IMPORTANT PRIVACY INFORMATION
Authenticator App is an iOS application that generates time-based one-time passwords (TOTP) for two-factor authentication and allows you to store login credentials, passwords, backup codes and optional notes in a local vault on your device. The App also offers an optional iCloud backup, an app lock using Face ID, Touch ID or device passcode through Apple LocalAuthentication, and local checks for weak or reused passwords.
Your authentication records and vault contents, including TOTP secret keys, saved passwords, backup codes and notes, are stored on your device. Orvanta does not maintain a server-side copy of those vault contents. If you enable iCloud backup, sensitive vault fields are encrypted on your device using Apple CloudKit encrypted values before they are uploaded to your private iCloud database. Limited backup metadata may be stored separately as described below. We do not have access to the decrypted vault contents in your private iCloud database.
Separate technical and service-related information may be processed outside your device. Depending on your settings and the technologies enabled in the App, this may include device or advertising identifiers, IP address and approximate location, app usage and event information, attribution data, purchase and subscription information, A/B test assignment, crash logs, diagnostics and support communications. These categories do not include the contents of your local vault unless you intentionally provide information in a support request.
Password-strength and password-reuse checks are performed locally on your device. Saved passwords do not need to be transmitted to our servers or to a third-party password-analysis service for these checks. Face ID and Touch ID authentication is handled by Apple LocalAuthentication; the App receives the result of the authentication attempt rather than your biometric template or biometric scan data.
Authenticator App does not display third-party advertisements inside the App and does not send marketing emails or push notifications as part of the current implementation described in this Policy. We may nevertheless advertise the App through external platforms and use attribution and advertising-measurement technologies to understand which campaigns lead to installs, trials, subscriptions or other relevant events.
BY USING THE SERVICE, YOU PROMISE US THAT (I) YOU HAVE READ, UNDERSTAND AND AGREE TO THIS PRIVACY POLICY, AND (II) YOU ARE OVER 16 YEARS OF AGE (OR HAVE HAD YOUR PARENT OR GUARDIAN READ AND AGREE TO THIS PRIVACY POLICY FOR YOU) AND (III) ACCEPT OUR DATA COLLECTION AND PROCESSING PRACTICES DESCRIBED BELOW. If you do not agree, or are unable to make this promise, you must not use the Service. In such case, you must (a) contact us and request deletion of data that we control; (b) cancel any subscriptions using the functionality provided by Apple; and (c) delete the App from your devices.
To learn more about the information we collect or process, see Section 2; for the purposes of processing, see Section 3; for the parties with whom information may be shared, see Section 5; and for your privacy rights, see Section 6. Questions and privacy requests may be sent to support@orvanta.limited.
PRIVACY POLICY
This Privacy Policy explains how Orvanta Digital Limited (“Orvanta”, “we”, “us” or “our”) collects, uses, stores, discloses and otherwise processes personal data when you use the Authenticator App mobile application (the “App”) and the services and features made available through it (together, the “Service”). It also explains important distinctions between data processed only on your device or in your private iCloud database and data processed by Orvanta or its service providers.
Translations of this Privacy Policy may be provided for convenience. If a translated version differs from the English version, the English version will prevail to the extent permitted by applicable law.
Definitions
In this Privacy Policy, “personal data” or “personal information” means information that identifies, relates to, describes or can reasonably be linked to an individual or household, as defined under applicable law. “Process” includes collecting, using, storing, accessing, analyzing, transmitting, disclosing and deleting information. “Vault contents” means TOTP account records, TOTP secret keys, saved login credentials and passwords, backup codes and optional notes stored through the App. “GDPR” means Regulation (EU) 2016/679. “UK GDPR” means the GDPR as incorporated into United Kingdom law. References to the “EEA” mean the European Economic Area.
