RTAuthenticator Terms of Service

Updated: November 2, 2026
Effective: November 2, 2026
Applicable software: RTAuthenticator Android and HarmonyOS clients v1.0.1 (version code 105)
Package IDs: Android top.rows.cloud.security.ml.android; HarmonyOS top.rows.cloud.security.ml
Operator: Zhang Zhibao (张治保)
Contact: rowstop@yeah.net

1. About Us

Thank you for choosing RTAuthenticator. RTAuthenticator is provided and operated by Zhang Zhibao (referred to as “we” or “us”). Contact us at rowstop@yeah.net.

These Terms of Service form an agreement between us and you for your use of the RTAuthenticator Android and HarmonyOS clients v1.0.1 (version code 105, package IDs top.rows.cloud.security.ml.android (Android) and top.rows.cloud.security.ml (HarmonyOS)).

2. Scope, Purpose, and Acceptance

Read these terms before using RTAuthenticator, especially the sections about local tokens, vault passwords, and recovery limits. Contact us if you have questions. Use the app after confirming that you accept these terms; if you do not accept them, stop using the app. Acceptance does not automatically enable optional camera or biometric permissions. Personal information is handled as described in the Privacy Policy, with any consent required by law obtained separately.

This page specifically applies to software version v1.0.1 described above. The service scope and rules for other versions are determined by their respective agreements and actual functionality. The revision date of this page does not mean that the app has been upgraded.

3. Requirements for Using the Service

The app is not specifically directed at children. Minors should use it with a guardian's consent and guidance. Users under 14 should have a guardian's consent and assistance with imported accounts, device permissions, and account recovery methods. See the Privacy Policy's section on protecting minors for details on personal information protection.

Only import accounts you own or are legally authorized to manage. Do not obtain, impersonate, or distribute other people's secret keys, QR codes, or verification codes, or use the app for fraud, unauthorized access, or other unlawful activities.

The app does not represent your account's service provider or handle account registration, login, identity verification, or recovery for third-party accounts. Each service determines its own code verification, authentication rules, and account management.

4. Service Content

RTAuthenticator is a local two-factor authentication app for importing, storing and managing tokens you are authorized to use, and generating TOTP or HOTP codes. Version 1.0.1 is free, with no ads or account registration. It does not provide automatic cloud synchronization. In addition to manual entry, OTPAuth, QR scanning and Google Authenticator migration QR codes, it supports encrypted .rta backup export and restore, compatible unencrypted 2FAS and Aegis backups, and unencrypted Bitwarden JSON or CSV imports. Encrypted third-party backups are not supported.

In About > Transfer & Backup, verify the local unlock password to export an encrypted backup, then choose a destination or recipient through the system interface. The backup password is the local unlock password used at export. Changing the local password later does not change an existing file's password. Restore requires that file's password, which may differ from the current device password; the current device keeps its own password after restore. Validated accounts are previewed and merged only after confirmation. Duplicates are skipped, preserving existing account names and HOTP counters.

You can enter secret keys manually, paste supported import links, scan QR codes, or choose photos to import. The app supports standard OTPAuth and Google Authenticator migration data compatible with the current version. Actual app functionality determines support; compatibility with every third-party authentication format or service is not guaranteed.

Codes are generated locally on your device. The in-app agreements can be read offline. Visiting the website in a browser, downloading updates or opening an app store may require internet access provided by the relevant platform.

5. Rules of Use and Local Tokens

Your vault and unlock data are processed on the current device and protected by local encryption and system security capabilities. The operator does not receive your vault and cannot look up secret keys, reset your local password, or remotely recover tokens.

Keep your device, vault password, secret keys, QR codes, and verification codes secure. Keep recovery codes or alternative verification methods for each third-party account. Do not include authentication credentials in support emails.

Keep the backup file and the password used at export, and verify the file's actual saved location. Successful system handoff does not guarantee that the recipient has saved the file permanently. Without a usable backup and its password, uninstalling, clearing app data, device damage or losing the local password may still make tokens unrecoverable. The operator does not receive your vault and cannot look up keys, reset local passwords, decrypt backups or remotely recover tokens.

Backups contain token accounts and OTP parameters, not local unlock passwords, biometric credentials, system permissions or device settings. Configure biometric unlock again on a new device. Verify codes with the relevant services before removing the old device, authenticator or external export files, and retain each service's recovery codes or alternative verification methods. Deleting tokens or clearing app data does not delete external backup copies.

TOTP depends on device time and the third-party service's settings. HOTP counters must also remain synchronized with the service. Check algorithms, code length, intervals, and counters when importing. Avoid advancing HOTP counters unnecessarily. If codes fail, check the settings or contact the relevant service provider.

Camera scanning, photo selection, and biometric quick unlock are optional. You can use manual entry and your vault password if you decline permissions. The device system performs biometric authentication; the app does not read or store raw face or fingerprint samples. Availability depends on your device and system.

Copying writes only the current code to the system clipboard. You actively provide pasted import content through the system input interface. Other apps with appropriate access may be able to read clipboard contents.

See the RTAuthenticator Privacy Policy for information types, purposes, retention, third-party engine diagnostics, and your rights:
privacy-policy.html

6. Liability

We will fulfill our obligations under the law and these terms. If problems arise from app defects, device environments, user actions, third-party services, or other causes, responsibility is determined by applicable law and the circumstances. These terms do not exclude liability that cannot legally be excluded or limit your statutory consumer or personal information rights.

7. Prohibited Conduct and Intellectual Property

Comply with laws and regulations when using the app. Do not obtain, impersonate, or distribute other people's secret keys, QR codes, or verification codes, or engage in fraud, unauthorized access, or other unlawful activities.

Rights in legally protected programs, names, graphics, and documents belong to their respective owners. Do not copy or distribute protected content beyond your authorization. Activities permitted by law and open-source component licenses are not restricted by this clause.

Your lawful rights in data you provide do not transfer to the operator through use of the app. Follow the relevant service rules when using third-party accounts.

8. Version Maintenance and Revisions

We aim to maintain the app's security and stability, but device environments, system changes, and third-party service changes may affect functionality. Obtain and update the app through trusted distribution channels. Do not provide authentication keys to software whose source you cannot verify.

If we add registration, paid services, ads, cloud sync, or other services that change the scope described here, we will explain the conditions, update these terms and the Privacy Policy, and obtain any consent required by law. These terms do not authorize future optional services. We will provide appropriate notice of changes that materially affect existing users' rights.

Updates to these terms will state the revision date and appropriately highlight significant changes. We will obtain renewed consent separately where required by law.

9. Governing Law and Disputes

These terms are governed by the laws of mainland China. Contact us by email first if a dispute arises. If consultation does not resolve it, you may seek relief from a court with jurisdiction under the law.

10. Contact Us

Send questions, feedback, or rights requests to rowstop@yeah.net. We will respond within 15 working days of receiving your request. Provide the information needed to describe the issue, but do not send secret keys, complete authentication QR codes, vault passwords, or valid verification codes.