Privacy Policy

Who We Are

SimplyAuth is operated by SimplyAuth LLC, an Illinois limited liability company ("SimplyAuth," "we," "us," or "our"). For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR, and similar laws, SimplyAuth LLC is the data controller of personal data collected through the App.

Contact:
SimplyAuth LLC
1600 N. Milwaukee Ave. #1116
Vernon Hills, IL 60061
United States
Email: support@simplyauth.app

What We Collect

When you sign in with Google, Apple, or email, we receive your name and email address (and a profile photo URL if one is provided by Google or Apple). We also store a unique account identifier and device tokens used to deliver push notifications to your device.

You may optionally add a phone number to your profile so trusted contacts can recognize you. Providing a phone number is optional, and you can remove it at any time.

When you connect with other people and perform verifications, we store connection records (who is connected with whom) and verification records (who verified whom, when, and the outcome). Verification phrases are ephemeral — they expire after 60 seconds and are automatically deleted within 24 hours.

Your Messages Are End-to-End Encrypted

When you share something in a Session — our encrypted messaging feature — the contents are end-to-end encrypted on your device and can be decrypted only on your recipient's device. We never see the contents of your messages. Our servers only ever hold encrypted ciphertext, which we cannot read. When a Session ends, the messages are deleted. We do not retain, back up, read, or analyze the contents of your Sessions.

What We Never Collect

How We Use Your Data

• To enable end-to-end encrypted Sessions (messaging) between you and your verified connections
• To provide identity verification between you and your trusted contacts
• To send push notifications when a verification request, message, or alert is directed to you
• To maintain your list of trusted connections
• To display your verification history
• To deliver safety features you set up, such as check-ins and distress alerts
• To manage your subscription and free trial

Third-Party Services

Google Firebase (Alphabet Inc.) — Authentication, real-time database, push notifications, and cloud functions. Firebase Privacy Policy

RevenueCat Inc. — Subscription and in-app purchase management. RevenueCat Privacy Policy

Apple Inc. / Google LLC — Sign-in and payment processing via their respective platforms.

Data Retention

Session messages are ephemeral — they are stored only as encrypted ciphertext that we cannot read, and they are deleted when the Session ends. Verification records are automatically deleted within 24 hours. Your account, connection, and subscription data is retained while your account is active. You may request deletion of all your data at any time by contacting us — we will remove your account and all associated records within 30 days.

Security

Messages shared in a Session are end-to-end encrypted — encrypted on your device and decrypted only on your recipient's device, so we cannot read them. All other data is protected by Firebase Security Rules, which ensure that only you and your verified connections can access shared data. Verification phrases are never transmitted over the phone — they exist only inside the app and expire automatically.

Children

SimplyAuth is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via the app. Continued use after changes constitutes acceptance.

Contact

Questions about this Privacy Policy? Email support@simplyauth.app.