TABLE OF CONTENTS
2. Categories of Personal Data We Collect
3. Purposes for Which We Process Personal Data
4. Legal Bases for Processing Personal Data (EEA and UK Users)
8. International Data Transfers
9. How We Protect Your Personal Data
11. Changes to This Privacy Policy
12. U.S. States Privacy Notice
1. PERSONAL DATA CONTROLLER
Orvanta Digital Limited, a company registered under the laws of Cyprus under registration number HE 496479, with its registered office at Zinonos Kitieos, 15, Ypsonas, 4187, Limassol, Cyprus, is the controller of personal data processed for the purposes described in this Privacy Policy.
Certain third parties, such as Apple or advertising platforms, may act as independent controllers for specific processing that they determine themselves. Their processing is governed by their own privacy notices. Where a provider processes personal data on our behalf, we use the provider for the limited functions described in this Policy and under the contractual arrangements applicable to that service.
2. CATEGORIES OF PERSONAL DATA WE COLLECT
The App processes information that you store or provide directly, information generated automatically when you use Authenticator App, and limited information received from Apple and other service providers. Some of the most sensitive information used by the App is processed only on your device or in your private iCloud database and is not received by Orvanta. The categories that apply depend on the features you use, your device and privacy settings, your subscription status and whether you enable optional backup or analytics-related functionality.
2.1. Information you provide directly
2.1.1. Vault and authentication records
When you add a two-factor-authentication account, the App may store information such as the issuer or service name, login or account label, TOTP secret key and optional backup codes. When you use the password-vault functionality, you may store a service name, login or username, password and optional note. These records are required or optional depending on the feature and the information you choose to save. Vault contents are stored locally on your device and are not maintained by Orvanta as a server-side copy.
2.1.2. iCloud backup and local security settings
If you enable iCloud backup, the App stores a backup snapshot in your private iCloud database. Sensitive vault fields are written using Apple CloudKit encryptedValues so that CloudKit encrypts those field values on your device before saving them to iCloud and decrypts them after retrieval. Limited backup metadata, such as the backup creation date, device name and the number of 2FA or password records included in a backup, may be stored separately from the encrypted vault contents where technically necessary to operate and manage the backup feature. The protection available to data stored in iCloud also depends on Apple’s iCloud security architecture and your account settings, including whether Advanced Data Protection is enabled.
If you enable an app lock, authentication is performed through Apple LocalAuthentication. Face ID, Touch ID or device-passcode verification is handled by Apple and the App receives an authentication result rather than your biometric template or biometric scan data.
2.1.3. Purchase and subscription information
Payments for Authenticator App subscriptions and in-app purchases are processed through Apple. We do not receive or store your full payment-card number. We may receive limited transaction and entitlement information such as the subscription or in-app purchase product selected, price and currency, purchase or restore status, subscription status, renewal or expiration status, transaction or purchase identifiers, purchase date, trial status, entitlement status and refund or cancellation information where Apple makes it available. RevenueCat may help us receive and manage subscription and entitlement information.
2.1.4. Communications, support and feedback
If you contact us, we may process your email address or other contact details, the content of your message, screenshots or other attachments you choose to provide, transaction or technical information relevant to the request, troubleshooting information and our response history. You should avoid sending TOTP secret keys, passwords, backup codes or other authentication secrets in a support message unless it is strictly necessary and you understand the security risk.
2.2. Information we receive from third parties
2.2.1. Apple
Apple may provide transaction, receipt, subscription and entitlement information when you make an App Store purchase. If you choose to use iCloud backup, Apple provides the private iCloud / CloudKit environment used for that feature. Apple’s processing is governed by its own Privacy Policy and applicable platform terms.
2.2.2. Analytics, attribution and other providers
Our analytics, diagnostics, attribution, advertising, support, A/B testing and subscription-management providers may return information generated from their services, such as campaign attribution, installation or event identifiers, subscription status, crash or performance information, test assignments, analytics results and advertising-measurement information. We use that information for the purposes described in Section 3. These providers do not receive your vault contents through the ordinary integrations described in this Policy.
2.3. Information collected automatically
2.3.1. Referral and campaign information
We may record the advertisement, campaign, deep link, website, application or other source that referred you to the App, together with AppsFlyer identifiers, campaign parameters, attribution results and related conversion or advertising events. This helps us understand which campaigns lead to installs, trials, subscriptions or other relevant events.
