Privacy Policy – factr

Last updated: 21 September 2026

This policy covers the Android app factr: 2FA Authenticator (package name de.timhaller.authenticator), distributed through Google Play. It does not cover this website – for that, see the privacy policy of factr.rellit.de.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Tim Haller
Beethovenstraße 9
64347 Griesheim
Deutschland
Email: mail@timhaller.de

No data protection officer has been appointed; the statutory conditions for doing so are not met.

2. The short version

The app runs no server of its own and collects no personal data itself. There is no user account, no sign-up and no login. No advertising, analytics or crash reporting SDK is embedded.

Everything created while using it – your accounts, their secrets, names, colours and folders – stays on your device alone. None of it takes part in any network connection; the app works in full in flight mode.

Personal data arises at one point, and it involves Google: the purchase of the Pro unlock through Google Play Billing (section 8). For that – and only that – the app holds the INTERNET permission. It is used neither for the codes nor for your accounts.

That library pulls in further Google components which can report diagnostics to Google and cannot be switched off individually. Section 9 describes this openly, because it is part of the truth: from me you learn nothing about anyone – what Google learns through its own libraries I can neither prevent nor inspect.

3. Data that never leaves your device

The app stores the following in a local database and in its private app storage (Android DataStore):

This data is not transmitted and cannot be read by other apps. It is deleted when you uninstall the app or clear its data in Android's settings.

Android's system backup does not capture it either. The app is excluded from automatic cloud backup and from device transfer (allowBackup="false" plus full exclusion rules). So your secrets do not end up in a Google Drive backup in passing, merely because that setting is on in the system. They leave the device solely through the export you trigger yourself (section 7).

4. How the secrets are protected

Every secret sits in the database encrypted with AES-256 in GCM mode. The key for it is generated in the Android Keystore and marked non-exportable: it never leaves the device's secure hardware, neither for a backup nor for the app itself, which can only use it to encrypt and decrypt. Where the device has a dedicated security chip (StrongBox, Android 9 and later), that chip is used.

A secret is decrypted only at the moment a code is computed, and only in memory. It is never logged, never displayed and never copied to the clipboard – at most the six-digit code goes there, and only when you tap it.

In addition, every screen showing codes, secrets or the QR preview is marked FLAG_SECURE. That prevents screenshots, screen recording and the thumbnail in the recent apps list – by other apps as well.

One thing the app cannot protect: the code displayed by a home screen widget. The home screen belongs to the launcher, not to the app, and FLAG_SECURE does not apply there. That is why every widget instance can be set to reveal its code only on tap.

5. Permissions and what they are needed for

That is the complete list. Explicitly not requested:

• AD_ID – there is no advertising and no access to the advertising ID.
• Location, contacts, microphone, phone state.
• Storage permissions – backup and gallery image go through the system's own pickers (Storage Access Framework and photo picker), which hand the app nothing but the one file you chose.

6. Camera and QR scanning

The camera image is evaluated at runtime only, to detect a QR code. It is not stored, not cached and not transmitted. Evaluation happens entirely on the device using the ZXing library; no cloud image-recognition service is involved. If you pick an image from your gallery instead, the same applies: it is read once and not kept.

7. Backup and restore

You can export all accounts into a file. You choose the location and file name through the system dialog – the app writes only where you point it. The file is always encrypted: with AES-256-GCM, whose key is derived via PBKDF2-HMAC-SHA256 at 210,000 iterations (the OWASP recommendation) from a password you set.

I do not know that password and cannot reset it. If it is lost, the file is unreadable – to you and to anyone else. That is the price of a backup of your 2FA secrets staying safe even when it falls into the wrong hands. Where you keep the file is up to you; if you move it into cloud storage, that provider's terms apply there – though what is transferred is the encrypted content and nothing else.

