Privacy Policy

We do not operate user accounts and do not use analytics. Authentication secrets, account labels, and app settings are stored locally using the secure storage mechanisms provided by your operating system (Apple Keychain or Android Keystore, where available and configured). They are not transmitted to us.

If you enable Google Drive backup on Android, the app uses Google OAuth only to obtain permission to its own backup area. We do not receive your Google password. Google may process account and authorization data under its own privacy policy.

The camera is used only to scan QR codes when you add an account. Images are processed in real time on your device and are never saved, uploaded, or shared. You can decline the permission and add accounts manually instead.

Local .wreauth files and optional cloud backups are encrypted locally on your device, using a password only you know, before they are saved or uploaded. We cannot access, decrypt, or recover a backup or its password.

On iOS, an encrypted backup may be stored in iCloud. On Android, an encrypted backup may be stored in Google Drive. Google Drive access uses OAuth and the non-sensitive scope https://www.googleapis.com/auth/drive.appdata. This permits access only to WreAuthenticator’s hidden application-data folder, not to your ordinary Drive files or files created by other apps. Uploading and restoring cloud backups requires an internet connection; generating codes does not.

To remove Google Drive backup data, open Google Drive settings, choose Manage apps, find WreAuthenticator, then choose Options → Delete hidden app data. To stop future access, revoke WreAuthenticator under your Google Account’s third-party connections. Revoking access does not by itself guarantee deletion of data already stored in the hidden folder. Uninstalling the app may not remove all locally stored data or cloud backups. Delete your accounts in the app before uninstalling, and delete cloud backups separately.

WreAuthenticator also offers an optional extension for Chrome and Edge. It is a companion to the app: you add only the accounts you choose, and each is stored in a separate encrypted vault inside your browser, protected by a master password (Argon2id key derivation with AES-256-GCM encryption). The extension makes no network connections and includes no sync and no analytics, so nothing is sent to us — your master password and secrets never leave your browser and cannot be recovered by us. Removing the extension or resetting its vault deletes its local data.

WreAuthenticator has no payment system of its own. The optional one-time Pro purchase is handled entirely through App Store in-app purchases or Google Play Billing, under the store operator’s privacy policy. We do not receive your card number or full payment details.

The app does not use advertising, analytics, or tracking SDKs. WreCore does not receive your authentication secrets or backup contents. If you enable cloud backups or purchase Pro, Apple or Google processes the data needed to provide those services under its own privacy policy. If you contact support, we receive the information you include in your message.

Authentication accounts remain in local secure storage until you delete them in the app. Uninstalling the app does not guarantee that all secure-storage data is removed. Local backup files remain wherever you saved them until you delete them. Cloud backups remain in your iCloud or Google Drive account until you delete them using the relevant cloud service controls. Google Drive hidden backup data can be deleted under Drive settings → Manage apps → WreAuthenticator → Options → Delete hidden app data, and access can be revoked in your Google Account’s third-party connections. Emails are retained only as long as needed to answer your request.

Where applicable under the GDPR, you may request access to, correction, deletion, restriction, or portability of personal data we process, and object to certain processing. You can manage locally stored authentication accounts directly in the app and delete cloud backups through the relevant service. For requests concerning information held by WreCore, such as support correspondence, contact hello@wrecore.com. You may lodge a complaint with the Polish Data Protection Authority (UODO) or another competent supervisory authority.

The app is not directed at children. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, contact hello@wrecore.com.

We will note material changes in the app’s update notes. The current version is always available at wreauthenticator.com/privacy/. Questions: hello@wrecore.com.