2.3.2. Device, network and approximate-location information
We may process IP address; device type and model; iOS and app version; language and time zone; memory and carrier information; app version and build; network or connectivity information; and other technical characteristics made available by your device or integrated SDKs. We may infer an approximate country, region or city from an IP address. We do not collect precise GPS location for the processing described in this Policy unless a future feature specifically requests it and you grant the relevant permission.
2.3.3. Usage and event data
We may record information about how you interact with the App, such as screens viewed, features used, session duration, subscription or restore events, onboarding steps, security-feature settings, backup-feature state, aggregate counts or status indicators that do not reveal vault contents, A/B test assignments and results, and other product interactions used to understand and improve the Service. We do not need to read the contents of your saved passwords or TOTP secrets merely to record ordinary product events.
2.3.4. Advertising and device identifiers
Depending on your device settings, permissions and the relevant SDK or platform configuration, we and our providers may receive advertising or device identifiers, including Apple’s Identifier for Advertising (IDFA), Identifier for Vendor (IDFV), Android Advertising ID (AAID), App Set ID, Firebase installation identifiers, AppsFlyer identifiers and other SDK-generated identifiers where available. These identifiers may be used for analytics, fraud prevention, attribution and advertising measurement. Where Apple’s App Tracking Transparency framework requires permission, tracking that requires such permission is subject to your choice.
2.3.5. Crash logs, diagnostics and performance data
We may receive crash reports, error logs, diagnostic information, performance measurements and technical context needed to identify and resolve failures, maintain reliability and protect the Service. This may include app version, device and operating-system information, timestamps, error codes and information about the feature being used when a problem occurred. We design our diagnostic integrations so that vault contents are not intentionally included in ordinary crash or performance reporting.
2.4. Sensitive and special-category information
TOTP secret keys, saved passwords, backup codes and other account-login credentials are highly sensitive security information and may also fall within definitions of sensitive personal information under certain U.S. state laws. The App is designed so that these vault contents remain on your device unless you choose to place a backup in your private iCloud database. Orvanta does not use vault contents to build advertising profiles, infer sensitive characteristics or make decisions about you. Optional notes or support materials could also contain information that applicable law treats as sensitive or special-category data; you should provide only what is necessary for the feature or support request.
We do not receive Face ID or Touch ID biometric templates or scans. Apple LocalAuthentication performs biometric or passcode verification and provides the App with the result of the authentication attempt.
2.5. Sources of personal data
The sources of personal data described in this Policy include: (a) you, when you add or edit vault records, enable optional iCloud backup, configure App security, purchase a subscription or in-app purchase, or contact support; (b) your device and use of the App; (c) Apple, in connection with App Store purchases, iCloud / CloudKit and LocalAuthentication; and (d) analytics, advertising, attribution, diagnostics, subscription-management, support and A/B testing providers that return information generated while providing services to us. Vault contents stored locally or in your private iCloud database are distinguished from data that Orvanta or its service providers receive.
3. PURPOSES FOR WHICH WE PROCESS PERSONAL DATA
We process personal data for the purposes described below. The information used for a particular purpose depends on the feature, your settings and the providers involved.
1. To provide TOTP authentication and vault functionality
The App processes your saved 2FA account records, TOTP secret keys, login credentials, passwords, backup codes and notes locally on your device so that it can generate authentication codes, display and manage your records and perform the actions you request. Orvanta does not maintain a server-side copy of these vault contents.
2. To provide optional iCloud backup and recovery support
If you enable iCloud backup, the App creates a backup snapshot in your private iCloud database. Sensitive vault fields are encrypted on your device using Apple CloudKit encrypted values before upload. Limited backup metadata may be processed separately to identify, display or manage available snapshots. Orvanta does not have access to decrypted vault contents stored in your private iCloud database.
3. To provide app-lock and local password-security features
The App uses Apple LocalAuthentication to verify Face ID, Touch ID or device passcode access without receiving the underlying biometric template. Weak-password and password-reuse checks are performed locally on the device to help you identify password-security issues without transmitting saved passwords to our servers or a third-party password-analysis service.
