Privacy Policy

Tokens: 2FA Authenticator · Last updated: June 27, 2026

The short version: Tokens does not collect, transmit, sell, or share any of your personal data. Your two-factor secrets and codes are generated and stored entirely on your own devices. We have no servers that hold your data, and we cannot read your codes.

What we collect

Nothing. Tokens does not require an account, an email address, or a phone number to use. We do not operate analytics, tracking, or advertising SDKs that profile you. We do not have a backend that stores your accounts or codes.

How your data is stored

Your two-factor accounts and their secret keys are stored locally on your device, protected by the device's encryption and, optionally, Face ID / Touch ID.
Codes are generated on-device using the standard time-based one-time password algorithm (TOTP, RFC 6238). No code or secret is ever sent to us.

Optional iCloud sync

If you choose to enable iCloud Sync, your accounts are stored in your own iCloud account, end-to-end encrypted with a password that only you know. The data is never accessible to us, and there is no backdoor. You can turn sync off at any time. Your use of iCloud is governed by Apple's Privacy Policy.

No third-party sharing

Because we do not collect your data, we have nothing to sell or share with advertisers, data brokers, or any third party.

Purchases

Optional Tokens Pro purchases are processed by Apple through the App Store. We do not receive or store your payment information. Purchase handling is subject to Apple's privacy practices.

Children's privacy

Tokens is rated 4+ and does not knowingly collect any data from anyone, including children.

Changes to this policy

If this policy changes, we will update this page and revise the date above.

Contact

Questions about privacy? Email us at xxkqw1992@gmail.com.