Your data, explained clearly

Privacy Policy

Effective date: August 30, 2026

Authify is a two-factor authentication browser extension. This policy explains what information Authify accesses, why it is needed, where it is stored, and the choices available to you.

Summary

• Authenticator secrets and generated codes are not sent to an Authify-operated server.
• Your vault is encrypted locally with your master password.
• Authify does not sell personal information.
• Authify does not include advertising or behavioral analytics.
• Google Drive backup is optional and initiated by you.

Authenticator vault

Account names, issuers, authenticator secrets, settings, notes, tags, and account ordering are stored in your browser's extension storage as an encrypted vault. The decrypted vault and master password exist only in extension memory while the vault is unlocked. Authify cannot recover a forgotten master password.

Camera and QR scanning

Camera access is requested only when you choose webcam QR scanning. Camera frames are processed on your device to detect authenticator QR codes and are not uploaded to Authify servers. You can revoke camera access in Chrome at any time.

Active-page access

When you explicitly request a page-region QR scan or user-invoked autofill, Authify temporarily processes the selected page content or active input field. Authify does not continuously monitor browsing history, clicks, or page activity.

Clipboard

Authify writes a verification code to the clipboard only when you choose to copy it. If clipboard clearing is enabled, Authify may remove that same copied value after 30 seconds.

Encrypted backup files

Offline backups are encrypted and authenticated with the backup password you provide before they are downloaded. Backup passwords are not recoverable. Restored backup files are processed locally.

Google Drive backup and Google user data

Google Drive backup is an optional Authify Pro feature. When you request a backup or restore, Authify uses the Google Drive API to upload, list, download, or delete password-encrypted .authify backup files in a visible Authify folder.

Authify requests the Google Drive drive.file scope. This limits access to files Authify creates or files you explicitly grant to Authify. Authify cannot access arbitrary files in your Google Drive. Disconnecting Google Drive revokes Authify's authorization and removes the local connection state; it does not delete backup files already stored in Drive.

Authify does not use Google user data for advertising, credit decisions, sale, or transfer to data brokers. Google user data is used only to provide the user-facing encrypted backup and restore feature.

The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Subscriptions and payment

Authify Pro access and checkout are provided through ExtensionPay and its payment processor, Stripe. Authify receives subscription status needed to enable paid features. Authify does not receive or store your full payment-card number. Those providers process information under their own privacy policies.

Data sharing and sale

Authify does not sell personal information. Information is shared only with service providers necessary to deliver a feature you request, such as Google Drive for optional backups and ExtensionPay/Stripe for subscriptions, or when legally required.

Retention and deletion

Local Authify data remains until you delete accounts, reset the vault, clear extension data, or uninstall Authify. You control encrypted Google Drive backup files from Authify's backup history or your Google Drive. Subscription records are retained by the relevant payment providers according to their policies and legal obligations.

Security

Authify uses browser-provided Web Crypto capabilities and authenticated encryption. No system can guarantee absolute security, so keep recovery codes and independent backups for important accounts.

Children

Authify is not directed to children under 13 and does not knowingly collect personal information from children.

Changes to this policy

Material changes will be published on this page with a revised effective date. This policy will be kept consistent with Authify's current behavior and public disclosures.

Contact

Questions or privacy requests can be sent to hello.rafihaidari@gmail.com.