4. To provide subscriptions and paid access
We process transaction, subscription, in-app purchase and entitlement information to unlock paid features, recognize trial or subscription status, restore purchases, diagnose purchase issues and synchronize entitlements. Apple processes App Store payments, and RevenueCat may help us manage subscription and purchase-entitlement status.
5. To provide customer support
We use contact details, support messages, technical context and relevant transaction or subscription information to answer questions, troubleshoot issues, investigate purchase problems and respond to complaints. Zendesk may be used to organize and respond to support communications.
6. To analyze, maintain and improve the Service
We process device, usage, transaction, diagnostic, test-assignment and performance information to understand how Authenticator App is used, measure reliability, identify errors, evaluate feature performance, test onboarding or paywall variants and improve usability. Firebase Analytics and Firebase Crashlytics, Amplitude, Sentry may support these activities.
7. To advertise the App and measure paid acquisition
Authenticator App does not display third-party advertising inside the App. We may advertise the App on external platforms and use attribution and measurement tools to understand which campaigns lead to installs, trials, subscriptions or other relevant events, evaluate campaign performance and improve paid user acquisition. Providers may include AppsFlyer, Meta, Google Ads / AdMob, Apple Search Ads, TikTok, Snapchat and AppLovin.
8. To protect the Service, prevent fraud and enforce our agreements
We may process device and network information, identifiers, purchase events, diagnostic information and security signals to prevent subscription fraud, protect infrastructure, investigate incidents, enforce our Terms of Use and establish or defend legal claims. We do not need to access your vault contents for ordinary fraud-prevention and service-security purposes.
9. To comply with legal obligations
We may process, preserve or disclose information we control where necessary to comply with applicable laws, tax or accounting requirements, consumer-protection rules, data-protection obligations, court orders, subpoenas, lawful government requests, sanctions requirements or other binding legal process. Because Orvanta does not maintain a server-side copy of vault contents, we cannot disclose vault contents that we do not possess or control.
10. Corporate transactions and business administration
We may process or disclose information we control for audits, financing, insurance, due diligence, restructuring, merger, acquisition, sale of assets, insolvency or another corporate transaction, subject to appropriate confidentiality, security and legal safeguards. Local vault contents and private iCloud data are not transferred as Company-held server data because we do not maintain a server-side copy of them.
How to opt out of or influence personalized advertising
You can control certain advertising and tracking activity through iOS settings. Relevant controls may include Settings > Privacy & Security > Tracking and Settings > Privacy & Security > Apple Advertising > Personalized Ads. Apple explains App Tracking Transparency in its support materials. Disabling or limiting tracking may reduce personalized advertising or cross-app attribution, although it may not prevent all measurement activities that are permitted without consent.
You may also obtain information about interest-based advertising choices through the Network Advertising Initiative and the Digital Advertising Alliance. If you reside in a U.S. state that provides a right to opt out of a “sale”, “sharing” or targeted advertising, see Section 12.4.
4. LEGAL BASES FOR PROCESSING PERSONAL DATA (EEA AND UK USERS)
This section applies where the GDPR, UK GDPR or another applicable European data-protection law requires us to identify a legal basis. The applicable basis depends on the category of data and the purpose for which it is processed. Processing that occurs solely on your device and is not received by Orvanta may fall outside some controller obligations, but we describe the relevant App functionality here for transparency.
4.1. Performance of a contract
We rely on contractual necessity, including taking steps at your request before entering into a contract, to provide the App features you request; administer subscriptions, trials, in-app purchases and paid entitlements; provide customer support; and perform our obligations under the Terms of Use and Subscription Terms.
4.2. Consent
Where consent is required, we rely on your consent for optional iCloud backup, certain device permissions, App Tracking Transparency or other advertising/tracking activities, and processing of sensitive or special-category information where applicable law requires consent. You may withdraw consent through the relevant device, iCloud or Service controls or by contacting us. Withdrawal does not affect processing that was lawful before withdrawal.
