Privacy Notice

In short

• Your one-time-code secrets are stored on your Idaxis SecureWave key. The app never sends them to us or anyone else.
• The app has no user account, no advertising, no analytics and no crash reporting.
• What you keep in the app (account names, an optional remembered PIN, settings) stays on your computer, encrypted by Windows.
• We receive information only when the app checks for or downloads an update, when you download it from our website, and when you contact us. That information includes your IP address and an approximate location derived from it.

What stays on your computer

To work, the app keeps the following on your computer only. We never receive it.

• Account details: the names and issuers of the accounts on your key, their display order and the icon you chose for each. They save reading them from the key every time.
• Remembered PIN, only if you choose to remember it.
• Settings and the language you chose.

This information is encrypted with Windows' data protection for your Windows user account and stored in your profile (in Android's protected app storage on Android). The window's size and position are stored in your Windows user registry.

QR codes you scan or import are read on your computer; images are not uploaded. A code you copy is placed on the clipboard marked as not to be kept in Windows clipboard history or synced to the cloud, and is cleared after 30 seconds or when Windows locks. The Idaxis background service installed with the app relays commands between the app and your key on your computer; it does not use the network.

What stays on your security key

The secrets that generate your one-time codes are written to your key when you add an account and stay there. The app asks the key for codes; it does not store the secrets. When you add accounts and choose to copy them to a backup key, the secrets are held in the app's memory only until they are written to the backup key or the copy is cancelled, then erased. They are never written to disk or sent over the network.

Update checks and downloads

Update checks. Unless you turn them off in Settings, the app asks www.idaxis.com once a day (and whenever you choose "Check for updates now") whether a newer version exists. Like any web request, this reveals your IP address, the date and time, and the app's version (sent in the request's User-Agent). Our web server records these in its access logs. No other information about you, your key or your accounts is sent.

Updates installed from the app. When you choose to install an update, the app downloads the setup from www.idaxis.com. Besides the access log entry, we record the download: date and time, file, IP address, app version, and an approximate location (city, region, country and coordinates) derived from the IP address.

Downloads from our website. When you use a download button on www.idaxis.com, we record the date and time, the file, your IP address and the approximate location derived from it.

Our website and contact form

When you contact us through www.idaxis.com/contact, we receive your name, email address, organization (optional), subject and message, together with your IP address and the approximate location derived from it. The form uses a session cookie for the duration of your visit to protect against forged submissions, and your IP address to limit repeated submissions. We email you an acknowledgement.

Please never send us passwords, PINs, one-time codes, private keys, seed secrets, recovery codes or unredacted enrollment QR codes.

Our pages load fonts from Google Fonts, and the contact page shows an embedded Google map; your browser then connects to Google, which receives your IP address and browser information under Google's privacy policy. We do not use advertising or analytics cookies.

How we use information

• To deliver updates and know which versions are in use, so we can support them and notify users of security fixes.
• To keep our website and services secure and detect abuse.
• To answer your messages and provide support.
• To comply with law and enforce our license agreement.

We do not sell or rent personal information, use it for advertising, or use your authentication secrets or account details for any purpose (including training AI models).

Who else receives it

• Our hosting provider runs the server for www.idaxis.com, including its logs and the download records.
• Microsoft (Microsoft 365) carries and stores the emails of the contact form.
• ipwho.is receives an IP address to return its approximate location, for download records and contact messages.
• OpenStreetMap map images are shown in the contact-form email our staff receive; the map service sees our staff's request, not yours.
• Google, through the fonts and map in your browser, as described above.
• Authorities, when required by law or to protect rights and safety.
• A buyer or successor if SCB's business is sold or reorganized, under this notice.

How long we keep it

• Web server access logs: up to 12 months, then deleted automatically.
• Download records: after 12 months, the IP address, city and coordinates are removed automatically. We keep the date, the file, the app version and the state or region and country, which no longer identify you, to understand where and how the software is used.
• Contact messages and support emails: as long as needed to handle your request and keep business records, then deleted.
• Contact-form session and abuse-protection data: up to 24 hours.
• Information on your computer: until you delete it ("Forget remembered PIN" in Settings, or uninstalling the app and removing your profile data).

Your choices and rights

• Turn off automatic update checks in the app's Settings. You can still download new versions from our website.
• Ask us what personal information we hold about you, to correct it, or to delete it, by writing to info@idaxis.com. We may need to verify your request and will answer as applicable law requires. Depending on where you live, you may have further rights, including to appeal our decision or to complain to a data-protection authority.

Children, location and changes

The app and our services are not directed to children under 13, and we do not knowingly collect their personal information.

We are based in the United States, and the information described here is processed in the United States.

We may update this notice. The effective date at the top shows when it last changed; we will give notice of material changes, for example in the app or on this website.

Contact

SCB Solutions, Inc., attention Idaxis Authenticator
1001 Fillmore Street, Suite 3157, Arlington, VA 22201, USA
info@idaxis.com · www.idaxis.com/contact