or reset the device.
You can delete any iCloud backup in the App's iCloud backup screen. File backups are deleted by deleting the file.
Analytics data is kept by Firebase according to its retention settings and then deleted automatically. Subscription records are kept by RevenueCat and Apple as needed for billing and legal obligations.
Security
Setup keys are stored in the iOS Keychain, and notes and backups are encrypted with AES-256. The App can be locked with a passcode and Face ID or Touch ID, and sensitive content is hidden in the app switcher and during screen recording. No method of storage is completely secure, so please keep your iPhone protected with a passcode and keep a backup of your accounts or recovery codes.
Your rights
Depending on where you live (for example under the GDPR in the EU/UK, KVKK in Türkiye or the CCPA in California), you may have the right to access, correct, delete or object to the processing of your personal data. Because your accounts and notes never reach us, you control them directly in the App. For analytics and subscription data, contact us and we will help with your request. We do not sell or share personal information for cross-context behavioral advertising.
Children
The App is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect personal information from children.
International transfers
Firebase, RevenueCat and Apple may process the limited data described above on servers outside your country, including the United States, under their own safeguards.
Changes to this policy
We may update this policy when the App changes. The effective date at the top shows the latest version. Significant changes will be announced in the App or in the App Store release notes.
Contact
Rapid Dijital Hizmetler Limited Şirketi (Rapid Mobile) Email: info@rapid-mobile.net Support: sites.google.com/view/auth-application-app