4.3. Legitimate interests
We may rely on legitimate interests, balanced against your rights and reasonable expectations, to operate, secure, troubleshoot and improve Authenticator App; analyze feature use and product performance; conduct A/B testing; measure advertising where consent is not legally required; prevent fraud, abuse and unauthorized access; enforce agreements and protect legal rights; respond to complaints and disputes; conduct audits and business administration; and use aggregated or de-identified information for research, planning and statistical purposes.
Where processing is based on legitimate interests, you may object in circumstances provided by law. We will stop the relevant processing unless we demonstrate compelling legitimate grounds to continue or the processing is required for legal claims. You may object to direct marketing at any time.
4.4. Compliance with legal obligations
We process information where necessary to satisfy legal, regulatory, tax, accounting, security, consumer-protection, sanctions, law-enforcement or other obligations that apply to us.
4.5. Sensitive or special-category information contained in vault or support content
Vault contents may include sensitive login credentials but are designed to remain under your control on the device or in your private iCloud database. If optional notes or support materials contain information treated as special-category data under Article 9 GDPR, UK GDPR or comparable law, we process information we actually receive only where a lawful condition applies, which may include explicit consent where required. We do not use such information to infer sensitive characteristics for unrelated advertising.
5. SHARING OF PERSONAL DATA
We do not disclose personal data indiscriminately. We share information only as reasonably necessary for the purposes described in this Privacy Policy, under contractual, technical or legal protections where appropriate. We do not provide TOTP secret keys, saved passwords, backup codes or other vault contents to advertising or analytics providers through the ordinary integrations described below.
5.1. Service providers and contractors
Hosting and infrastructure. Amazon Web Services (AWS) provides cloud infrastructure used for certain operational and supporting components of the Service, including infrastructure in the us-east-1 region identified for this product. Authentication secrets, saved passwords and other vault contents are not stored by us on AWS as part of the core vault functionality.
Analytics and diagnostics. We may use Firebase Analytics / Firebase Crashlytics, Amplitude, and Sentry to understand product use, measure performance, identify errors and maintain reliability. Depending on the integration, these providers may receive device or SDK identifiers, usage events, approximate location, crash logs and diagnostic information.
Subscriptions and App Store services. Apple processes App Store purchases. RevenueCat may help synchronize subscription status, in-app purchase status and paid-feature entitlements.
Customer support. Zendesk may process contact details, message content, attachments and support history needed to manage a request.
5.2. Apple iCloud, CloudKit and LocalAuthentication
If you enable iCloud backup, the App uses Apple CloudKit and your private iCloud database. By enabling this feature, you instruct the App to store the relevant backup data in your private iCloud environment through Apple. Sensitive fields stored through CloudKit encrypted values are encrypted on-device before upload. Apple controls the iCloud service and applicable security architecture under its own Privacy Policy and iCloud terms. Orvanta does not maintain a separate decrypted server-side copy of your vault.
When you enable an app lock, Apple LocalAuthentication performs Face ID, Touch ID or device-passcode verification and provides the App with the result of the authentication attempt. We do not receive your biometric template or biometric scan data.
5.3. Advertising and measurement partners
We may use AppsFlyer, Meta, Google Ads / AdMob, Apple Search Ads, TikTok, Snapchat and AppLovin to advertise the App, attribute installs or subscriptions and measure campaign performance. These providers may receive advertising or device identifiers, campaign parameters, attribution data and limited conversion events. The App does not display third-party advertisements.
5.4. Courts, regulators, law enforcement and other authorities
We may disclose information we possess where required by law, binding legal process, court order, valid regulatory request or another lawful obligation, or where reasonably necessary to protect rights, security and safety. Because Orvanta does not maintain a server-side copy of your vault contents, we cannot disclose vault contents that we do not possess or control.
5.5. Business transfers and professional advisers
We may disclose information we control to professional advisers, auditors, insurers, lenders, investors or transaction counterparties where reasonably necessary for legal, financial, security, due-diligence or corporate-transaction purposes, subject to appropriate confidentiality and legal safeguards.
