Sign in
Privacy Policy
Last updated 12 October 2026
FoxAuth ("we", "us") is shared two-factor authentication for teams, operated by Pigeon Digital. This policy explains what we collect when you use FoxAuth (the web app at app.foxauth.com and the FoxAuth Chrome extension), why, and the choices you have.
What we collect
| Data | Why |
|---|---|
| Your email address, and your name and profile picture if you sign in with Google | To create your account, sign you in, and show teammates who is on the team. |
| Team membership and role | To decide who can see and use each code. |
| 2FA token details you add: service name, account label, website, and the secret key from the setup QR code | To generate one-time codes for you and your team. Secret keys are encrypted (AES-256-GCM) before storage, and the decryption key is held separately from the database. Teammates receive codes, never the secret key. |
| Activity records: who revealed, copied, autofilled, added, or changed a code, when, from which IP address and browser | So team admins can see how shared accounts are used, and to protect accounts from misuse. |
| A second-factor (authenticator) enrolment for owners and admins | To protect accounts that control your team's codes. |
We do not sell your data, use it for advertising, or read the accounts your codes protect. The Chrome extension only reads a page when you click it, to fill a code or scan a QR code you choose; it does not track your browsing.
Google sign-in
If you choose "Sign in with Google", we receive your name, email address, and profile picture from Google, only to create and sign in to your FoxAuth account. We do not request access to your Gmail, Drive, contacts, or any other Google data. FoxAuth's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Service providers
We use these providers to run FoxAuth. They process data only on our behalf.
- Supabase: database and sign-in (Asia-Pacific region).
- Cloudflare: hosting the app and API; holds the encryption key used to protect secret keys.
- Resend: sending sign-in emails.
- Google: optional sign-in with your Google account.
How long we keep data
We keep your account and team data while your account is active. When a token is deleted, its encrypted secret key is deleted with it. Activity records are kept for your plan's audit retention period. When you leave a team, any codes you marked "Only me" are deleted. You can ask us to delete your account and associated data at any time.
Your choices and rights
You can access, correct, export, or delete your data by contacting us. Depending on where you live, you may have additional rights under laws such as the GDPR or Australian Privacy Act; we honour these requests.
Security
Data is encrypted in transit (HTTPS) and secret keys are encrypted at rest with a key stored apart from the database. Access to codes is checked on every request, and every reveal is logged.
Contact
Questions or requests: hello@foxauth.com.