TechAuth Privacy Policy

Last updated: June 2026

This page describes how the TechAuth Android app, built by TechBoiL, handles your data. TechAuth is a login-approval app: it lets you approve or deny WordPress login attempts from your phone instead of typing a one-time code.

1. What TechAuth stores on your device

When you connect a WordPress site (by scanning a QR code in your WordPress admin), the app stores the site’s address, your username, and a private cryptographic key locally on your phone, inside the Android Keystore. This private key never leaves your device — not even TechBoiL can access it — and every use of it to approve a login requires your fingerprint or face unlock.

2. What TechAuth sends, and to whom

The only information TechAuth sends off your device is sent directly to the WordPress site you connect it to — never to TechBoiL or any other third party:

• The matching public key for the private key described above, so that site can verify your approvals.
• A Firebase Cloud Messaging (FCM) token, so that site can push you a login-approval notification.
• A cryptographic signature each time you approve or deny a login or an account-unlock request.

TechBoiL does not operate a central server for TechAuth and does not receive, store, or have access to any of this data. Each WordPress site you connect is responsible for the data it receives from the app, under that site’s own privacy policy.

3. Firebase Cloud Messaging

TechAuth uses Google’s Firebase Cloud Messaging to deliver push notifications. Firebase may collect standard device and diagnostic identifiers (such as a push token) under Google’s own privacy policy, available at policies.google.com/privacy. TechAuth does not use Firebase Analytics, Crashlytics, or any advertising SDK.

4. What TechAuth does not do

• No analytics or usage tracking
• No advertising or ad SDKs
• No selling or sharing of data with third parties
• No account or password storage — TechAuth never sees or stores your WordPress password

5. Removing your data

You can remove a connected site at any time from the app (tap the site, then “Remove Site”), which deletes its private key from your device. Disconnecting the device from a WordPress site’s Profile page removes that site’s copy of your public key and push token.

6. Contact

Questions about this policy can be sent to Contact@techboil.com.