8. Pro unlock (Google Play Billing)

The app is free. A few features – more folders, more codes per folder, the full icon selection and custom icons – can be unlocked by a one-off purchase inside the app. Payment is handled entirely by Google through Google Play.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Google processes your account details, payment information and purchase history in doing so. I never receive your payment data – neither card number nor billing address. The app merely asks Google whether a valid purchase exists and stores the answer as a yes/no value locally on the device. That query opens a connection to Google Play, in the course of which technically necessary connection data arises at Google, including your IP address.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract). In the Play Console I see aggregated sales figures only, nothing about individual buyers.

This query also happens when you have not bought anything: otherwise an unlock once purchased could not be restored after a reinstall or on a new device. Nothing but that query is transmitted – your accounts, secrets and codes are never part of it. The purchase is managed and refunded through Google Play.

9. Distribution through Google Play

When you download, update and use the store, Google processes data under its own responsibility – for instance installation statistics and crash reports from the Play service. I have no influence over that; Google's privacy terms apply. In the Play Console I see only aggregated statistics, such as installations per country or device type. I cannot draw conclusions about individual people from them.

What the billing library brings along: Google Play Billing cannot be embedded in isolation. It brings further Google components into the app, among them play-services-base and play-services-basement as well as Google's data transport (transport-backend-cct, firebase-encoders). Google libraries use that transport to report diagnostic and usage data to Google; typically device characteristics, error states and technical identifiers.

I do not employ these components, do not configure them and receive no data from them – but they cannot be switched off along with the payment handling either. Google is responsible for them. Anyone wanting to avoid this entirely uses the free version and makes no purchase; the components are then still contained in the app, but the purchase that sets them in motion does not take place.

Wherever the choice was mine, it went against Google libraries: QR scanning uses ZXing rather than Google's ML Kit, which would have brought the same data transport along. No analytics, advertising or crash reporting SDK is embedded anywhere.

10. What the app does not do

For clarity, because apps are often assumed to do otherwise. Every point below refers to what I build into the app; what comes along with Google's payment handling is covered in section 9 and is excepted from it:

• No analytics tool is used – no Firebase Analytics, no Google Analytics, no comparable SDK.
• No crash reporting service such as Crashlytics is integrated.
• No advertising is shown and no advertising ID is read.
• There is no user account, no registration, no login.
• It does not record which accounts you add, which services you use or how often you open the app.
• No data is passed on or sold to third parties.
• No accounts, secrets or codes are transmitted – the app's only connection goes to Google Play and concerns the purchase check alone (section 8).

11. Planned cloud sync

An optional sync through the private app-data area of your Google Drive is planned for a later version. It is not part of this version; the app ships neither code nor permissions for it.

Should it arrive, this will hold: explicitly opt-in, everything stays as described without it, and what would be transferred is the already encrypted backup file – never a secret in the clear. This policy will be updated beforehand.

12. Retention

Local data remains stored until you delete the account in question, uninstall the app or clear its data. There is no server-side storage. For data arising at Google in connection with the purchase and the store, Google's own retention periods apply, over which I have no influence.

13. Your rights

Under the GDPR you have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing (Art. 21).

One practical note: since I store no personal data about you myself, I can neither provide information about you nor delete anything – there simply is nothing on file. You delete your data by uninstalling the app or clearing its data. For data arising at Google in connection with the purchase or store use, please address your request to Google directly.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority of your place of residence is competent, as is the one responsible for me:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Gustav-Stresemann-Ring 1
65189 Wiesbaden, Germany
Phone: +49 611 1408-0
Email: poststelle@datenschutz.hessen.de
Web: datenschutz.hessen.de

14. Children

The app is not directed at children and is not classified as a children's app in the store. No data from children under 16 is knowingly collected – and, for lack of any collection, none from anybody else either.

15. Changes to this policy

This policy is updated whenever the app or the legal situation changes. The current version is always available at this address. The “last updated” date above shows when something last changed.

16. Contact

For questions about privacy in this app: mail@timhaller.de