AuthBro
Login
Client-Side Privacy Standard

Privacy Policy

Learn about AuthBro's strict 100% client-side execution and zero data retention commitment.

Last updated: 2026-09-21

Our Zero-Knowledge Privacy Guarantee

At AuthBro, we operate on a fundamental principle: We cannot leak, lose, or monetize data that we never receive. All 2FA secret keys, TOTP seed calculations, QR code scanning, and vault backups are executed strictly inside your device's web browser memory. No secret keys or personal credentials are ever uploaded to our web servers.

100% Client-Side Hashing AES-256 Local Encryption Zero Server Logging

1. Information We Do NOT Collect or Store

When you use AuthBro to manage your Two-Factor Authentication (2FA) verification codes, all cryptographic processing occurs directly in your web browser. We explicitly do NOT collect:

  • Secret Keys & TOTP Seeds: Your Base32 secret keys, service issuer names, and account labels are saved exclusively in your browser's local sandbox storage (localStorage / IndexedDB).
  • Camera Feeds & QR Images: Web camera frames scanned during QR setup are parsed locally using in-browser WebAssembly. Video feeds are never recorded, streamed, or uploaded to any remote server.
  • Generated 2FA Codes & Copy Logs: We do not track when 6-digit TOTP verification codes are generated or copied to your clipboard.
  • Master Passphrases: If you protect your vault with a master password, the key derivation function (PBKDF2/AES-GCM) runs strictly inside your local browser memory. We do not store or transmit your master password.

2. How Your Local Data is Protected

Your security credentials reside within your browser's isolated sandbox. To protect your data locally on your device:

  • Client Encryption: Sensitive vault entries can be encrypted with AES-256-GCM symmetric encryption using your personal master passphrase.
  • Encrypted Backups: When you export a backup JSON archive, the resulting file is encrypted prior to file download. You retain sole physical ownership of your backup files.
  • Offline Capability: Once loaded in your web browser, AuthBro can be operated completely air-gapped without an active internet connection.

3. Cookies & Local Storage Policy

We strictly minimize web storage usage:

  • Essential Local Storage: Used solely to preserve your application settings (e.g., active light/dark visual theme choice and local encrypted 2FA vault state).
  • No Advertising Trackers: We do not utilize third-party advertising cookies, cross-site tracking pixels, or invasive behavioral profiling tools.

4. Data Control & Complete Deletion

You hold 100% control over your credentials at all times. You can wipe your stored authenticators immediately by selecting "Clear Local Vault" in application settings or by clearing your browser site data.

Important Security Reminder: Because we maintain zero server database backups of your secret keys, lost master passphrases or un-backed-up browser cache purges cannot be recovered by our team. Always keep a secure, encrypted backup file in a safe location.

5. GDPR & Global Privacy Compliance

Because AuthBro collects zero personal data or unencrypted credentials on backend servers, our platform inherently satisfies the highest requirements of Privacy-by-Design and Privacy-by-Default under the General Data Protection Regulation (GDPR Article 25) and the California Consumer Privacy Act (CCPA/CPRA).

6. Privacy Questions & Contact

If you have questions regarding this Privacy Policy, client-side cryptography, or security audits, please reach out via our contact support channel.

Did you find this policy page helpful?
4

How to Verify Our Privacy Guarantee Yourself

You don't need to take our word for it. Open your browser Developer Tools (F12 or Ctrl+Shift+I), switch to the Network tab, and generate 2FA tokens or scan QR codes. You will observe zero outbound API requests containing your 2FA secrets or seed keys.

Frequently Asked Privacy Questions

No. Because we operate on a zero-knowledge architecture with zero server key storage, our engineers have no physical or technical access to your 2FA secret keys, master passwords, or generated TOTP tokens.
Your account secrets are saved locally inside your device's browser profile sandbox. You can encrypt this vault with a master passphrase using AES-256-GCM encryption.
Clearing your browser's site data or local storage will delete your locally saved authenticators. To prevent accidental data loss, always export a password-protected JSON backup archive from the application settings menu.