PRIVACY POLICY FOR VEXAUTH

Effective Date: October 21, 2025
Last Updated: October 21, 2025
Version: 1.0.0

========================================

PRIVACY-FIRST DESIGN

Vexauth is a two-factor authentication app designed with privacy as our fundamental principle. We don't collect, store, or transmit any of your personal data to external servers. Your authentication codes are yours and yours alone.

========================================

1. INFORMATION WE COLLECT

We collect ZERO personal information. Vexauth operates completely offline and does not collect, store, or transmit any data to external servers.

Data Stored Locally on Your Device:
- Account Information: Service names and account identifiers you provide
- Authentication Secrets: The cryptographic keys needed to generate your 2FA codes
- App Settings: Your preferences such as PIN lock settings and display preferences

Data Security:
- AES-256-GCM encryption for authentication secrets
- Android Keystore for secure key management
- Hardware-backed security when available on your device

========================================

2. WHAT WE DON'T DO

Complete Privacy Commitment:
❌ We DO NOT collect any personal information
❌ We DO NOT track your usage or behavior
❌ We DO NOT use analytics or tracking services
❌ We DO NOT display advertisements
❌ We DO NOT require account registration
❌ We DO NOT connect to the internet
❌ We DO NOT access your authentication codes
❌ We DO NOT sell, share, or monetize any data
❌ We DO NOT use third-party services (except ML Kit for QR scanning)

========================================

3. PERMISSIONS WE REQUEST

Camera Permission:
- Purpose: To scan QR codes when adding new 2FA accounts
- Usage: Only activated when you tap "Scan QR Code"
- Optional: You can add accounts manually without granting camera access
- Processing: QR codes are processed entirely on your device using Google ML Kit
- Storage: No images or QR code data is stored

Note: Google ML Kit processes QR codes locally on your device. No image data is sent to Google or any external service.

========================================

4. DATA PROCESSING AND STORAGE

Local-Only Operation:
- All authentication codes are generated on your device
- No network connections are required or made
- Your data never leaves your device
- No cloud backup or sync functionality

Data Retention:
- Duration: Data remains on your device until you delete it
- Deletion: Delete individual accounts through the app or uninstall to remove all data
- No Server Data: Since we don't use servers, there's no server-side data to delete

========================================

5. CHILDREN'S PRIVACY (COPPA COMPLIANCE)

Vexauth does not knowingly collect any information from children under 13 years of age. The app is designed for general use and does not collect personal information from users of any age.

========================================

6. GDPR COMPLIANCE

Since we don't collect or store personal information on our servers:
- Right to Access: All your data is on your device
- Right to Deletion: Delete accounts in-app or uninstall the app
- Right to Portability: Not applicable (no server-side data)
- Right to Rectification: Edit accounts by deleting and re-adding them
- Right to Object: Simply uninstall the app

========================================

7. CCPA COMPLIANCE

Since Vexauth does not collect, sell, share personal information, or operate online, CCPA rights are not applicable as there is no personal information to access, delete, or opt-out from.

========================================

8. SECURITY MEASURES

- Encryption: AES-256-GCM for all sensitive data
- Hardware Security: Android Keystore integration
- PIN Protection: Optional 4-digit PIN lock
- No Network Access: App works completely offline
- Secure Coding: Following Android security best practices

========================================

9. LEGAL COMPLIANCE

This app and privacy policy comply with:
- Google Play Developer Program Policies
- General Data Protection Regulation (GDPR)
- California Consumer Privacy Act (CCPA)
- Children's Online Privacy Protection Act (COPPA)
- Android security and privacy requirements

========================================

10. CONTACT INFORMATION

Email: support@vexauth.app
Developer: Vexauth Development Team
Response Time: We aim to respond to privacy inquiries within 72 hours

For Privacy-Related Requests:
- Data deletion requests (though no server data exists)
- Privacy policy clarifications
- Security vulnerability reports
- GDPR or CCPA related inquiries

========================================

SUMMARY

Your Privacy = Our Priority

✅ 100% offline operation
✅ Zero data collection
✅ Military-grade encryption (AES-256)
✅ No tracking or analytics
✅ No advertisements
✅ Open and transparent
✅ Full user control

We don't collect data because we don't need to. Your authentication codes belong to you, and you alone.

========================================

Document Information:
Privacy Policy Version: 1.0.0
Last Updated: October 21, 2025
Effective Date: October 21, 2025
App Version: 1.0.0
Language: English