Terms of use

Effective date: November 4, 2026

The short version

The app and this website are provided as they are. Your codes, your backup file and your backup passphrase are your responsibility: they live on your phone and in files you control, and we cannot recover them for you. If you lose your phone and have no backup, you may lose access to the accounts the app protected, and you will need to use each service’s own recovery options.

Acceptance of these terms

These terms govern your use of the Black Vault Authenticator app for Android (“the app”) and this website, bvauth.com (“the website”). By installing or using the app, or by using the website, you agree to these terms and to our Privacy policy. If you do not agree, please do not use them.

Who we are

The app and the website are operated by Black Vault Authenticator (“Black Vault”, “we”, “us”). You can reach us at support@bvauth.com.

What the app does

The app makes one-time sign-in codes on your phone for the accounts you add. It supports time-based and counter-based codes (the standard methods known as TOTP and HOTP). You can add an account by scanning a QR code, typing its setup key, or importing from Google Authenticator. Your accounts are stored in an encrypted file on your phone, and the app is protected by your fingerprint, face or screen lock. This version of the app does not use the internet.

Licence to use the app

We give you a personal, non-exclusive, non-transferable, revocable licence to install and use the app on Android phones that you own or control, for your own lawful purposes, under these terms. The app is licensed to you, not sold. We keep all rights that we do not expressly give you.

You may not copy, modify, rent, sell or distribute the app, or remove its notices. You may not reverse engineer, decompile or disassemble the app, except to the extent the law gives you that right despite this restriction. The app includes open-source components that are licensed to you under their own licences; nothing in these terms limits your rights under those licences.

Acceptable use

Use the app and the website lawfully. In particular, do not use the app to get into accounts you are not allowed to access, do not scan or import codes that you are not entitled to use, and do not interfere with the website. Do not try to gain unauthorized access to the website or our systems, overload or disrupt them, probe them for weaknesses without our written permission, or use automated tools to scrape or attack them. If you find a security problem, please tell us as described on the Security page.

Your responsibility for your codes and backups

Please read this section carefully. It is the most important one.

• Your codes live on your phone. The app has no accounts and no cloud sync, and it does not send anything to us. We do not have a copy of your accounts, your codes or your setup keys, so we cannot restore them.
• Unlocking the app uses your phone’s lock. The app opens with your fingerprint, face or screen lock. It does not have a separate vault password. The encryption key is kept in your phone’s protected key storage and cannot be copied out of it. If you remove your screen lock or reset or lose the phone, the stored accounts can become unreadable.
• Backups are optional and yours. The app can export an encrypted backup file (a “.bvak” file) to a location you choose, and import it later. It does not make backups by itself, and Android’s own cloud backup and device transfer are switched off for the app. You decide where a backup is saved and who can reach that place.
• Your backup passphrase cannot be recovered. A backup is protected by a passphrase of at least 12 characters that you choose. We never receive it and cannot reset it. If you forget it, the backup cannot be opened by anyone, including us.
• Keep each service’s recovery codes. Before you rely on the app for an account, save the recovery codes or other backup sign-in method that the service gives you. Deleting an account in the app removes its codes from the app, and the service will still ask for a code at sign-in.
• If you lose your phone, or the stored accounts and your backup are both gone, you may lose access to the accounts the app protected. We cannot recover those accounts or bypass those services. You would need to use each service’s own recovery process, which can be slow or may not be possible.
• Keep your phone’s clock correct. Time-based codes depend on your phone’s time. If a service rejects your codes, set your phone’s date and time to automatic.
• Only scan codes you asked for. A QR code from an untrusted source can add an account you did not intend.

Security disclaimer

We build the app to protect your codes, and the Security page describes what it does and does not protect against. No software or system is perfectly secure, and we do not promise that the app will never be attacked or defeated. The app cannot make a compromised, rooted or infected phone safe, and it cannot protect you if someone knows your screen-lock PIN or if you reveal your codes, setup keys, backup file or passphrase. The app has not been through an independent third-party security audit. You are responsible for keeping your phone, its screen lock and its software up to date and secure.

Third-party services and trademarks

The app works with services that follow the standard code methods, such as Google, Microsoft and GitHub, and with Black Vault products. Black Vault Authenticator is not affiliated with, endorsed by or sponsored by Google, Microsoft, GitHub or any other service it can generate codes for. Their names and marks belong to their owners and are used only to say what the app is compatible with. Your use of those services is governed by their terms and policies, not these.

If you install the app from an app store such as Google Play, the store’s own terms also apply to your download and use. We are not responsible for the store or for any third-party website we link to.

Intellectual property

The app, this website and their content, including text, graphics, logos, icons and design, are owned by us or our licensors and are protected by intellectual-property laws. Black Vault, Black Vault Authenticator and their logos are our trademarks. You may view the website and share links to it. Any other use needs our written permission. Fonts used on this website and in the app are used under their open licences.

Feedback

If you send us ideas or suggestions, we may use them without obligation to you. Please do not send us your backup file, passphrase, setup keys or codes; we will never ask for them.

Disclaimers

The app and the website are provided “as is” and “as available”. To the fullest extent permitted by law, we disclaim all warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, title and non-infringement. We do not warrant that the app or the website will be uninterrupted, error-free, secure against every attack, or free of harmful components, or that codes will always be accepted by every service.

Limitation of liability

To the fullest extent permitted by law, we will not be liable for any indirect, incidental, special, consequential or punitive damages, or for any loss of profits, data, accounts, access or goodwill, arising from your use of, or inability to use, the app or the website, including loss caused by a lost phone, a forgotten passphrase, a lost backup or a service’s refusal to restore your account. Our total liability for any claim relating to the app or the website is limited to one hundred US dollars (US$100). Some places do not allow these limits, so they may not apply to you.

Indemnification

You agree to indemnify and hold us harmless from claims, losses and costs arising out of your misuse of the app or the website, your breach of these terms, or your violation of the law or of another person’s rights.

Termination

You can stop using the app at any time by uninstalling it. Uninstalling deletes the stored accounts from your phone, so make a backup first if you want to keep them. We may suspend or end your licence or your access to the website if you break these terms. Sections that by their nature should continue after termination will continue, including those on intellectual property, disclaimers, limitation of liability, indemnification and governing law.

Governing law

These terms are governed by the laws of the State of Texas, United States, without regard to its conflict-of-law rules. Any dispute relating to the app or the website will be brought in the state or federal courts located in Texas, and you and we consent to their jurisdiction.

Changes to these terms

We may update these terms, for example when the app gains new features. We will post the new version on this page and change the effective date at the top. If you keep using the app or the website after a change, you accept the updated terms.

Contact

Questions about these terms: support@bvauth.com.