Privacy Policy

1. Summary

HostSpica Authenticator is designed to collect nothing. It has no account system, no analytics, no advertising SDK, and no server of any kind — the app cannot make a network request even if it wanted to, because the Android app manifest does not declare the INTERNET permission. This policy explains exactly what that means.

2. Data we collect

None. Specifically:

• • No account or sign-up, so no name, email, or identity is ever collected.
• • No analytics, crash reporting, or advertising SDKs are included in the app.
• • No usage data, device identifiers, or diagnostics are sent anywhere.
• • No cookies (the app is not a website).

3. What's stored, and where

Account names and secret keys you add are stored only on your device, encrypted with AES-256-GCM using a key held in the Android Keystore (hardware-backed where the device supports it). We — HostSpica — never see this data. It never leaves your device unless you deliberately export an encrypted backup file yourself, to a location you choose.

4. Permissions the app requests, and why

• • Camera — only to scan a QR code on-screen when you add an account. The camera feed is processed entirely on-device to read the code; it is never recorded, stored, or transmitted.
• • Biometric / device credential — to lock the app and gate sensitive actions (viewing a code, exporting a backup, deleting an account). Biometric data itself is handled entirely by the Android OS; the app never receives or stores it.
• • Storage (via the system file picker) — only when you choose to export or import a backup file. The app does not browse your files outside what you explicitly pick.

The app does not request and cannot be granted network/internet access.

5. Backup files

A backup file you export is encrypted with a password only you know (PBKDF2-HMAC-SHA256, 600,000 iterations, AES-256-GCM), and saved wherever you choose to put it. HostSpica has no access to it and no way to recover it if you lose the password — there is no backdoor.

6. Google Play services used by the app

The app uses Google Play's in-app update and in-app review features. These communicate with the Google Play Store app already installed on your device (not with HostSpica), to check for app updates and to optionally show Google's native review prompt. This is governed by Google Play's own privacy policy, not ours — HostSpica does not receive any data through these features.

7. Third-party sharing

There is nothing to share, because nothing is collected. HostSpica does not sell, rent, or transmit any user data, because none passes through our hands.

8. Children's privacy

This app does not knowingly collect information from anyone, including children, because it does not collect information from anyone.

9. Changes to this policy

If this app's data practices ever change, this page will be updated before that change ships, and the app's in-app version number will reflect it.

10. Contact

Questions about this policy or the app: [email protected]