Privacy Policy

Effective: July 7, 2026

The short version: your 2FA secrets never leave your device unencrypted, we run no servers and collect no analytics, and we cannot see your accounts or codes — ever.

1. What OTPeek stores

OTPeek stores your two-factor authentication accounts (issuer, account name, and the shared secret used to generate codes) in an encrypted vault on your device. The vault is encrypted with AES-256-GCM; the key is derived from your master password using Argon2id, or held in your device's secure keystore (Keychain on Apple platforms, DPAPI on Windows). We — the developers — have no access to it.

2. iCloud sync (optional)

If you enable iCloud Sync on Apple devices, OTPeek stores a copy of the already-encrypted vault in your personal iCloud (CloudKit private database). Only your devices, using your master password/key, can decrypt it. Apple's handling of iCloud data is governed by Apple's Privacy Policy. The same applies to optional WebDAV sync on Windows: only the encrypted vault is uploaded, to a server you choose.

3. Service logos (favicons)

To show a recognizable logo next to each account, OTPeek derives a website domain from the account's issuer name (for example, issuer “GitHub” → github.com) and requests that domain's logo from third-party icon services (Clearbit Logo API, icon.horse, and Google's favicon service). Only the derived domain name is sent — never your account name, email, secrets, or codes. Icons are cached on your device afterwards. You can turn this off any time in Settings → “Show website icons,” and no such requests will be made.

4. No advertising

OTPeek contains no ads and no advertising SDKs on any platform.

5. Purchases

Optional in-app tips are processed entirely by Apple. We receive no payment details — only an anonymous receipt. Tips are voluntary donations and do not unlock any features.

6. What we do NOT do

No accounts, sign-ups, or developer-run servers.
No analytics, telemetry, or crash-reporting SDKs.
No selling, sharing, or monetizing of your data — we never see it in the first place.

7. Your data, your control

You can export your vault at any time as an encrypted backup in an open, documented format, and delete all data by deleting your accounts or uninstalling the app (plus removing the iCloud copy from Settings if you enabled sync).

8. Children

OTPeek is a utility for managing authentication codes and is not directed at children under 13.

9. Changes & contact

We'll update this page if the policy changes; the effective date above always reflects the latest revision. Questions? Open an issue on GitHub or email jiunbae.dev@gmail.com.