Privacy Policy

1. Scope

This policy covers the Autheris apps for iPhone, iPad, Mac and Apple Watch, and the website at autheris.app, both operated by Hunter Eddington (“I”, “me”, “the developer”). It does not cover Apple’s App Store, iCloud or CloudKit, which are governed by Apple’s own privacy policy.

2. This website

This site is a set of static files. It has no accounts, no forms, no comment system and no advertising, and it does not set cookies. Apart from the Umami analytics script described below, and the Three.js library that draws the homepage animation on larger screens (loaded from the jsDelivr CDN), every font, script and image is served from this domain.

To see which pages are useful, this website (not the app) uses Umami Cloud, a privacy-focused, cookieless analytics service. For each page view it records the page address, the referring site, your browser, operating system, device type, screen size, language and country. It does not use cookies or browser storage, does not store your IP address, and does not follow you across other websites, and it is not used to identify you. Only aggregate counts are shown to me. The data is processed by Umami Software, Inc. as described in the Umami privacy policy. You can block the script with a content blocker and the site works the same.

Like any website, the hosting provider that serves these files processes standard request data (IP address, user agent, timestamp, requested path) in order to deliver the page and protect the service from abuse. That data is held by the hosting provider, is not used by me to identify visitors, and is not combined with anything else.

One convenience feature stores a preference — the light or dark appearance you choose — in your browser’s localStorage. It never leaves your device, and clearing your browser storage removes it.

3. The Autheris app

Autheris collects no personal data. Specifically:

• No account, email address, phone number or name is requested or transmitted.
• No analytics, crash reporting, advertising or attribution SDK is included.
• No usage data, device identifiers or advertising identifiers are transmitted.
• Nothing is sold, rented or shared with data brokers — there is nothing to sell.

What the app does keep is entirely local to your device:

• Your tokens and their setup keys are stored as JSON in the device Keychain using kSecAttrAccessibleWhenUnlockedThisDeviceOnly — the data protection Keychain on the Mac. They are readable only by Autheris, only while the device is unlocked, and they are excluded from iCloud Keychain and from encrypted device backups.
• Recently Deleted keeps a deleted code in the Keychain, under its own account, for up to 7 days so that a wrong tap can be undone. “Delete Now” and “Delete All” remove it immediately.
• Preferences such as Face ID lock, blur behaviour, recording protection and your sort order are stored on the device as well.

The Apple Watch app keeps its own copy of your codes. It is fed by the iPhone it is paired with: once the watch app is installed, your iPhone sends it the current list over Apple’s Watch Connectivity framework, and the watch writes that list to its own Keychain with the same kSecAttrAccessibleWhenUnlockedThisDeviceOnly protection the iPhone uses. The watch is read-only — there is no copy, no editing and no settings there, so a code is never added, changed or deleted on the watch. Before the watch app is installed, nothing is sent at all, and deleting the watch app removes its copy from the watch.

4. Optional iCloud Sync

iCloud Sync is off by default, and it is a per-device choice. It is the only feature that sends your tokens anywhere, and when it is off CloudKit is never contacted.

When you turn it on:

• Records are written to the private CloudKit database associated with your own Apple ID. That database is scoped to you; the developer cannot query it, browse it or read it.
• Labels, account names, secrets, countdown-ring colours and pin flags are written through CloudKit’s encrypted fields, so CloudKit encrypts them end to end with keys managed on your behalf. They are not visible in the CloudKit dashboard.
• Only non-secret metadata is stored as plain fields: modification timestamps, a deleted flag, a SHA-256 fingerprint used for change detection, the algorithm, digit count and period of each code, whether a code is time- or counter-based, and how many times a counter-based code has been used. None of those reveal a secret.
• Deleting a token replaces its record with a tombstone whose encrypted fields are cleared, so the secret does not linger in iCloud after you delete it.
• Turning sync off prompts you to either keep the codes on the device or delete the iCloud copy first. Deleting the copy also removes the codes from your other devices.

Apple processes this data as the provider of iCloud and CloudKit. See Apple’s Privacy Policy for how Apple handles it.

5. Backups you export

Autheris can write an encrypted backup file (AES-256-GCM, protected by a password you choose) or a QR code export. Those files are created only when you ask for them, and they go wherever you send them — the Files app, another device, a cloud drive you control. You are responsible for where they end up and for the strength of the password. A backup file is protected by that password and by wherever you store it; it is not protected by Autheris. A backup Autheris keeps in its own storage is excluded from iCloud Backup and Finder backups of the device, so it only leaves the device when you move it yourself.

6. When the app uses the network

Autheris makes a network request in exactly two situations:

• iCloud Sync, if you have switched it on (see above).
• An optional issuer-logo lookup, which asks a small service for the brand icon of a service you are adding (for example, the name you typed). No tokens, secrets or account identifiers are sent with that request.

Everything else — generating codes, searching, locking, backups — happens offline.

The hand-off to Apple Watch is not one of those requests. The watch app is fed by the paired iPhone over Apple’s Watch Connectivity, which stays between your own devices, and the watch never contacts iCloud or this developer directly.

7. Third-party services

• Apple — App Store distribution, iCloud/CloudKit sync (only if enabled), and the hand-off to Apple Watch (only once the watch app is installed).
• GitHub — hosts the public source code and issue tracker.
• The website’s hosting provider — serves these static pages.
• jsDelivr — serves the Three.js library for the homepage animation on larger screens.
• Umami Cloud — cookieless page-view analytics on autheris.app only, never in the app.
• The logo-lookup service — described above, and only for issuer icons.

No other third party receives data from the Autheris app, because no other data leaves it.

8. Your choices and rights

• Access and portability: everything the app holds is on your device and exportable from Settings → Backup.
• Deletion: deleting a code (or the app) removes it from your device. If you enabled iCloud Sync, use Settings → iCloud Sync → Delete Tokens from iCloud to remove the copy from your Apple ID.
• Withdraw sync: switch iCloud Sync off at any time; nothing further is uploaded from that device.
• No profiling: because no personal data is collected, there is no profile to opt out of.

9. Children

Autheris is a general-purpose security tool and is not directed at children. It does not knowingly collect any information from anyone, including children.

10. Changes to this policy

If this policy changes, the “last updated” date at the top of this page changes with it. Material changes will also be noted in the release notes for the affected version.

11. Contact