Privacy policy

There is no OpenFactor account, no OpenFactor server, and no analytics, crash reporting, or telemetry of any kind. The app makes no network requests of its own. This is checked automatically: continuous integration searches every source file for networking and logging code and fails the build if any appears.

OpenFactor contains no crash reporting code. iOS can send crash logs to any app's developer if you have Share iPhone Analytics turned on. That is a setting in Privacy and Security, not something this app does, and not something it can turn off for you.

What is stored, and where

Your accounts and their secrets are stored on your devices, encrypted, in the iOS Keychain. The key that decrypts them is held in the app's private container on each device. It is never synced, never written to the Keychain, and never included in a device backup.

Your preferences, meaning sort order, appearance, chosen icon, whether sync is on, and the app lock settings, are stored on the device. They never include an account name or a secret.

iCloud

iCloud sync is off until you turn it on. When it is on, your encrypted accounts are offered to iCloud Keychain, which is Apple's service and is end to end encrypted. OpenFactor does not operate it and cannot read what it carries. Apple's own privacy policy governs it.

Turning sync off stops offering new changes to iCloud Keychain and returns the accounts on that device to device only protection.

Sharing

Nothing is shared with anyone. There are no third party libraries in this app, so no other company's code runs inside it.

When you export a backup, that file is yours and goes wherever you send it. When you import one, it is read on the device.

Children

The app collects no data from anyone, including children.

Contact

OpenFactor is published by ReVeNG System. Questions, problems and anything else: info@openfactor.dev. Bugs and feature requests are better as issues, where the discussion is public and searchable, but the address needs no account and reaches a person.

Security vulnerabilities: see SECURITY.md, which asks for private disclosure through GitHub Security Advisories. security@openfactor.dev works if you cannot use that, though it is not encrypted, so say only that you have found something and let the details follow through the private channel.

Changes

This policy is versioned with the source. Its history is visible in the repository.