Overview
This policy covers 2FA Studio: an authenticator for two-factor sign-in codes, on Android, the web and as a browser extension.
It was built by Ahsan Mahmood, a software developer in Lahore, Pakistan. I am responsible for it, and you can reach me at aoneahsan@gmail.com.
2FA Studio is not released. I froze it on October 21, 2026, with my other idea projects, so the products already in production get finished first. It is not being developed or sold now, and these documents change before that does.
What it holds
You sign in with your Google account. Google shares your name, email address and profile photo with 2FA Studio; your Google password never reaches it.
If you used a build of 2FA Studio, it may hold:
- your Google name and email address
- the account names and two-factor secrets you add
How it is used
Only to run the part of 2FA Studio you were using. Nothing is sold, and nothing goes to anyone outside the services listed below.
The Android build shows ads through Google AdMob, which can read the advertising ID Android gives your device. You can reset or delete that ID in your Android settings.
Services it uses
| Service | What it receives |
|---|---|
| Google Firebase | Your sign-in record and the data you save, stored in Cloud Firestore. |
| Google AdMob | The ads shown in the Android build, and the device advertising ID that Android gives it. |
| Stripe | Card details, if paid plans are ever opened. They go to Stripe directly and never reach me. |
| Sentry | Error reports when something breaks: the page, the browser or device, and what went wrong. Not your content. |
| Amplitude | Counts of which screens are opened and which buttons are pressed, to see what gets used. |
| Microsoft Clarity | How pages are scrolled and clicked, with typed text masked. |
| OneSignal | A device token, only if you allow notifications. |
Each service keeps what it receives under its own privacy policy.
Please keep this out
This build is not maintained. If you added two-factor secrets to it, move them to an authenticator you trust, then delete your 2FA Studio account.
How long it is kept
Until you ask me to delete it, or until I switch the 2FA Studio backend off, whichever comes first.
Children
2FA Studio is not meant for children under 13, and I do not knowingly keep anything about them. If you think a child has used it, email me and I will delete what it holds.
Deleting your data
How to ask, what is deleted and what is kept are on the 2FA Studio account deletion page.
Changes to this policy
If this policy changes, the new version goes on this page with a new Last updated date. There is no mailing list, so that date is the notice.
Contact
- Ahsan Mahmood, Lahore, Pakistan
- Email — aoneahsan@gmail.com