Privacy Policy
This Privacy Policy explains what information BeatzLock Authenticator collects, why it is collected, where it is stored, how long it is kept, who it is shared with, and what control you have over it. It covers the BeatzLock apps, the BeatzLock account and sync service, notifications, update and download services, ratings, and the BeatzLock pages on the felixmokayabeatz.com website.
BeatzLock is built so that the most sensitive thing it holds, your OTP secrets, is encrypted on your device before it ever reaches a server. The service is designed to collect what it needs to work and to keep the rest out of reach.
This policy is versioned. This version accompanies BeatzLock Authenticator version. Earlier published versions remain in the document archive linked from the Privacy Policy page.
1. Who is responsible
BeatzLock Authenticator is provided by Felix Mokaya (felixmokayabeatz), who is the data controller for the information described in this policy.
Privacy contact: support@felixmokayabeatz.online/
Website: https://www.felixmokayabeatz.com/
Apps Website: https://www.apps.felixmokayabeatz.com/
2. A note on how BeatzLock is built
Two separate services sit behind BeatzLock, each with its own database:
· The account and sync service, which holds your BeatzLock account, your encrypted OTP data, your device sessions, and your notifications.
· The website and download service, which serves the download pages, the app update check, these legal documents, and the public ratings.
The two are deliberately kept apart. The website service does not hold your OTP data or your authentication secrets.
3. Information you give us
Account information
· Your email address, which is also your login.
· Your password, stored only as a salted hash. We never hold your password in readable form.
· Email verification codes you enter to confirm your address.
· If you sign in with Google on the website: your Google account identifier, your email address, your name, and the URL of your Google profile picture. The picture itself stays hosted by Google.
Profile information
· A display name, and a profile image if you upload one.
OTP account data
· The issuer, label, username, and secret for each OTP account you add, whether you scan a QR code or type the details in.
Feedback
· Your star rating, review text, and any suggestion you write.
· Support messages and anything you choose to include in them.
4. Information created while you use BeatzLock
· Your account identifier and account status.
· Authentication tokens for your signed-in sessions.
· Device session records: a device label, device type, a device identifier and fingerprint, the browser or app user agent, the network address the session was seen from, whether it is the primary device, when it was created, when it was last active, and when it was revoked.
· Push notification tokens and the platform they belong to, where you allow push.
· Sync records: device identifier, sync type and outcome, timestamps, version counters, the number of accounts in the last sync, and markers for accounts you deleted so the deletion reaches your other devices.
· Sign-in approval requests, including the requesting device's label and type, and a short-lived verification code.
· Security events, such as sign-ins, password changes, PIN changes, and backup code generation.
· Notification records, stored as encrypted payloads.
· Update and version check requests from the app.
· Server, error, and security logs containing network addresses, timestamps, and request metadata.
5. Encrypted OTP and backup data
When you enable cloud sync, your OTP account data, which can include issuers, labels, usernames, and secrets, is encrypted on your device and stored by the sync service only in that encrypted form. Backup code sets and notification payloads are stored encrypted as well.
We cannot read this data, and we cannot decrypt it for you. If you lose the key material that unlocks it, meaning your password, your recovery and backup codes, and every device holding your keys, the data cannot be recovered by anyone, including us.
6. Information stored only on your device
The app keeps the following locally, and it is not sent to us unless a feature you turn on sends it:
· Your OTP accounts and the codes generated from them.
· App settings, theme, and preferences.
· Sign-in tokens.
· Encryption key material.
· App lock and PIN data.
· Sync preferences.
Local data stays on your device until you delete it, sign out, clear the app's data, or uninstall the app. Your operating system, its cloud backups, malware on the device, and anyone with physical access to an unlocked device can all affect the safety of that local data.
7. Device permissions
· Camera, used only to scan an OTP QR code when you ask to. The image is processed on your device and is not uploaded or stored.
· Biometrics, handled entirely by your operating system. BeatzLock is told only whether the check passed. Your fingerprint or face data never reaches BeatzLock or its servers.
· Photos or files, used only when you pick a profile image or import a file you choose.
· Notifications, used to deliver security and account alerts.
You can withdraw any of these permissions in your operating system settings. The feature that relies on the permission stops working; the rest of the app continues.
8. Website information
· When you download the app, the download is counted against a country. Your network address is looked up against an offline country database to determine that country, and is used briefly to avoid double-counting a single download. What is stored is a per-country and per-day count, not a record of your download.
· Where Google Analytics is enabled, it sets cookies and reports usage of the BeatzLock web pages. This is aggregate website analytics, not a view into your app data.
· Signing in on the website uses session and security cookies, which are required for the site to work.
· Ratings you post publicly are shown with the display name you chose.
9. How we use information
· To create your account, sign you in, and keep your session secure.
