Privacy Policy

1. Who we are

Ydenticator ("we", "us") provides a proprietary two-factor authenticator. Contact: fred@aquaduq.com. For GDPR purposes we act as the data controller for the account data described below.

2. What data we collect

We collect only the data necessary to provide and secure the authenticator service:

• Verified email address — used as your account identifier.
• Mobile phone number — used for 2FA delivery and device recovery.
• Questionnaire scores — point totals for Explorer, Thinker, and Performer categories, your top-scoring category, and the average time you take to answer questions. These values are stored in an encrypted payload on your device before being transmitted to us.
• Service provider metadata — account names and encrypted TOTP seeds for the services you register.
• Device identifiers — random, non-personally-identifiable tokens generated on each device to support multi-device enrollment.

3. How we collect data

Data is collected directly from you when you create your key, add a phone, scan a provider QR code, or answer a challenge question. We do not collect data from third parties or track your activity across other websites.

4. Legal basis for processing

We process your data to perform the contract with you (providing the Ydenticator service), to comply with legal obligations, and to protect the legitimate security interests of your account and our systems.

5. Encryption and security

Your questionnaire results and TOTP seeds are encrypted with AES-GCM-256 using non-extractable keys stored in your device's hardware-backed secure storage (e.g., Windows Hello / DPAPI or iOS Keychain / Secure Enclave). The encrypted payload is the only form in which your answers are stored or transmitted to our servers. We cannot decrypt your answers without the device-bound key.

5a. Storage on your device & recovery

The AES-GCM-256 key that decrypts your questionnaire payload and TOTP seeds is generated on your device and marked non-extractable: the browser will not export it and we never see it. Where the platform supports it, the key is bound to a WebAuthn passkey using the PRF extension so it is protected by your device's hardware-backed secure storage (Windows Hello / TPM, iOS Secure Enclave / iCloud Keychain, Android StrongBox). Unlocking the key requires a local biometric or PIN gesture on that device.

Because the key is device-bound, clearing your browser storage or switching devices means the local key reference is gone. On platforms that back the passkey up (e.g. iCloud Keychain) we can re-derive the key with a Face ID / Touch ID prompt. Otherwise you must re-enroll from a device that still holds the key, or answer your questionnaire again to create a new one. We cannot recover your key for you.

6. How we use your data

We use your data only to:

• Authenticate you and deliver 2FA codes.
• Verify that the device generating a code is owned by the right user at the time of 2FA delivery.
• Maintain your list of registered service providers for easy access.
• Protect against abuse, fraud, and unauthorized access.
• Comply with applicable legal obligations.

We do not use your data for advertising, profiling, or automated decision-making.

7. Data retention

We keep your account data for as long as your account is active. When you delete your account, or when we delete it after a long period of inactivity, we remove your encrypted payloads, provider records, and challenge data from our servers. The device-side keys are under your control and can be removed by clearing the app data on your device.

8. Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to receive a copy of it in a portable format. To exercise these rights, contact us at fred@aquaduq.com. We will respond within 30 days.

9. Third parties

We use Lovable Cloud (backend infrastructure and authentication) to host the service. We do not sell your data or share it with advertisers. Service providers you register (e.g., websites for which you enable 2FA) operate independently and are covered by their own privacy policies.

10. International transfers

Your data is stored in the EU (Lovable Cloud default region). If we ever need to transfer data outside the European Economic Area, we will use appropriate safeguards such as Standard Contractual Clauses and ensure the destination country provides an adequate level of protection.

11. Children

Ydenticator is not intended for users under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us.

12. Cookies & tracking

We use only strictly necessary storage (session token, device identifier, encrypted key material). No advertising or analytics cookies.

13. Changes

Material changes to this policy will be announced in-app at least 30 days before taking effect. The effective date at the top of this page reflects the latest version.

14. Contact / DPO

For privacy questions or to exercise your rights, email us at fred@aquaduq.com.

By using Ydenticator, you confirm that you have read and agree to this Privacy Policy.