Subprocessors
We rely on a short list of infrastructure providers to run TOTP Authenticator. This page names each one, what we use it for, and what data passes through it.
| Provider | Purpose | Data | Where |
|---|---|---|---|
| Apple Inc. | App Store distribution, in-app purchases | Purchase and device info, collected directly by Apple as the store operator | iOS |
| Google LLC | Play Store distribution, in-app purchases | Purchase and device info, collected directly by Google as the store operator | Android |
| Google LLC (Firebase) | Browser-extension sync bridge | A temporary six-digit code and routing info — never your account secret | Browser extension |
| Microsoft Azure | Website hosting | Standard web-server access logs | Website |
What isn't on this list
Cloud Sync backups go to your own iCloud or Google Drive account. That's a direct relationship between you and Apple or Google, not a service we contract for on your behalf, so it isn't listed as a subprocessor here even though it's how your backup is stored. See how Cloud Sync works for the full picture.
We don't currently run any analytics, advertising, or customer-support-platform vendor. See the privacy policy for what that means today and what would change first if that changes.
Changes
We'll update this page whenever we add or remove a subprocessor.