Your keys. Your control.
Privacy policy for Key369 Authenticator, Google Play edition (app.key369.authenticator). Updated October 7, 2026.
Key369 is provided by 369Apps. This policy explains the Android app’s account, purchase and optional cloud features. Questions and deletion requests: 369apps.studio@gmail.com.
Authenticator keys and device access
TOTP secrets, labels and generated codes are processed in your device’s encrypted vault. Camera frames and images you select are decoded on the device to read QR codes; the app does not upload those images. Android handles device-lock and biometric authentication. Key369 does not receive fingerprint or face templates.
Keys leave the device only when you choose to export an encrypted backup or enable encrypted cloud backup. Your backup password and decryption key are not sent to the account or payment server. Neither an email sign-in code nor restoring a purchase can replace the backup password or recover missing keys.
Information used by the service
| Email and account ID | For email sign-in, account management, trial eligibility and linking your optional cloud backups and purchases. |
| Purchase information | Google Play purchase tokens, product IDs, account binding and subscription or entitlement status are used to verify, restore and maintain PRO access. Google handles payment details; Key369 does not receive your full card number. |
| Encrypted cloud backups | If enabled, the server stores encrypted backup contents, account ownership, version numbers, sizes and timestamps. They are used only to provide backup, sync and recovery. |
| Aggregate app activity | A launch event includes platform and app version. Daily counters contain no email, TOTP keys, vault contents or persistent device identifier. There are no advertising SDKs or advertising cookies. |
| Technical and support information | Hosting and email providers process ordinary request information, including IP addresses and message delivery details. Abuse limits use protected email/IP values. Support receives the information you choose to send. |
Providers and security
Supabase hosts account and encrypted cloud data. Email delivery uses the configured Google email service. Google Play processes purchases and communicates purchase status through its services. Providers process information needed to operate, secure and deliver these features, subject to their applicable terms and privacy practices. Data may be processed outside your country.
Network communication uses HTTPS. Sessions are protected on the device and stored as verification hashes on the server. Purchase verification credentials stay on the server. Key369 does not sell your personal information or use it for advertising.
Retention
Email sign-in codes expire after 10 minutes. Sessions last up to 30 days unless revoked earlier. Aggregate daily counters are retained for up to 400 days. Older cloud versions are retained for up to 30 days; your latest cloud backup remains until cloud data or your account is deleted. Cloud quotas may limit uploads.
Account and purchase information is retained while needed to provide access, restore purchases, prevent fraud, resolve disputes and meet applicable legal obligations. After account deletion, encrypted cloud contents, sign-in sessions and the account email are removed from the active account service. Limited transaction records and protected trial-eligibility or purchase fingerprints may be retained for those purposes. Deleted records may remain temporarily in restricted provider backups until those backups expire; they are not used to restore an active account.
Choices and deletion
You can keep using saved local codes without cloud backup. Exporting a backup, sending a support email and making a purchase are your choices. Cloud uploads require PRO, an active trial or a verified owner grant; existing cloud copies remain readable after PRO expires.
Request account deletion here or use Account → Request account deletion in the app. You do not need to reinstall the app. We verify ownership before deleting account data. Never send TOTP secrets or backup passwords to support.
Deleting your account or uninstalling Key369 does not cancel a Google Play subscription. Manage subscriptions separately in Google Play. Deleting the cloud account does not erase files exported to your devices or other destinations. Keep any backup you need before requesting deletion.
Children and policy changes
Key369 is a general security utility and is not directed to children. If you believe a child has provided personal information improperly, contact support. We update this policy when service behavior changes and show the revision date above.