Preface & Overview

Xianggang Mengchuang specializes in the research, development and distribution of iOS identity‑authenticator applications. This Privacy Policy explains how we collect, store, use, share and protect various types of information generated when you use our Authenticator product. This Privacy Policy applies exclusively to this iOS Authenticator client and does not govern third‑party websites, external services or other software not developed by us.

Please read this Privacy Policy in full before installing, configuring or enabling any features of the Authenticator. By continuing to use this product, you acknowledge that you fully understand and accept all terms of this policy. If you disagree with any provision herein, you must immediately stop installing and using the Authenticator.

If you have questions, feedback or need to exercise your personal data rights under this Privacy Policy, please send an email to our official service mailbox: wistenwindy@gmail.com.

1. Types of Collected Information and Purposes of Processing

1.1 Local Account and Identity Credential Information

The core function of the Authenticator is to store multi‑platform two‑factor verification credentials. When you manually import or scan QR‑codes to add verification accounts, service provider names, account identifiers, secret seeds and token generation parameters will be stored locally on your device. Sensitive authentication secrets are saved by default within the iOS System Keychain on your local device and will not be automatically uploaded to our cloud servers.

1.2 Optional Cloud‑Sync Related Data

If you voluntarily enable cloud backup synchronization, you agree that encrypted data packages containing your authentication entries may be uploaded to our cloud services. All uploaded data packages are protected by end‑to‑end encryption. Xianggang Mengchuang cannot decrypt or read your original identity secrets. Decryption passphrases are kept solely by you; losing your decryption password will result in permanent loss of recoverable backup data. You may disable synchronization and erase all cloud‑stored backup records at any time.

1.3 Device and Runtime Log Information

To maintain application stability and resolve crash anomalies, the app may optionally collect anonymized basic device information including device model, OS version, application build version, crash stack traces and runtime error logs. Such logs are de‑identified and will not be linked to your authentication secrets. You may disable crash‑log reporting within the application settings.

1.4 Information We Do NOT Collect by Default

Unless you actively submit data manually, the Authenticator will not collect your real‑name identity, ID documents, residential addresses, contacts, photo‑gallery contents or geolocation data. The application avoids requesting unnecessary system permissions. Clipboard content will only be accessed when you manually trigger paste‑import operations for credential entries.

1.5 Permitted Use Cases for Collected Data

• (1) Generate and display dynamic one‑time verification codes for completing two‑factor authentication on third‑party platforms;
• (2) Provide encrypted cloud backup and cross‑device recovery of authentication entries when you explicitly activate sync;
• (3) Analyze crashes and runtime errors to fix defects and improve overall application stability;
• (4) Respond to your email inquiries, issue reports and personal‑data‑right requests;
• (5) Comply with mandatory legal requirements issued by competent regulatory authorities.

2. Information Storage, Security Protection and Data Retention

2.1 Local Storage Mechanism

Identity credentials are primarily stored within the iOS System Keychain protected by hardware‑backed encryption provided by the operating system. Uninstalling the application may not automatically erase Keychain‑saved data. To achieve complete removal, please delete all authentication entries inside the app before uninstalling.

2.2 Cloud Storage Security Rules

Backup packages uploaded to cloud infrastructure are encrypted with your custom passphrase. Our servers store only ciphertext without retaining your decryption password. Even in the event of unauthorized server access, third parties cannot restore your authentication secrets without your private decryption passphrase. Cloud‑backup data will be permanently purged within a reasonable period after you manually delete your cloud backup.

2.3 Data Retention Period

Local authentication entries persist until you manually delete individual records or reset the application. Cloud‑backup data is retained until you disable synchronization or remove backups. Crash logs are held for a limited period and auto‑purged without indefinite persistent storage.

3. Information Sharing, Transfer and Disclosure

3.1 No Sale of Personal Information

Xianggang Mengchuang will not sell, rent or trade your identity credentials or personal information. Without your explicit consent, we will not share your authentication secrets or backup datasets with external third‑party entities.

3.2 Limited Circumstances for Disclosure

Information may only be disclosed under the following conditions: you provide explicit authorization; competent government agencies issue formal legal documents in accordance with applicable law; disclosure is necessary to safeguard important legitimate interests of Xianggang Mengchuang, users or the public, after careful risk assessment.

3.3 Boundary for Third‑Party Services

One‑time codes generated by this Authenticator are used for logging into external third‑party websites or applications. We will not transmit your original authentication secrets to those third‑party service providers. Privacy policies operated by third‑party platforms are independent of this document and you shall review their respective privacy rules separately.

4. User Personal Data Rights and Available Operations

4.1 Operations Available Inside the Authenticator App

Within the Authenticator application, you may add, view, edit and delete each authentication entry at any time. You can toggle cloud‑backup synchronization, clear all local stored records, and disable crash‑log reporting functionality.

4.2 Exercising Rights via Email Channel

If you wish to obtain copies of your server‑stored data, request cloud‑backup deletion or withdraw previously granted consents, submit your request via our official email. After identity verification, we will respond within legally‑compliant timeframes. Certain locally‑kept data inside your device Keychain cannot be remotely operated from our cloud side and must be deleted directly on your iOS device.

4.3 Account‑Related Notes

Basic local token‑generation features do not force mandatory account registration. Virtual sync identifiers created when you enable cloud synchronization may be requested for deletion. After deletion, encrypted cloud backups will be erased, but authentication entries stored locally on your device will remain unaffected.

5. Minor Protection, Policy Revision and Contact Information

5.1 Use by Minors

The Authenticator is intended for users of all age groups. If you are under 18 years old, please use this product only with knowledge and consent from your legal guardian. Guardians may contact our official mailbox to handle issues arising from unauthorized minor usage.

5.2 Privacy Policy Update Mechanism

We may revise this Privacy Policy to reflect product upgrades and changes in regulatory requirements. Updated versions will be published on our official disclosure webpage. Material revisions will be notified via in‑app alerts. Continued use of the Authenticator constitutes acceptance of the revised Privacy Policy.