6. YOUR PRIVACY RIGHTS
Depending on your location and applicable law, you may have rights to access personal data we control, obtain a copy, correct inaccurate data, request deletion, restrict or object to certain processing, withdraw consent, request portability, opt out of certain advertising-related processing, or complain to a supervisory authority. These rights are subject to legal conditions, limitations and exemptions. Orvanta cannot provide a copy of or delete local vault contents that it does not possess; those records are controlled through the App, your device and, if enabled, your iCloud account.
6.1. Deletion and other self-service controls
You can delete individual vault records or local App data using available App and device controls. If you use iCloud backup, you may manage or delete the relevant backup through available App and iCloud controls. Deleting the App may remove locally stored data from the device but does not automatically cancel an App Store subscription, and restoration behavior may depend on whether an iCloud backup remains available. You can also manage App Tracking Transparency and other device-level permissions through iOS settings.
6.2. How to submit a privacy request
To exercise a privacy right concerning information that Orvanta or its service providers control and that cannot be completed through device or iCloud controls, contact us at support@orvanta.limited. Describe the request and provide information reasonably necessary to identify the relevant purchase, installation or support record. We may ask for information needed to verify your identity and protect against fraudulent requests.
6.3. Authorized agents
Where applicable law allows an authorized agent to submit a request on your behalf, we may require proof that the agent is authorized to act for you and may also verify your identity or ask you to confirm the request directly, to the extent permitted by law.
6.4. Automated decision-making
The Service does not use personal data to make solely automated decisions that produce legal or similarly significant effects on you. Local weak-password or password-reuse warnings are security-assistance features and do not determine your eligibility for employment, credit, insurance, housing, healthcare or another similarly significant service.
7. AGE LIMITATION
The Service is intended for users aged 16 and older. If you are under 16, you may use the Service only where your parent or legal guardian has reviewed and agreed to this Privacy Policy for you and such use is lawful in your jurisdiction. We do not knowingly process personal data from a person under 16 in circumstances where valid parental authorization or another lawful basis is required but has not been obtained. If you believe a younger person has provided personal data improperly, contact us at support@orvanta.limited.
8. INTERNATIONAL DATA TRANSFERS
Orvanta is established in Cyprus, while our users, providers and technical infrastructure may be located in other countries. Certain operational infrastructure used for Authenticator App, including AWS us-east-1, is located in the United States. Analytics, attribution, support, subscription and advertising providers may also process information in the United States, the EEA, the UK or additional countries depending on their infrastructure and the service used. Your private iCloud backup is stored through Apple in accordance with Apple’s iCloud architecture and account settings; Orvanta does not control Apple’s data-center allocation for your private iCloud database.
Where personal data originating in the EEA is transferred to a country that does not benefit from an applicable adequacy decision, we use appropriate safeguards where required, which may include the European Commission Standard Contractual Clauses and supplementary measures. Information about EU adequacy decisions is available from the European Commission.
For restricted transfers from the UK, we may use the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, adequacy regulations or another lawful transfer mechanism, as described in the UK ICO international transfers guidance.
9. HOW WE PROTECT YOUR PERSONAL DATA
The App follows a local-first design for vault contents. TOTP secret keys, saved passwords, backup codes and notes are stored in the local App database on your device, and Orvanta does not maintain a separate server-side copy. If you enable iCloud backup, sensitive vault fields are written through Apple CloudKit encrypted values so that those fields are encrypted on your device before upload. Access to the App can also be protected through Apple LocalAuthentication using Face ID, Touch ID or device passcode.
For information we or our providers actually receive, we use technical and organizational measures designed to protect personal data against unauthorized access, alteration, loss, destruction or disclosure. Depending on the system, measures may include access controls, authentication, encrypted network transmission, provider security controls, logging, monitoring, restricted production access, software updates, incident-response procedures and data-minimization practices.
