Privacy Policy

Ressl Auth is a zero-knowledge authenticator for time-based one-time passwords (TOTP / two-factor codes). This policy explains what information the service handles and how it is protected. It applies to the Ressl Auth iOS app and the Ressl Auth service operated at auth.ressl.app.

The short version: your authentication secrets are encrypted on your device with a key derived from your passphrase. They are stored only as ciphertext, and the server cannot read them, your account names, or your codes.

Information we handle

• Account information. A username and email address, used to create your account, sign you in, and send essential account email (such as verification and recovery).
• Your encrypted vault. Your TOTP secrets and the metadata you add (service names, account labels, notes, groups) are encrypted on your device with AES-256-GCM before they ever leave it. The server stores only the resulting ciphertext and cannot decrypt it.
• Security & operational data. To protect your account we record technical information such as IP address, device/browser user-agent, and timestamps for active sessions and a per-account security audit log.

How your data is protected

Your passphrase is stretched with Argon2id and never sent to the server. The resulting key encrypts a master key that, in turn, encrypts every vault entry on your device. All traffic is protected in transit with TLS. Because encryption and decryption happen on your device, the operator of the service has no way to read your secrets.

How we use information

Information is used only to provide and secure the service: to authenticate you, sync your encrypted vault between your devices, protect your account against unauthorized access, and operate the service reliably. We do not use your data for advertising or profiling.

What we do not do

• No third-party advertising, tracking, or analytics SDKs.
• No selling or renting of personal data.
• No reading of your vault contents — they are encrypted end-to-end.

Optional features that contact third parties

Service icons. If you turn on “Load Service Icons,” the app requests an icon for a service’s domain from a third-party icon provider. This shares only that domain, never your secrets or account data. The feature is off by default, so by default no service information is sent to any third party.

Data sharing

We share data only with the infrastructure providers needed to operate the service (for example, hosting), and only as required to run it. We do not share personal data with advertisers or data brokers. We may disclose information if required by law.

Data retention & deletion

Your account and encrypted vault are retained until you delete them. You can delete your entries at any time, and deleting your account removes your account data from the service. Security log entries are kept for a limited period to protect your account and are then discarded.

Your rights

You can access and export your data, correct your account details, and delete your account at any time from within the app. To exercise any privacy right or ask a question, contact us using the details below.

Children

Ressl Auth is a general-purpose security tool and is not directed to children under 13, and we do not knowingly collect data from them.

Self-hosted instances

Ressl Auth can be run on a self-hosted server. If you use an instance operated by someone other than us, that operator is responsible for the data on it, and this policy describes the practices of the official service at auth.ressl.app.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected here with a new effective date.

Contact

Questions about this policy or your data? Email rr@canus.ch.