RTAuthenticator Privacy Policy

Updated: October 15, 2026

RTAuthenticator is provided by Zhang Zhibao (张治保, “we”) to manage two-factor authentication tokens on this device, generate TOTP/HOTP codes, and import accounts through scanning, photos, manual entry, and Google Authenticator migration data. This statement describes how we handle your personal information.

We value your personal information and privacy and provide appropriate safeguards in accordance with legal requirements and established industry security standards.

The following summary explains the purposes, methods, and scope of personal information processing. In addition to the main features, the following processing activities apply:

The initial release is free, with no ads, registration, or cloud sync. Tokens and unlock data you enter or import are processed and encrypted on this device, without being uploaded to the operator or third parties. Camera scanning, photo import, and biometric unlock are optional; you can use manual entry and a local password instead. Engine performance and error diagnostics are described under “Third-Party SDKs” and do not include token secrets or verification codes. You can view tokens, edit their names, or delete them. Clearing app data deletes the local vault. Contact: rowstop@yeah.net.

1. How We Collect and Use Personal Information

We use personal information only where there is a lawful basis, such as your consent, necessity for entering into or performing our contract with you, or compliance with legal obligations, as permitted by applicable law.

1.1 We provide local token management, code generation, scanning/migration import, and optional secure unlock. These features require the information needed to perform our contractual obligations. Without it, the corresponding features or services may be unavailable.

With your consent, the app processes local token data: service and account names, OTP secrets, algorithms, code lengths, intervals, HOTP counters, verification codes, import links, and migration QR contents. Secret keys are sensitive authentication credentials used only on this device for import, code calculation, and encrypted storage; they are not uploaded to us or third parties. Local unlock data includes temporarily entered passwords, password derivation parameters, encrypted records, quick-unlock settings, system authentication results, and enrollment-state checks. Plaintext passwords and raw face or fingerprint samples are not stored. Photos are read only when you actively select them. Copying writes a code to the clipboard only at your request; the app does not browse clipboard contents.

“Collection” here means reading and processing information on this device after you actively enter or import it, without transmitting it to the operator or third parties. Camera, photo import, and biometrics are optional; you can use manual entry and a password instead. Keep secrets, QR codes, and verification codes secure to protect your accounts.

2. Third-Party SDKs

Some features use partners' software development kits (SDKs) or similar software. We evaluate their security and require partners to protect personal information. SDKs may change as services or functionality evolve, and we will disclose updates here. SDK versions or policies may change the data involved; consult their official disclosures.

SDK 1

Company: DCloud (Beijing) Network Technology Co., Ltd. (数字天堂（北京）网络技术有限公司)

Product/type: DCloud App Engine (uni-app x, 5.26)

Information types: Engine diagnostics may process device brand/model, processor and display parameters, OS/version, network type and IP address, user agent, language/time zone, emulator or root status, and random anonymous identifiers; app name/package/version/AppId/SDK composition, exception stacks, startup time, and memory use. Support varies by platform. Random anonymous identifiers do not include OAID, IMEI, IDFA, or Android ID. Token secrets, verification codes, camera frames, vault passwords, and raw biometrics are outside this diagnostic scope.

Purpose: Provide native cross-platform runtime support and diagnose engine performance, crashes, or errors to identify problems and improve stability. Diagnostics do not include token secrets, verification codes, imported QR codes, passwords, or raw biometric samples.

When used: Engine performance and error diagnostics during app operation, subject to user authorization and platform support.

Collection method: The engine SDK processes diagnostic information directly under its own disclosures. The local token vault is not passed to the SDK.

Third-party privacy policy: https://dcloud.io/license/appprivacy.html

3. Managing Your Personal Information

You may exercise statutory rights including access, copying, correction, and deletion in the following ways.

3.1 Access

Unlock the home token list with your password or enabled quick unlock to view service names, account names, authentication types, codes, countdowns, or HOTP counters.

3.2 Correction

You have the right to correct or update personal information when necessary or when it is inaccurate.

Open Home > token “Manage” > “Edit Name” > Save to change the service or account name.

3.3 Deletion

Open Home > token “Manage” > “Delete Token” > confirm to delete the account record and local key. This cannot be recovered through the app. Keep a recovery method for the third-party service first.

3.4 Withdrawing Consent

Cancel the current operation in the system scanner or photo picker. See “Local Data Protection and Optional Features” for removing saved data and withdrawing quick-unlock authorization.