No security technology can eliminate all risk. You are responsible for protecting your iPhone, Apple ID, iCloud account, device passcode, authentication secrets, backup codes and available recovery methods. You should keep appropriate backups and recovery options for the third-party accounts protected by TOTP. Because Orvanta does not possess your local vault contents or decrypted private iCloud vault, we generally cannot recover TOTP secret keys, passwords, backup codes or notes that are lost, deleted or corrupted and are not available through a backup or other recovery method you control.
10. DATA RETENTION
Retention depends on where the relevant information is stored and who controls it. Local vault records remain on your device until you delete the records, clear the relevant App data, delete the App in a manner that removes local data, or otherwise use available device or App controls. Orvanta does not maintain a separate server-side copy of those vault contents.
If you enable iCloud backup, backup data remains in your private iCloud environment until you delete or replace the backup using available App or iCloud controls, subject to Apple’s own retention, recovery and backup practices. Limited backup metadata may remain as needed to operate or identify available snapshots. Orvanta does not control Apple’s independent iCloud retention rules.
Subscription, in-app purchase and transaction information may be retained as necessary to administer entitlements, handle refund or dispute issues, comply with accounting or legal requirements and maintain fraud-prevention records. Support communications may be retained for the time reasonably necessary to resolve a request and maintain appropriate business records. Analytics, attribution, A/B testing and diagnostic providers may retain information according to the settings and contractual arrangements applicable to our use of their services. Information retained for legal, security or dispute-resolution reasons is restricted to those purposes and deleted or de-identified when the reason for retention ends.
11. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy to reflect changes in Authenticator App, providers, technical architecture, legal requirements or our data practices. We will update the “Last Updated” date and provide additional notice where applicable law requires it. If a change materially affects processing that relies on consent, we will obtain renewed consent where required.
12. U.S. STATES PRIVACY NOTICE
Applicability and scope
This section supplements the rest of this Privacy Policy for residents of U.S. states with comprehensive privacy laws, including California and other states where applicable. The rights available to you depend on the state in which you live and the law that applies. Where the App processes vault contents solely on your device and Orvanta does not receive or control that information, certain state-law obligations may not apply to Orvanta in the same manner as they apply to Company-held personal information.
12.1. Categories of personal information
During the preceding 12 months, and depending on the features used, we may have collected or processed the following categories of personal information:
- Identifiers, such as installation or SDK identifiers, IP address, device identifiers, advertising identifiers and support contact information.
- Commercial information, such as subscription product, in-app purchase, purchase, restore, trial, renewal, refund, cancellation or conversion events.
- Internet or other electronic network activity, such as app screens or features used, interactions, session information, referral and attribution events, A/B test assignment, crash information and diagnostics.
- General geolocation information, such as country, region or city inferred from IP address. We do not collect precise GPS location for the ordinary processing described in this Policy.
- Sensitive account-access information, including TOTP secret keys, saved passwords and backup codes, which the App processes locally on your device and, if you enable backup, in your private iCloud database. Orvanta does not maintain a separate server-side copy of these vault contents.
- Other electronic information, such as optional notes or support messages that you choose to provide.
- Inferences and derived information, such as product-use patterns, password-strength or password-reuse warnings generated locally, and campaign attribution. We do not use this information to make decisions that have legal or similarly significant effects on you.
We use these categories for the purposes described in Section 3, including providing and securing the Service, administering subscriptions and in-app purchases, support, analytics and improvement, A/B testing, advertising measurement, legal compliance and business administration.
12.2. Disclosure for business purposes
During the preceding 12 months, we may have disclosed Company-held identifiers, commercial information, network activity, general geolocation and diagnostic information to the service-provider and recipient categories described in Section 5 for business purposes. We do not disclose TOTP secret keys, saved passwords, backup codes or other vault contents to analytics or advertising providers through the ordinary integrations described in this Policy.
We may also disclose information we possess to public authorities, professional advisers or transaction counterparties as described in Section 5. Private iCloud backup content is handled through Apple at your direction and is not maintained by Orvanta as a decrypted server-side vault.
12.3. State privacy rights
Depending on your state, you may have some or all of the following rights: to know or confirm whether we process personal information; access personal information we control; request deletion; correct inaccuracies; obtain eligible data in a portable format; opt out of sale, sharing, targeted advertising or certain profiling; limit certain uses or disclosures of sensitive personal information; withdraw consent where applicable; appeal certain decisions; and exercise rights without unlawful discrimination.
