Privacy policy

Effective date: November 4, 2026

This policy covers the Black Vault Authenticator app for Android (“the app”) and this website, bvauth.com. They are operated by Black Vault Authenticator (“Black Vault”, “we”).

The short version

The app collects nothing. It has no accounts, no analytics, no advertising and no internet access in this version. Everything stays on your phone, or in a backup file that you create and control.

This website uses no cookies, analytics or trackers. Our website host, Cloudflare, and our security layer keep limited technical records, such as your IP address, to deliver the site and keep it safe. Details are below.

Who we are

Black Vault Authenticator is the operator of the app and this website. For anything in this policy, write to support@bvauth.com.

The app

• No data collection. We do not collect, receive, store or share any information from the app: not your accounts, codes, backup files, device details, usage or location.
• No accounts. You do not sign up for anything, and we have no record that you use the app.
• No analytics, ads or trackers. The app contains no analytics, advertising or crash-reporting code.
• No internet access. In this version the app does not have permission to use the internet, so it cannot send information anywhere.
• Your data stays on your phone. Your accounts and codes are stored in an encrypted file on your phone. The key is kept in your phone’s protected key storage (in dedicated security hardware where the phone has it), and the app opens only with your fingerprint, face or screen lock.
• Settings. The app keeps a few non-secret settings on the phone, such as the lock timeout. They never leave the phone.
• Backups. A backup is a file you choose to create and save wherever you want. It is encrypted with a passphrase that only you know. We never receive it and cannot read it, and we cannot recover your passphrase. Android’s own cloud backup and device-to-device transfer are switched off for the app, so nothing is copied off the phone unless you export a backup. If you save a backup to a cloud drive or another app, that provider’s privacy policy applies to the file.
• Clipboard. If you copy a code, the app marks it as sensitive and clears it from the clipboard after 45 seconds.
• Screens. The app asks Android to block screenshots, screen recordings and the recent-apps thumbnail for its windows.

Permissions the app asks for

• Camera. Used only so that you can scan a QR code to add an account. Scanned images are read on the spot and are not saved or sent anywhere.
• Biometric. Used to unlock the app with your fingerprint, face or screen lock. The app never sees your fingerprint or face data; Android handles it.
• Hide overlay windows. Used to hide other apps’ overlay windows while the app is in front, so that nothing can cover its buttons.

The app does not ask for permission to use the internet.

This website

• The website is a set of static pages. It has no accounts or forms, runs no scripts, and sets no cookies of its own. We do not use analytics or trackers, and its pages do not load anything from other companies. Fonts and images come from bvauth.com itself.
• The website is hosted on Cloudflare, which processes technical details of each request, such as your IP address, browser type, the page requested and the time, to deliver the page and protect the site against abuse. Cloudflare keeps these under its own retention practices and privacy policy.
• If you email us, we receive your email address and what you write. We use them only to reply to you and to keep a record of the conversation.

Security records

We protect the website with Black Vault Watchtower, a security layer that runs in front of it. When it refuses or flags a request (for example, a visit from outside the United States, an automated scan for weak spots, an attack attempt or too many requests too fast), it records the decision. A record can include the date and time, your IP address, the country, the approximate city or region when Cloudflare provides it, the network (ASN) and its owner, the page you asked for, your browser’s user-agent text, and what the security layer decided and why.

• Detailed records of this kind are deleted after 90 days.
• For every request, including normal ones, the security layer adds to hourly counters that contain no IP address or other personal detail. They are kept for up to 400 days.
• If an address behaves in a hostile way, it can be blocked for a limited time, or permanently after repeated offences. The address is kept while a block is in force, and otherwise for up to 30 days after its last activity.

We use these records only to keep the website secure, to investigate abuse, and to meet legal obligations. They are not used for advertising or to build profiles of visitors.

United States only

The website is only available from the United States. Visitors from other countries are refused, and the refusal is recorded as described above.

Service providers

We use Cloudflare to host this website and to deliver and protect it. Cloudflare processes request data on our behalf and under its own terms. The app does not communicate with anyone, so no service provider receives anything from it.

No selling or sharing

We do not sell personal information, we do not share it for advertising, and we do not rent it. We share information only with the service provider named above as needed to run the website, when you ask us to, or when the law requires it. We respond to valid legal process and limit what we disclose to what the request requires. Because the app collects nothing, we have nothing from the app to disclose.

Security

We protect the information we hold with reasonable technical and organizational safeguards. The Security page explains how the app protects your codes. No method of storage or transmission is perfectly secure, so we cannot guarantee absolute security.

Children

The app and website are not directed at children under 13, and we do not knowingly collect information from them. Because the app collects no information, there is nothing to collect from anyone. If you believe a child has written to us, contact us and we will delete the message.

Your choices and rights

You can ask us to tell you what personal information we hold about you, to correct it, or to delete it, by emailing support@bvauth.com. In practice, the only information we may hold about you is an email you sent us and the security records described above. We may need to confirm who you are before acting, and we will not treat you differently for making a request.

Depending on where you live, for example in Texas or California, state privacy laws may give you rights to know, access, correct and delete your personal information and to opt out of its sale or sharing for advertising. We do not sell or share personal information in that way. If you are unhappy with our answer, you may contact your state attorney general.

For the app, you control your information directly: you can delete all of it by uninstalling the app or clearing its storage, and you can delete any backup file you made.

International users

We are based in the United States, and the website is available only from the United States. If you use the app elsewhere, your information still stays on your phone, but this policy is written for use in the United States.

Changes to this policy

If we change this policy, we will post the new version on this page with a new effective date. If a change affects what happens to your information, we will say so clearly at the top of this page and in the app’s store listing before it takes effect. We will update this policy before any version of the app that uses the internet is released.

Contact

Questions about privacy: support@bvauth.com. See also our Terms of use.