Privacy Policy

We do not operate user accounts and do not use analytics. Authentication secrets, account labels, and app settings are stored locally using the secure storage mechanisms provided by your operating system (Apple Keychain or Android Keystore, where available and configured). They are not transmitted to us.

If you enable Google Drive backup on Android, the app uses Google OAuth only to obtain permission to its own backup area. We do not receive your Google password. Google may process account and authorization data under its own privacy policy.

The camera is used only to scan QR codes when you add an account. Images are processed in real time on your device and are never saved, uploaded, or shared. You can decline the permission and add accounts manually instead.

Local .wreauth files and optional cloud backups are encrypted locally on your device, using a password only you know, before they are saved or uploaded. We cannot access, decrypt, or recover a backup or its password.

On iOS, an encrypted backup may be stored in iCloud. On Android, an encrypted backup may be stored in Google Drive. Google Drive access uses OAuth and the non-sensitive scope https://www.googleapis.com/auth/drive.appdata. This permits access only to WreAuthenticator’s hidden application-data folder, not to your ordinary Drive files or files created by other apps. Uploading and restoring cloud backups requires an internet connection; generating codes does not.

To remove Google Drive backup data, open Google Drive settings, choose Manage apps, find WreAuthenticator, then choose Options → Delete hidden app data. To stop future access, revoke WreAuthenticator under your Google Account’s third-party connections. Revoking access does not by itself guarantee deletion of data already stored in the hidden folder. Uninstalling the app removes local app data but may not remove a cloud backup.

WreAuthenticator also offers an optional extension for Chrome and Edge. It is a companion to the app: you add only the accounts you choose, and each is stored in a separate encrypted vault inside your browser, protected by a master password (Argon2id key derivation with AES-256-GCM encryption). The extension makes no network connections and includes no sync and no analytics, so nothing is sent to us — your master password and secrets never leave your browser and cannot be recovered by us. Removing the extension or resetting its vault deletes its local data.

WreAuthenticator has no payment system of its own. The optional one-time Pro purchase is handled entirely through App Store in-app purchases or Google Play Billing, under the store operator’s privacy policy. We do not receive your card number or full payment details.

We do not share data with third parties, do not use advertising or ad networks, and do not track or profile users. Because no data is collected, there is nothing to sell or transfer.

Local data remains on your device until you remove accounts in the app or uninstall it. Local backup files remain wherever you saved them until you delete them. Cloud backups remain in your iCloud or Google Drive account until you delete them using the relevant cloud service controls. Google Drive hidden backup data can be deleted under Drive settings → Manage apps → WreAuthenticator → Options → Delete hidden app data, and access can be revoked in your Google Account’s third-party connections. Emails are retained only as long as needed to answer your request.

Under the GDPR you have the right to access, rectify, delete, and port your data, and to lodge a complaint with a supervisory authority. Because your data never leaves your device, you exercise these rights directly in the app (delete accounts or uninstall; export to port your data). For questions, contact hello@wrecore.com. You may also complain to the Polish Data Protection Authority (UODO) or your local EU authority.

The app is not directed at children and does not knowingly collect any data from anyone, including children.

We will note material changes in the app’s update notes. The current version is always available at wreauthenticator.com/privacy/. Questions: hello@wrecore.com.