Privacy Policy¶
Private Authenticator (also shown as PrivAuth) is made by Pebble IT Solutions Pty Ltd, Australia ("we", "us"). This policy explains what the app does with your information. The short version: it keeps everything on your devices, and we never see any of it.
Last updated 26 September 2026.
The short version¶
- The app has no account and no sign-up. We don't know who uses it.
- Your accounts and their setup keys are stored on your iPhone, in its Keychain. They are never sent to us or to anyone else by the app.
- The app collects no analytics, shows no adverts and contains no third-party tracking.
- The app makes no network connections of its own. The only times it opens anything on the internet are when you tap a link to the Pebble IT website or to this documentation, which open in your browser.
What the app stores, and where¶
| Information | Where it's kept | Who can read it |
|---|---|---|
| Your accounts: setup keys, code settings, names, descriptions, tags, archived state and when you last used each | Your iPhone's Keychain | Only Private Authenticator on your iPhone, after Face ID or Touch ID for the keys |
| The same accounts, if you chose Sync via iCloud Keychain | Your iCloud Keychain, encrypted end to end by Apple | Only your own devices signed into your Apple ID. Apple's own policy governs iCloud Keychain |
| Your tag list and your settings | Your iPhone's app storage | Only the app |
| Accounts sent to your Apple Watch, if you turned on Device Sync | Your Apple Watch's Keychain, behind the Watch's passcode | Only the Watch app |
| Backups you make | Wherever you save them (Photos, Files, or elsewhere), encrypted with a recovery key that only you have | Anyone with both the images and the key |
The app never sends any of this to us. We have no server that could receive it.
Permissions¶
- Camera: used only to read a QR code while the camera screen is open.
- Photos, add only: used only to save backup images. The app cannot see your photo library. When you choose a screenshot or backup images to read, iOS shows its own picker and passes the app only what you selected.
- Face ID or Touch ID: used to confirm it's you before a code is shown, before settings are changed, and before anything is deleted, exported or backed up. The recognition happens inside iOS; the app only learns whether it succeeded.
Information you choose to share¶
Some features copy information off your iPhone, but only when you use them, and only to where you point them:
- iCloud Keychain sync stores your accounts in your iCloud Keychain, under Apple's terms.
- Backups, exports and Share Key put encrypted backup images, QR codes or a recovery key wherever you save or send them.
- Copy puts a code on the clipboard for 30 seconds (on this iPhone only), or a recovery key for two minutes (which may reach a nearby Mac of yours through Universal Clipboard).
- Device Sync sends your accounts to your own paired Apple Watch over its private connection.
Children¶
The app is suitable for anyone old enough to have accounts that use two-step verification. It collects no personal information from anyone, of any age.
Changes to this policy¶
If this policy changes, the new version will be published here with a new date. The app itself can't be changed to collect information without a new version of the app appearing in the App Store.
Contact¶
Questions about privacy: privauth@pebbleit.com.au.
Pebble IT Solutions Pty Ltd, Australia. www.pebbleit.com.au
Continue to the Disclaimer.