For other questions, comments, or requests about your data rights, contact us as described under “Contact Us.”

4. Storage Location and Retention

4.1 Unless otherwise required by law, information is retained only for the shortest time necessary to fulfill its processing purpose.

4.2 Information is transmitted to and stored on DCloud servers in China only for the engine diagnostics described under “Third-Party SDKs.” Core data such as tokens stays on the device and is not uploaded to any server.

5. Local Data Protection and Optional Features

1. This release is free and has no ads, registration, payments, cloud sync, or backup export. You provide token names, keys, settings, and unlock data for processing on the current device only. We do not receive your vault and cannot look up keys or recover passwords.
2. The vault is encrypted locally. Passwords are used only for local derivation and verification; plaintext passwords are not stored. HarmonyOS uses the system Asset Store to protect local keys, and the plugin disables cross-device key synchronization. Retention depends on your use and deletion actions. Deleted tokens are removed from the vault. Keep recovery codes or alternate verification methods for third-party services. Uninstalling, clearing app data, or losing a password may make tokens unrecoverable.
3. HarmonyOS uses the system scanner for camera scanning or recognizing a QR code in a selected photo. The system scanning service manages camera access; this app does not directly request user authorization to access the camera or read images/videos. We receive only the returned QR text for token import, without obtaining or storing the camera preview or original photo, browsing your photo library, or uploading scan contents. Cancel scanning or photo selection and use manual entry if you prefer. You actively provide pasted links through the system input interface; the app does not browse clipboard contents. Copying writes only the current code.
4. Face/fingerprint quick unlock is enabled only on supported devices after you set a password and separately agree. The system authenticates you; we do not obtain raw face or fingerprint data. Only local support/enabled status, authentication results, and enrollment checks are processed to prevent old authorization from remaining usable after enrollment changes. You can decline and use your password. This version has no separate in-app button to disable quick unlock. To remove all unlock data, first ensure third-party account recovery is available, then clear app data in system settings. This also deletes the vault.
5. Except for necessary diagnostics directly processed by the engine SDK, this release has no advertising, payment, marketing, or behavioral analytics SDKs, does not sell tokens, and does not use tokens for profiling. Diagnostics are stored in China for as long as needed under the engine's privacy rules, then deleted or anonymized. The server provisions in the storage section apply only to diagnostics, not local tokens. The operator does not arrange overseas transfers of local tokens.
6. There are no online accounts, so no online account deletion process is needed. After unlocking, you can view and copy codes, edit names, or confirm deletion through Manage. Clear app data in system settings to remove all local information. The operator cannot remotely access or change your device data. Support emails should contain only the necessary contact information and problem description, without keys, complete QR codes, passwords, or verification codes. Emails and handling records are used only to resolve requests and retained for the shortest necessary period, then deleted or de-identified, except where retention is required by law.
7. You may request explanations, access, copying, correction, deletion, or withdrawal of consent. If local data cannot technically be exported or handled remotely, we will explain why and describe feasible local options without restricting statutory rights. Withdrawal does not affect earlier lawful processing. Policy changes will be communicated through an updated policy and appropriate notices. New purposes, data types, recipients, or optional features require fresh consent where applicable. If a data security incident occurs, we will take remedial action and notify affected individuals and authorities as required by law.
8. Minors: The app is not specifically directed at children and does not actively collect age, identity documents, or guardian information. Minors should use it under guardian guidance; users under 14 need a guardian's consent and help importing only accounts they are authorized to manage. Children's tokens and unlock data remain on their devices and are not uploaded, used for advertising, profiling, or recommendations. Camera, photos, and biometrics are optional. Guardians should help manage permissions and recovery methods. Guardians may request explanations, restrictions, or deletion through the contact email. Local data must be managed on the device; the operator cannot view or delete it remotely.

6. Contact Us

Email: rowstop@yeah.net

Operator and personal information handler: Zhang Zhibao (张治保). Email: rowstop@yeah.net. Send access, correction, deletion, withdrawal, or other requests by email. We will reply within 15 business days of receipt. Do not send token secrets, QR codes, vault passwords, or valid verification codes.

If you are dissatisfied with our response, particularly where processing infringes your lawful rights, you may seek relief from a court with jurisdiction, an industry self-regulatory organization, or the relevant government authority. You can also ask us about possible complaint channels.

Effective: October 15, 2026