· To sync your encrypted OTP data across your devices when you enable sync.
· To restore access through backup and recovery features.
· To send security and account notifications.
· To show and manage your active devices, and to let you revoke them.
· To provide update checks and app downloads.
· To display these legal documents and their archive in the app and on the website.
· To publish and moderate ratings, and to reply to feedback and support requests.
· To detect and investigate abuse, fraud, and security incidents, and to keep the records needed to do so.
· To fix defects and improve the reliability, usability, and security of the app.
We do not use your information for advertising, and we do not sell it.
10. Legal bases for processing
Where the GDPR, the Kenyan Data Protection Act, or a similar law applies, we rely on these bases:
· Performance of a contract, for running your account, sync, recovery, device sessions, and updates.
· Legitimate interests, for security, abuse prevention, debugging, and improving the service, balanced against your rights.
· Consent, for optional things such as push notifications, analytics where consent is required, and publishing a review.
· Legal obligation, where we must retain or disclose information by law.
Where processing rests on consent, you may withdraw it at any time; withdrawal does not affect processing already carried out.
11. Who we share information with
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share it only in these situations:
· Service providers who help operate BeatzLock, bound to process data only on our instructions: hosting and infrastructure, email delivery, Firebase Cloud Messaging for push notifications, Google Sign-In for website sign-in, and Google Analytics for website usage where enabled.
· Where required by law, legal process, or an enforceable government request.
· To protect BeatzLock, our users, or others from fraud, abuse, or a security threat.
· Publicly, in the case of a review you choose to publish, together with the display name you chose.
· In connection with a merger, acquisition, or transfer of the service, on notice to you and subject to this policy.
12. International transfers
BeatzLock is operated from Kenya and uses providers who may process data in other countries, including within the European Economic Area and the United States. Data protection law differs between countries.
Where we transfer personal data across borders, we rely on appropriate safeguards, such as standard contractual clauses with the receiving provider, or another lawful transfer mechanism.
13. How long we keep information
· Account records, encrypted sync data, and backup code sets: kept while your account is open, and deleted when you delete the account.
· Device sessions: kept while active, and for a limited period after revocation so you can review recent activity.
· Verification, sign-in approval, and deletion codes: short-lived, and invalidated once used or expired.
· Notification records: kept until you clear them or your account is deleted.
· Published reviews: kept until you delete the review or your account.
· Download statistics: kept indefinitely as per-country, per-day counts, which do not identify you.
· Server and security logs: kept for a limited period, typically no longer than twelve months, unless a longer period is needed to investigate an incident or to meet a legal obligation.
After deletion, residual copies may persist briefly in backups and security records before those expire on their normal cycle.
14. Your rights
Depending on where you live, you may have the right to:
· Access the personal information we hold about you.
· Correct information that is inaccurate or incomplete.
· Delete your account and the personal information tied to it.
· Object to or restrict certain processing.
· Receive a copy of certain information in a portable format.
· Withdraw consent where processing is based on consent.
· Complain to your data protection authority. In Kenya, that is the Office of the Data Protection Commissioner.
Use the controls in the app where they exist, or write to support@felixmokayabeatz.come. We aim to respond within thirty days. We may need to verify your identity first, and we will not charge you for a reasonable request. Exercising a right will never cause you to be treated worse as a user.
One limit is worth stating plainly: because your synced OTP data is encrypted with keys we do not hold, an access or portability request returns your account and service records, not decrypted OTP secrets. Those can only be read on a device holding your keys.
15. Security
We protect information with client-side encryption of synced OTP data and backup codes, hashed passwords, token-based sessions, device session controls that let you revoke access, encrypted transport, app lock and biometric options, rate limiting, and server-side hardening.
No method of storage or transmission is perfectly secure. Protect your device, password, email account, backup and recovery codes, and app PIN, and keep BeatzLock up to date.
If a breach occurs that is likely to result in a risk to your rights, we will notify you and the relevant authority as required by law.
16. Children
BeatzLock is not directed at children under 13, and we do not knowingly collect personal information from them. Where local law sets a higher age of digital consent, that higher age applies.
If you believe a child has provided personal information through BeatzLock, contact support@felixmokayabeatz.com and we will review and delete it.
17. Changes to this policy
We may update this policy. Each update is published as a new version with its own date, and the version it replaces moves to the public archive rather than being deleted, so you can see what changed and when.
Where a change is significant, we will give notice in the app, on the website, by email, or by another reasonable method.
18. Contact
For privacy questions, requests, or complaints:
Felix Mokaya (felixmokayabeatz)
Email: support@felixmokayabeatz.com
Website: https://www.felixmokayabeatz.online/
Website: https://www.apps.felixmokayabeatz.online/
Portfolio Website: https://www.portfolio.felixmokayabeatz.online/