AuthG
Get AuthG
Effective Date: September 2026•Version 1.0

Privacy Policy

AuthG was founded on a simple principle: your authentication secrets belong solely to you. We do not have servers, databases, accounts, or telemetry.

1. Information We Do Not Collect

Unlike cloud authenticators, AuthG does not operate central servers or user accounts. We collect:

  • No Personal Information: No names, email addresses, phone numbers, or IP addresses.
  • No Two-Factor Secrets: Your TOTP secret seeds, account labels, issuers, and generated codes are never transmitted to us or any third party.
  • No Usage Telemetry: No tracking of when you open the app, which accounts you use, or what features you click.
  • No Cookies or Identifiers: The desktop application uses no advertising IDs, device fingerprints, or tracking cookies.

The one network request the app makes is the update check, and only when you click Check for Updates. It asks GitHub for the latest release, so GitHub sees your IP address, as with any download. No account data is sent.

2. How Your Credentials Are Stored & Protected

Your two-factor authentication credentials are saved in a local encrypted vault file (vault.enc) stored exclusively on your computer's local drive.

  • Encryption: The vault is encrypted with AES-256-GCM. On macOS the key is kept in the system keystore (Keychain), not in the file. See the security page for details, including Linux.
  • Strict File Permissions: The vault file is written with strict POSIX permissions (0600, owner-only read and write) on Unix systems to prevent other user accounts on shared computers from reading it.
  • No Browser Storage: Secrets are never saved in unencrypted webview storage (localStorage or sessionStorage).

3. Camera & Clipboard Usage

Camera Access (Optional QR Scanning)

If you choose to scan a Google Authenticator export QR code using your webcam, camera access is requested on-demand. Video frames are processed strictly in volatile system RAM by the local CPU to extract the migration URI and are immediately discarded. No video frames, photographs, or recordings are ever saved to disk or transmitted across any network.

Clipboard Handling (Concealed Pasteboard)

When you copy a 6-digit TOTP code, AuthG applies native OS privacy flags (org.nspasteboard.ConcealedType on macOS) to instruct clipboard managers (such as Raycast, Alfred, and Maccy) not to log or persist your codes. A customizable background timer automatically zeroes and clears the clipboard after copying.

4. Website Privacy

This marketing website (authg.abhinavdhakal.com) is statically generated and hosted via secure CDNs. We do not use third-party analytics trackers, tracking cookies, or advertising scripts. Web server access logs (such as IP addresses and user agents) are handled by the hosting infrastructure solely for DDoS mitigation, caching, and technical uptime delivery.

5. Open Source

AuthG is 100% open-source software distributed under the MIT license. All of its code is public on GitHub, so you can check these claims yourself.

6. Contact

If you have questions regarding this Privacy Policy or AuthG's security design, please open an issue or discussion on the official GitHub repository at github.com/abhidhakal/authg-app.