How to Submit a Privacy Request
To exercise an applicable privacy right concerning information Orvanta controls, email support@orvanta.limited and describe the request, together with your state of residence where relevant. We may request information reasonably necessary to verify your identity and match the request to purchase, installation or support records. Orvanta cannot retrieve or provide vault contents that it does not possess; local or private-iCloud data should be managed through the App, device and iCloud controls available to you.
If we deny a request and the law applicable in your state gives you a right to appeal, you may request review by replying to our decision or emailing support@orvanta.limited with the subject line “Privacy Request Appeal.”
12.4. Sale, sharing and targeted advertising
We do not sell personal information for money. We may allow advertising, attribution and measurement partners to collect or receive advertising identifiers, device identifiers, IP address, approximate location, app interaction information, attribution events and limited commercial or subscription-conversion events. Under some state laws, these activities may be considered a “sale”, “sharing” or processing for targeted advertising even though no monetary payment is made for the data.
Relevant recipients may include advertising networks, social-media platforms, analytics and measurement providers, and attribution services such as Meta, Google, TikTok, Snapchat, AppLovin and AppsFlyer. The exact recipients depend on the campaigns and SDK configuration in use. The App does not display third-party advertising.
We do not provide TOTP secret keys, saved passwords, backup codes, vault notes or private iCloud vault contents to advertising partners for ordinary campaign measurement or targeted advertising.
Where applicable, you may opt out of sale, sharing or targeted advertising by emailing support@orvanta.limited with the subject “Opt Out of Sale, Sharing, or Targeted Advertising.” You may also use iOS privacy and App Tracking Transparency controls. Some advertising choices are device- or provider-specific and may need to be repeated after device, account or identifier changes.
We do not knowingly sell or share the personal information of individuals under 18 for targeted advertising where applicable law requires opt-in consent or otherwise prohibits that processing.
12.5. Do Not Track and privacy preference signals
Browser “Do Not Track” signals generally do not control processing inside an iOS application. This is separate from device privacy controls, App Tracking Transparency and legally recognized opt-out preference mechanisms.
Where a legally recognized opt-out preference signal or universal opt-out mechanism can be applied to a relevant interaction or supported technology, we will process the signal as required by applicable law. You may also use iOS privacy settings or contact us directly to exercise an applicable opt-out right.
12.6. California-specific information
California residents may have rights under the California Consumer Privacy Act, as amended, including rights to know, access, correct and delete personal information and to opt out of sale or sharing, subject to legal exceptions. We do not use or disclose sensitive personal information for purposes that would require a separate “Limit the Use of My Sensitive Personal Information” mechanism based on the processing described in this Policy.
California’s “Shine the Light” law (Cal. Civ. Code § 1798.83) permits eligible California residents to request information once a year about certain disclosures of personal information to third parties for those third parties’ direct-marketing purposes. To make such a request, email support@orvanta.limited with “Request for California Privacy Information” in the subject line and include your state of residence and email address.
12.7. Nevada residents
Nevada residents may submit a verified request to opt out of a covered sale of certain personal information under Nevada law by contacting support@orvanta.limited. We do not sell personal information for monetary compensation as described in this Policy.
12.8. Financial incentives and consumer health information
We do not currently offer a financial incentive or price or service difference in exchange for personal information. Authenticator App is not a health service and is not designed to collect consumer health data as a separate product category. Optional vault notes or support materials may nevertheless contain health or other sensitive information that you choose to provide. Such information is processed only as necessary for the feature or support you request and is not used to build a consumer health profile for unrelated purposes.
13. CONTACT US
For questions about this Privacy Policy, previous versions or the processing of personal data, contact Orvanta Digital Limited at support@orvanta.limited. Registered office: Zinonos Kitieos, 15, Ypsonas, 4187, Limassol, Cyprus. Registration number: HE 496479.
Effective as of: September 1, 2026